6d9b8c1ed1c512d747f3f4996c1d99c1c0cf0559e9f5538cb8c11b2613d5a297

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rootkit/RunAsAdmin.bat
Size 213B
Sample260717-a77baagy9k
SHA256 6d9b8c1ed1c512d747f3f4996c1d99c1c0cf0559e9f5538cb8c11b2613d5a297
MD5 0070056d35edeb1b22b078e29b86a5a4
SHA1 69cf9e268bb4138e2f71668d69aa26640e00f987
SHA512 a0abe59a07b5840030e100a9c62585696663be4dfe20d5e160a9e583fca0e1655e4b605d914c5f232bd49df02c11b841a198c9458c793bc8c86e40b79ddd4810
TLSH
T188D0220387C0A70331994D02E20B6C347D32753C89BA20A0CF4D72C4E00829E8370FF5
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\lrkndrv.sys	cmd.exe
File opened for modification	C:\Windows\system32\drivers\lrkndrv.sys	cmd.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1588	sc.exe
5720	sc.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3876	regedit.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3876	2660	cmd.exe	88
PID 2660 wrote to memory of 1588	2660	cmd.exe	89
PID 2660 wrote to memory of 5720	2660	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\rootkit\RunAsAdmin.bat"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\regedit.exe
  regedit /s soft.reg
  2⤵
  - Runs .reg file with regedit
  PID:3876
- C:\Windows\system32\sc.exe
  sc create lrkndrv start= boot binpath= system32\drivers\lrkndrv.sys type= kernel group= "System Reserved"
  2⤵
  - Launches sc.exe
  PID:1588
- C:\Windows\system32\sc.exe
  sc start lrkndrv
  2⤵
  - Launches sc.exe
  PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads