655005101a55389ef1aefe295aacd9a17baaf9cf5c68677eea0861fe91f25ce0

Analysis

max time kernel
149s
max time network
133s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-fr
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-frlocale:fr-fros:windows10-ltsc_2021-x64systemwindows
submitted
27/07/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.exe
Size 1.0MB
Sample260727-vaej8aak61
SHA256 655005101a55389ef1aefe295aacd9a17baaf9cf5c68677eea0861fe91f25ce0
MD5 21e6beded850a6fd536cacb61bb36af7
SHA1 b4626ba3f189f2f4e2b89a2f619a3e0ecd1f1906
SHA512 2668f4d4d0d06aa94b84c5c3b9d53229f31e306b33dcd11083e4d96b833ee0dc8013dd01cfbd79b77d22be95d15c33ec64b4f21ab71cc02774887d558274ff50
SSDEEP 12288:ejV4R8ln6O19hbi4b0KUtttWWj8q8TmlP0E:Apn6OdbiE0KUtttWW38UP0
TLSH
T129352B17E35344ECC52AC4F1436B5272FD71F42A85356A2EAE85DF312F21E614A2EFA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	client.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	pastebin.com
6	pastebin.com

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4704	cmd.exe
2328	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1448	PING.EXE
2328	cmd.exe
1568	PING.EXE
4704	cmd.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1448	PING.EXE
1568	PING.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 4704	2004	client.exe	91
PID 4704 wrote to memory of 1448	4704	cmd.exe	93
PID 2004 wrote to memory of 2328	2004	client.exe	94
PID 2328 wrote to memory of 1568	2328	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1568