17e98d92ccfdb23c3e14aa1e5aa55e8ffd71e31a395ac8f3c122c7436303bab5

Resubmissions

20/07/2026, 18:41

260720-xbwagabz5k10

18/07/2026, 22:36

260718-2jnmtahs6t10

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Private Bypass/yonetici calistir sonra loaderi aç.bat
Size 636B
Sample260718-2jnmtahs6t
SHA256 17e98d92ccfdb23c3e14aa1e5aa55e8ffd71e31a395ac8f3c122c7436303bab5
MD5 6de192f8e7f86649535e833623974a6b
SHA1 4e2cdb3c243fe656884fe199e21e9e45c4ec567a
SHA512 35e50867a9628d84cf43ed2ea79ecec38734dc1eac3011a13ac442fb998e31d31a965864bf6edee0d5bf9854725a312880582f39296737b303df9456c3ba69cc
TLSH
T198F0810A84EC85CF38D2FB3437D3A722471E75ADB963A2E91F91901D008828326ED48F
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4432	netsh.exe
1192	netsh.exe
2856	netsh.exe
5012	netsh.exe
4948	netsh.exe
4528	netsh.exe
1700	netsh.exe
5108	netsh.exe
2700	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1168	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 4432	1168	cmd.exe	86
PID 1168 wrote to memory of 5012	1168	cmd.exe	87
PID 1168 wrote to memory of 1192	1168	cmd.exe	89
PID 1168 wrote to memory of 4948	1168	cmd.exe	90
PID 1168 wrote to memory of 4528	1168	cmd.exe	93
PID 1168 wrote to memory of 1700	1168	cmd.exe	94
PID 1168 wrote to memory of 5108	1168	cmd.exe	96
PID 1168 wrote to memory of 2856	1168	cmd.exe	99
PID 1168 wrote to memory of 2700	1168	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Private Bypass\yonetici calistir sonra loaderi aç.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\system32\netsh.exe
  netsh advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4432
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5012
- C:\Windows\system32\netsh.exe
  netsh advfirewall set currentprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1192
- C:\Windows\system32\netsh.exe
  netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4948
- C:\Windows\system32\netsh.exe
  netsh advfirewall set privateprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4528
- C:\Windows\system32\netsh.exe
  netsh advfirewall set publicprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1700
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5108
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2856
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall set rule all new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2700