f01a1d81cc15187304360905980a01fca029e221cfd7eff5543adeadfdd0b415

Analysis

geolocation tags

eueuropefrfrance
max time kernel
29s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20260513-fr
resource tags

arch:x64arch:x86image:win10v2004-20260513-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
27/07/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6/!!!!RUNME!!!!!.bat
Size 1KB
Sample260727-qaqv2afk9s
SHA256 f01a1d81cc15187304360905980a01fca029e221cfd7eff5543adeadfdd0b415
MD5 b85b07c305578fe29c88fed4a348a891
SHA1 028203b9a34fcc6ca6c47d67c14619d00b5b36f8
SHA512 3cced910a3e9b772c0f6579ab5daefe9ce84836e7339caea4f070572b1f31f62e3c7d2cb38a66aba88f2b2e096d5560b7b1bd136daeed8cfcbc6c1efa3b28950
TLSH
T1BE21FF63A2D6E09019E0899F70C3BE15ED8B2DE7209F59EB3DC352D5006992DA704B92
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2784	sc.exe
3824	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4260	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1184	timeout.exe
1116	timeout.exe

Runs net.exe

Suspicious behavior: LoadsDriver 27 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4160	4260	cmd.exe	85
PID 4260 wrote to memory of 2908	4260	cmd.exe	86
PID 4260 wrote to memory of 3748	4260	cmd.exe	87
PID 4260 wrote to memory of 2740	4260	cmd.exe	88
PID 4260 wrote to memory of 3212	4260	cmd.exe	89
PID 4260 wrote to memory of 4372	4260	cmd.exe	90
PID 4260 wrote to memory of 2156	4260	cmd.exe	91
PID 4260 wrote to memory of 2840	4260	cmd.exe	92
PID 4260 wrote to memory of 4656	4260	cmd.exe	93
PID 4260 wrote to memory of 1152	4260	cmd.exe	94
PID 4260 wrote to memory of 4512	4260	cmd.exe	95
PID 4260 wrote to memory of 416	4260	cmd.exe	96
PID 4260 wrote to memory of 3280	4260	cmd.exe	97
PID 4260 wrote to memory of 392	4260	cmd.exe	98
PID 4260 wrote to memory of 2464	4260	cmd.exe	99
PID 4260 wrote to memory of 4952	4260	cmd.exe	100
PID 4260 wrote to memory of 1236	4260	cmd.exe	101
PID 4260 wrote to memory of 4772	4260	cmd.exe	102
PID 4260 wrote to memory of 3704	4260	cmd.exe	103
PID 4260 wrote to memory of 4396	4260	cmd.exe	104
PID 4260 wrote to memory of 1948	4260	cmd.exe	105
PID 4260 wrote to memory of 2600	4260	cmd.exe	107
PID 4260 wrote to memory of 560	4260	cmd.exe	109
PID 4260 wrote to memory of 4912	4260	cmd.exe	110
PID 4260 wrote to memory of 2796	4260	cmd.exe	111
PID 4260 wrote to memory of 2644	4260	cmd.exe	112
PID 4260 wrote to memory of 4872	4260	cmd.exe	113
PID 4260 wrote to memory of 3376	4260	cmd.exe	114
PID 3376 wrote to memory of 4132	3376	net.exe	115
PID 4260 wrote to memory of 4780	4260	cmd.exe	116
PID 4780 wrote to memory of 4348	4780	net.exe	117
PID 4260 wrote to memory of 2784	4260	cmd.exe	119
PID 4260 wrote to memory of 1184	4260	cmd.exe	120
PID 4260 wrote to memory of 3824	4260	cmd.exe	121
PID 4260 wrote to memory of 1116	4260	cmd.exe	123

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\6\!!!!RUNME!!!!!.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SU auto
  2⤵
  PID:4160
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SS "151721200"
  2⤵
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SV "1.0"
  2⤵
  PID:3748
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CSK "171703056"
  2⤵
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CM "270037127"
  2⤵
  PID:3212
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SP "MS-7D23"
  2⤵
  PID:4372
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SM "Micro-pro International Co., Ltd."
  2⤵
  PID:2156
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SK "242716728"
  2⤵
  PID:2840
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SF "1089717131"
  2⤵
  PID:4656
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BM "Micro-pro International Co., Ltd."
  2⤵
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BP "H510M-A PRO (MS-7D23)"
  2⤵
  PID:4512
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BV "1.0"
  2⤵
  PID:416
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BT "108827099"
  2⤵
  PID:3280
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BLC "2515718811"
  2⤵
  PID:392
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PSN "180218875"
  2⤵
  PID:2464
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PAT "2066919177"
  2⤵
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PPN "3110130314"
  2⤵
  PID:1236
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CSK "14949326"
  2⤵
  PID:4772
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CS "9613946"
  2⤵
  PID:3704
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CV "1.0"
  2⤵
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CM "Micro-pro International Co., Ltd."
  2⤵
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CA "78653166"
  2⤵
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CO "0000 0000h"
  2⤵
  PID:560
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CT "03h"
  2⤵
  PID:4912
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IV "3.80"
  2⤵
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IVN "American Megatrends International, LLC."
  2⤵
  PID:2644
- C:\Users\Admin\AppData\Local\Temp\6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BS "650313906"
  2⤵
  PID:4872
- C:\Windows\system32\net.exe
  net stop winmgmt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop winmgmt /y
    3⤵
    PID:4132
- C:\Windows\system32\net.exe
  net start winmgmt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start winmgmt /y
    3⤵
    PID:4348
- C:\Windows\system32\sc.exe
  sc stop winmgmt
  2⤵
  - Launches sc.exe
  PID:2784
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:1184
- C:\Windows\system32\sc.exe
  sc start winmgmt
  2⤵
  - Launches sc.exe
  PID:3824
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:1116