b743668a60f325f027ead058c3797f343629874210e7dc4521ce73236f7a3efd

Analysis

user interaction
yes
max time kernel
103s
max time network
104s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
rat.exe
Size 7.2MB
Sample260728-cldsyswclc
SHA256 b743668a60f325f027ead058c3797f343629874210e7dc4521ce73236f7a3efd
MD5 b2b9b390174ef4a4f5305a0a393013fd
SHA1 03c1176c68a15d170c00e2a4d5bb5b4215d1bc05
SHA512 0000de455b502d34d8804c088c06b27901a8fe628ac843601be2edd7354ec7b1a98c093d1ff40dd6a5f97a6f350beef52ac952c7aa113c02bfe8ea0f0d3dcd7f
SSDEEP 49152:wksEGOAYt8fE7XoIgwdKEQzQIyhVV1X7OwKOHvovEcar6jiAc6KdKVK1KsLsnuO2:wkbN5VX88T/1L+j1EY3u
TLSH
T13D764A13FC5519E9C0AED131897296137B617C894B2163E32B50F628BF76BE0BEB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
5128	powershell.exe
4612	powershell.exe
4224	powershell.exe
2020	powershell.exe
240	powershell.exe
5816	powershell.exe
2880	powershell.exe
4324	powershell.exe
2300	powershell.exe
3556	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
3	discord.com
11	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2980	powershell.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3460	cmd.exe
4436	cmd.exe
5392	cmd.exe
3724	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
6040	systeminfo.exe
2328	systeminfo.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
5100	reg.exe
4352	reg.exe
1168	reg.exe
4684	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
2020	powershell.exe
2020	powershell.exe
2020	powershell.exe
240	powershell.exe
240	powershell.exe
240	powershell.exe
5128	powershell.exe
5128	powershell.exe
2980	powershell.exe
2980	powershell.exe
2980	powershell.exe
2980	powershell.exe
5816	powershell.exe
5816	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
4324	powershell.exe
4324	powershell.exe
4324	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
3556	powershell.exe
3556	powershell.exe
3556	powershell.exe
3556	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeIncreaseQuotaPrivilege	4224	powershell.exe
Token: SeSecurityPrivilege	4224	powershell.exe
Token: SeTakeOwnershipPrivilege	4224	powershell.exe
Token: SeLoadDriverPrivilege	4224	powershell.exe
Token: SeSystemProfilePrivilege	4224	powershell.exe
Token: SeSystemtimePrivilege	4224	powershell.exe
Token: SeProfSingleProcessPrivilege	4224	powershell.exe
Token: SeIncBasePriorityPrivilege	4224	powershell.exe
Token: SeCreatePagefilePrivilege	4224	powershell.exe
Token: SeBackupPrivilege	4224	powershell.exe
Token: SeRestorePrivilege	4224	powershell.exe
Token: SeShutdownPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeSystemEnvironmentPrivilege	4224	powershell.exe
Token: SeRemoteShutdownPrivilege	4224	powershell.exe
Token: SeUndockPrivilege	4224	powershell.exe
Token: SeManageVolumePrivilege	4224	powershell.exe
Token: 33	4224	powershell.exe
Token: 34	4224	powershell.exe
Token: 35	4224	powershell.exe
Token: 36	4224	powershell.exe
Token: SeIncreaseQuotaPrivilege	4224	powershell.exe
Token: SeSecurityPrivilege	4224	powershell.exe
Token: SeTakeOwnershipPrivilege	4224	powershell.exe
Token: SeLoadDriverPrivilege	4224	powershell.exe
Token: SeSystemProfilePrivilege	4224	powershell.exe
Token: SeSystemtimePrivilege	4224	powershell.exe
Token: SeProfSingleProcessPrivilege	4224	powershell.exe
Token: SeIncBasePriorityPrivilege	4224	powershell.exe
Token: SeCreatePagefilePrivilege	4224	powershell.exe
Token: SeBackupPrivilege	4224	powershell.exe
Token: SeRestorePrivilege	4224	powershell.exe
Token: SeShutdownPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeSystemEnvironmentPrivilege	4224	powershell.exe
Token: SeRemoteShutdownPrivilege	4224	powershell.exe
Token: SeUndockPrivilege	4224	powershell.exe
Token: SeManageVolumePrivilege	4224	powershell.exe
Token: 33	4224	powershell.exe
Token: 34	4224	powershell.exe
Token: 35	4224	powershell.exe
Token: 36	4224	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeIncreaseQuotaPrivilege	2020	powershell.exe
Token: SeSecurityPrivilege	2020	powershell.exe
Token: SeTakeOwnershipPrivilege	2020	powershell.exe
Token: SeLoadDriverPrivilege	2020	powershell.exe
Token: SeSystemProfilePrivilege	2020	powershell.exe
Token: SeSystemtimePrivilege	2020	powershell.exe
Token: SeProfSingleProcessPrivilege	2020	powershell.exe
Token: SeIncBasePriorityPrivilege	2020	powershell.exe
Token: SeCreatePagefilePrivilege	2020	powershell.exe
Token: SeBackupPrivilege	2020	powershell.exe
Token: SeRestorePrivilege	2020	powershell.exe
Token: SeShutdownPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeSystemEnvironmentPrivilege	2020	powershell.exe
Token: SeRemoteShutdownPrivilege	2020	powershell.exe
Token: SeUndockPrivilege	2020	powershell.exe
Token: SeManageVolumePrivilege	2020	powershell.exe
Token: 33	2020	powershell.exe
Token: 34	2020	powershell.exe
Token: 35	2020	powershell.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2420	taskmgr.exe
2420	taskmgr.exe
2420	taskmgr.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 3460	5832	rat.exe	90
PID 5832 wrote to memory of 4436	5832	rat.exe	91
PID 4436 wrote to memory of 6040	4436	cmd.exe	92
PID 4436 wrote to memory of 4484	4436	cmd.exe	93
PID 5832 wrote to memory of 1168	5832	rat.exe	96
PID 5832 wrote to memory of 4224	5832	rat.exe	97
PID 5832 wrote to memory of 2020	5832	rat.exe	98
PID 5832 wrote to memory of 240	5832	rat.exe	99
PID 5832 wrote to memory of 4684	5832	rat.exe	100
PID 5832 wrote to memory of 5128	5832	rat.exe	102
PID 5128 wrote to memory of 1044	5128	powershell.exe	103
PID 1044 wrote to memory of 5392	1044	rat.exe	105
PID 1044 wrote to memory of 3724	1044	rat.exe	106
PID 3724 wrote to memory of 2328	3724	cmd.exe	107
PID 3724 wrote to memory of 2412	3724	cmd.exe	108
PID 5832 wrote to memory of 2980	5832	rat.exe	109
PID 1044 wrote to memory of 5100	1044	rat.exe	110
PID 1044 wrote to memory of 5816	1044	rat.exe	111
PID 1044 wrote to memory of 2880	1044	rat.exe	112
PID 1044 wrote to memory of 4324	1044	rat.exe	113
PID 1044 wrote to memory of 4352	1044	rat.exe	114
PID 1044 wrote to memory of 2300	1044	rat.exe	115
PID 1044 wrote to memory of 3556	1044	rat.exe	117
PID 1044 wrote to memory of 4612	1044	rat.exe	118
PID 4612 wrote to memory of 1580	4612	powershell.exe	119
PID 1580 wrote to memory of 3132	1580	csc.exe	120

