51f6be6279594e0dfddc705d6c3cadfd7fb387daa056b86de7dd271df4fe7a57

Analysis

max time kernel
898s
max time network
890s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/07/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.exe
Size 964KB
Sample260727-ysdx7ada43
SHA256 51f6be6279594e0dfddc705d6c3cadfd7fb387daa056b86de7dd271df4fe7a57
MD5 30c023e1fee74b9bce6af1ea04c9fa1f
SHA1 22107c835c344377bee85e3ad8dc9c58bfdfbd65
SHA512 1b48c061fd2c583a7b37176823437b232b5e8f39b2c4e08d74dadd69236d9c30f7340d809ba708b417b2045dc7bcafe3b0d72d6b8ac3f8516c228967da2b3512
SSDEEP 12288:vuvAPwRRvUJbJ6ICqZz3gOtRDp0Aj6mB9UoC0mvb:WIWUJoIZd3gSRDp0Q9UP0mD
TLSH
T1FE253A5BE36344EDC57BC170876B9372BA30F86512346A7E1E85CB312F21E705A6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	client.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16431	pastebin.com
16432	pastebin.com
16436	pastebin.com
16437	pastebin.com
2	pastebin.com
3	pastebin.com

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1728	cmd.exe
4824	cmd.exe
4648	cmd.exe
3276	cmd.exe
4652	cmd.exe
460	cmd.exe
3704	cmd.exe
1692	cmd.exe
4876	cmd.exe
4812	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3532	PING.EXE
2120	PING.EXE
1692	cmd.exe
4192	PING.EXE
4876	cmd.exe
4812	cmd.exe
2308	PING.EXE
3624	PING.EXE
1304	PING.EXE
3276	cmd.exe
4652	cmd.exe
1728	cmd.exe
1676	PING.EXE
3704	cmd.exe
4824	cmd.exe
3104	PING.EXE
460	cmd.exe
3792	PING.EXE
4248	PING.EXE
4648	cmd.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
2120	PING.EXE
3792	PING.EXE
1676	PING.EXE
2308	PING.EXE
4192	PING.EXE
3104	PING.EXE
1304	PING.EXE
4248	PING.EXE
3624	PING.EXE
3532	PING.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 4652	1348	client.exe	92
PID 4652 wrote to memory of 2120	4652	cmd.exe	94
PID 1348 wrote to memory of 460	1348	client.exe	95
PID 460 wrote to memory of 3792	460	cmd.exe	97
PID 1348 wrote to memory of 1728	1348	client.exe	98
PID 1728 wrote to memory of 1676	1728	cmd.exe	100
PID 1348 wrote to memory of 3704	1348	client.exe	101
PID 3704 wrote to memory of 2308	3704	cmd.exe	103
PID 1348 wrote to memory of 4824	1348	client.exe	104
PID 4824 wrote to memory of 3624	4824	cmd.exe	106
PID 1348 wrote to memory of 1692	1348	client.exe	107
PID 1692 wrote to memory of 4192	1692	cmd.exe	109
PID 1348 wrote to memory of 4648	1348	client.exe	110
PID 4648 wrote to memory of 3532	4648	cmd.exe	112
PID 1348 wrote to memory of 4876	1348	client.exe	113
PID 4876 wrote to memory of 3104	4876	cmd.exe	115
PID 1348 wrote to memory of 4812	1348	client.exe	116
PID 4812 wrote to memory of 1304	4812	cmd.exe	118
PID 1348 wrote to memory of 3276	1348	client.exe	119
PID 3276 wrote to memory of 4248	3276	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING ATTACK_STOPATTACK|get|https://load.vmheaven.io/|120
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-0-0x00007FF67C860000-0x00007FF67C957000-memory.dmp

Download

memory/1348-49-0x00007FF67C860000-0x00007FF67C957000-memory.dmp

Download

memory/1348-56-0x00007FF67C860000-0x00007FF67C957000-memory.dmp

Download

memory/1348-57-0x00007FF67C860000-0x00007FF67C957000-memory.dmp

Download

memory/1348-59-0x00007FF67C860000-0x00007FF67C957000-memory.dmp

Download

memory/1348-60-0x00007FF67C860000-0x00007FF67C957000-memory.dmp

Download

memory/1348-61-0x00007FF67C860000-0x00007FF67C957000-memory.dmp

Download

memory/1348-62-0x00007FF67C860000-0x00007FF67C957000-memory.dmp

Download

memory/1348-73-0x00007FF67C860000-0x00007FF67C957000-memory.dmp

Download

memory/1348-76-0x00007FF67C860000-0x00007FF67C957000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads