2590879a8cd745dbbe7ad66a548f31375ccfb0f8090d56b5e4bd5909573ac816

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
898s
max time network
424s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MrsMajor-main/DreS_X.bat
Size 360B
Sample260720-cgp1escs8m
SHA256 2590879a8cd745dbbe7ad66a548f31375ccfb0f8090d56b5e4bd5909573ac816
MD5 ba81d7fa0662e8ee3780c5becc355a14
SHA1 0bd3d86116f431a43d02894337af084caf2b4de1
SHA512 0b768995187f988dc15d055f9689cee3ab3908d10b05a625b40d9757c101e067bbd6067ccbcf1951ebb683f5259eec562802ea6161d59475ce86cf6bc7c957f2
TLSH
T127E0F7438803A00AD9982AE0C3DE0384F88BC0B38C7081A2A4473030B8A128DC23FFDF
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4732	cmd.exe

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
3468	taskkill.exe
3120	taskkill.exe
2240	taskkill.exe
5112	taskkill.exe
4388	taskkill.exe
4968	taskkill.exe
4676	taskkill.exe
2616	taskkill.exe
1104	taskkill.exe
5864	taskkill.exe
5432	taskkill.exe
5448	taskkill.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	4676	taskkill.exe
Token: SeDebugPrivilege	5112	taskkill.exe
Token: SeDebugPrivilege	2616	taskkill.exe
Token: SeDebugPrivilege	1104	taskkill.exe
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeDebugPrivilege	5432	taskkill.exe
Token: SeDebugPrivilege	5448	taskkill.exe
Token: SeDebugPrivilege	3468	taskkill.exe
Token: SeDebugPrivilege	3120	taskkill.exe
Token: SeDebugPrivilege	4968	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2240	4732	cmd.exe	87
PID 4732 wrote to memory of 4676	4732	cmd.exe	89
PID 4732 wrote to memory of 5112	4732	cmd.exe	90
PID 4732 wrote to memory of 2616	4732	cmd.exe	91
PID 4732 wrote to memory of 1104	4732	cmd.exe	92
PID 4732 wrote to memory of 4388	4732	cmd.exe	93
PID 4732 wrote to memory of 5864	4732	cmd.exe	94
PID 4732 wrote to memory of 5432	4732	cmd.exe	95
PID 4732 wrote to memory of 5448	4732	cmd.exe	96
PID 4732 wrote to memory of 3468	4732	cmd.exe	97
PID 4732 wrote to memory of 3120	4732	cmd.exe	98
PID 4732 wrote to memory of 4968	4732	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MrsMajor-main\DreS_X.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\system32\taskkill.exe
  taskkill /f /im iexplore.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\system32\taskkill.exe
  taskkill /f /im opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\system32\taskkill.exe
  taskkill /f /im yandex.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im microsoftedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5432
- C:\Windows\system32\taskkill.exe
  taskkill /f /im mspaint.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dllhost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3468
- C:\Windows\system32\taskkill.exe
  taskkill /f /im notepad.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\system32\taskkill.exe
  taskkill /f /im bing.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads