655005101a55389ef1aefe295aacd9a17baaf9cf5c68677eea0861fe91f25ce0

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260513-fr
resource tags

arch:x64arch:x86image:win11-20260513-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
27/07/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.exe
Size 1.0MB
Sample260727-vaej8aak61
SHA256 655005101a55389ef1aefe295aacd9a17baaf9cf5c68677eea0861fe91f25ce0
MD5 21e6beded850a6fd536cacb61bb36af7
SHA1 b4626ba3f189f2f4e2b89a2f619a3e0ecd1f1906
SHA512 2668f4d4d0d06aa94b84c5c3b9d53229f31e306b33dcd11083e4d96b833ee0dc8013dd01cfbd79b77d22be95d15c33ec64b4f21ab71cc02774887d558274ff50
SSDEEP 12288:ejV4R8ln6O19hbi4b0KUtttWWj8q8TmlP0E:Apn6OdbiE0KUtttWW38UP0
TLSH
T129352B17E35344ECC52AC4F1436B5272FD71F42A85356A2EAE85DF312F21E614A2EFA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	client.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	client.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2100	cmd.exe
4296	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5128	PING.EXE
2100	cmd.exe
1632	PING.EXE
4296	cmd.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1632	PING.EXE
5128	PING.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 2100	4980	client.exe	79
PID 2100 wrote to memory of 1632	2100	cmd.exe	81
PID 4980 wrote to memory of 4296	4980	client.exe	82
PID 4296 wrote to memory of 5128	4296	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5128