d53e499a70b5276866e88cd1ce6a92af58b6eb5580df82f45537de9af60b1ba1

Analysis

user interaction
yes
max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
usernamesniper.bat
Size 1KB
Sample260715-ylm8aadv9k
SHA256 d53e499a70b5276866e88cd1ce6a92af58b6eb5580df82f45537de9af60b1ba1
MD5 1674b915ef530e34722b3dfe6c876a8f
SHA1 69fa7a44900456a245d65aa91470c4a42cfc0816
SHA512 2581710cc5c13c68223d85c01bf9feb1e904f165fde2ef3d5d4e2c2e4334d40a2596bd2beb2da66dcfe7cee030f1dd5c9bb7d4721b399a68d79d55ba9ada3c9e
TLSH
T15231F0261041B36A0A77DB7ACC42A121FD9886AB070D1EC9B65D82943FE855BD3F7783
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2836	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 2836	3124	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\usernamesniper.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command $token = ""; $target = ""; $headers = @{ "Authorization" = $token; "Content-Type" = "application/json" }; $body = @{ username = $target }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads