b6cd79a1fc147046cdca607e3ad30274ad7a5aa8544a0221455a1b4305962d42

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B 6 L.exe
Size 593KB
Sample260727-ph4w7astgx
SHA256 b6cd79a1fc147046cdca607e3ad30274ad7a5aa8544a0221455a1b4305962d42
MD5 23d85c693614bedaed9142bfcbd7cb77
SHA1 e5556d7ef81d95dc7cdf1b78ef28d2decb93654c
SHA512 b82bf7690219fe0aba54b3180aea8daf8ccc97741b2ba23641cc1437a8fd3c889b5006167a36fc79a131de61bd690c7a08c641d84dd03205ba82e46c9130edfc
SSDEEP 12288:31ixytRvGF+JAx05dew7msZN0XLpUP6w:CytlGkGxQew7mWILpfw
TLSH
T11CD47D56A7E904EAD1A7C13C8647C613E7B2B45A13109BDB43A0C9792F13BE56F3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3544	cmd.exe
3748	cmd.exe
1956	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1600	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3748	2608	B 6 L.exe	90
PID 3748 wrote to memory of 3760	3748	cmd.exe	91
PID 3748 wrote to memory of 2256	3748	cmd.exe	92
PID 3748 wrote to memory of 252	3748	cmd.exe	93
PID 2608 wrote to memory of 1956	2608	B 6 L.exe	96
PID 1956 wrote to memory of 3544	1956	cmd.exe	97
PID 3544 wrote to memory of 1600	3544	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\B 6 L.exe
"C:\Users\Admin\AppData\Local\Temp\B 6 L.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\B 6 L.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\B 6 L.exe" MD5
    3⤵
    PID:3760
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2256
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads