Analysis
- user interaction
yes - max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
not a rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
not a rat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target not a rat.exe
- Size 389KB
- Sample260722-ceasqack5v
- SHA256 7e8ebde2c3985b88c8ba5096920b187a9f95403aa30dc91efbe3135b98644e5e
- MD5 8e04b5322f56395b65d6bafe57707196
- SHA1 9f7ee4e7e277b72e79b088a91895fcf3e115b737
- SHA512 1f699b78a1839eee3ef7773bc762593fbb197c3e6c9d4cf2fa9d7f1787db8022c1a6d888ce5b72e10dacc5aa8ffbad5be6362f2f4f4aea73cb64b32df161aafc
- SSDEEP 6144:WdkxfClO8SGgBwEUHNXnXLPhgB0S58vVZjWPoRT6gk74x0gX8CPn4AgWlFlkh:VfY/fgBevzxPn4SFlkh
- TLSH T1C5848E86F1A480E9D06BA078956BB20BF975384C07505ACB73E84D952FE37E07FBA711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3928 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4684 not a rat.exe 4684 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe 2284 not a rat.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4684 wrote to memory of 2284 4684 not a rat.exe 90 PID 2284 wrote to memory of 3928 2284 not a rat.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\not a rat.exe"C:\Users\Admin\AppData\Local\Temp\not a rat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\not a rat.exe"C:\Users\Admin\AppData\Local\Temp\not a rat.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
PID:3928
-
-