C:\Users\Admin\AppData\Local\Temp\rat.exe
"C:\Users\Admin\AppData\Local\Temp\rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3460
- C:\Windows\system32\cmd.exe
  cmd /c "systeminfo | findstr /B /C:\"OS Name\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:6040
- - C:\Windows\system32\findstr.exe
    findstr /B /C:\"OS Name\"
    3⤵
    PID:4484
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$cs = Get-CimInstance Win32_ComputerSystem; $mem = Get-CimInstance Win32_PhysicalMemory | Select-Object -First 1; $totalGB = $cs.TotalPhysicalMemory / 1GB; $ddr = switch ($mem.SMBIOSMemoryType) { 26 { 'DDR5' } 20 { 'DDR4' } 21 { 'DDR3' } 25 { 'DDR3' } 24 { 'DDR2' } 17 { 'SDRAM' } default { 'DDR' }; }; Write-Output \"$([math]::Round($totalGB, 2)) GB $ddr\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$cpu = Get-CimInstance Win32_Processor; Write-Output \"$($cpu.Name) ($($cpu.NumberOfCores) cores, $($cpu.NumberOfLogicalProcessors) threads)\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\rat.exe' -ArgumentList '--admin-restart' -Verb RunAs"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Users\Admin\AppData\Local\Temp\rat.exe
    "C:\Users\Admin\AppData\Local\Temp\rat.exe" --admin-restart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\system32\cmd.exe
      cmd /c ver
      4⤵
      Executes a command shell one-liner
      PID:5392
  - - C:\Windows\system32\cmd.exe
      cmd /c "systeminfo | findstr /B /C:\"OS Name\""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3724
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:2328
    - - C:\Windows\system32\findstr.exe
        
        findstr /B /C:\"OS Name\"
        5⤵
        
        PID:2412
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
      4⤵
      Modifies registry key
      PID:5100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$cs = Get-CimInstance Win32_ComputerSystem; $mem = Get-CimInstance Win32_PhysicalMemory | Select-Object -First 1; $totalGB = $cs.TotalPhysicalMemory / 1GB; $ddr = switch ($mem.SMBIOSMemoryType) { 26 { 'DDR5' } 20 { 'DDR4' } 21 { 'DDR3' } 25 { 'DDR3' } 24 { 'DDR2' } 17 { 'SDRAM' } default { 'DDR' }; }; Write-Output \"$([math]::Round($totalGB, 2)) GB $ddr\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$cpu = Get-CimInstance Win32_Processor; Write-Output \"$($cpu.Name) ($($cpu.NumberOfCores) cores, $($cpu.NumberOfLogicalProcessors) threads)\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4324
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
      4⤵
      Modifies registry key
      PID:4352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Speech; $speak = New-Object System.Speech.Synthesis.SpeechSynthesizer; $speak.Speak('nih')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Get-Process | Select-Object -ExpandProperty Name | Sort-Object -Unique"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $code = @\" using System; using System.Runtime.InteropServices; public class CriticalProc { [DllImport(\"ntdll.dll\")] public static extern int NtSetInformationProcess(IntPtr hProcess, int processInformationClass, ref int processInformation, int processInformationLength); } \"@ Add-Type -TypeDefinition $code $process = Get-Process -Id 1044 $breakOnTermination = 1 $result = [CriticalProc]::NtSetInformationProcess($process.Handle, 0x1D, [ref]$breakOnTermination, 4) if ($result -eq 0) { Write-Host \"SUCCESS\" } else { Write-Host \"FAILED: $result\" } "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zwn0ia3u\zwn0ia3u.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1580
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES442E.tmp" "c:\Users\Admin\AppData\Local\Temp\zwn0ia3u\CSC6E58651B37542DBAFABEF1164F116.TMP"
        6⤵
        
        PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process 'rat' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2980

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
1⤵
PID:2604

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact