136ef661f3ead5ecb9ce3586e8140dbe21562617fba07310102a8eed60d746ed

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.bat
Size 138B
Sample260729-22fd6avama
SHA256 136ef661f3ead5ecb9ce3586e8140dbe21562617fba07310102a8eed60d746ed
MD5 a119c97dadf6c55c78c699e62ba41824
SHA1 580d8334dbdd8785e75c9699905c3b48036e6e64
SHA512 7849a6d0fc90293bd1efc00dad3f50f69d5b2f3312cf6f81647e5f52bc16e4ec79ffcbe9729746f9af123902e166c583ddfaa0d1cfe873ac69330c1693e5587f
TLSH
T15BC09209A47171B5AF4E8CAA8B34370365C6D69BA1A91E0A616E509C4F0FE2276933A1
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
828	cmd.exe
4288	cmd.exe
1116	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1116	4288	cmd.exe	90
PID 4288 wrote to memory of 828	4288	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\setup.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K start_tool.bat
  2⤵
  - Executes a command shell one-liner
  PID:1116
- C:\Windows\system32\cmd.exe
  cmd /c
  2⤵
  - Executes a command shell one-liner
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

start_tool.bat

Path C:\Users\Admin\AppData\Local\Temp\start_tool.bat
Size 17B
SHA256 4c4f3756a56db801fc2ec0e01b5bf5b3eb26bd16e933838a9e70a5474c8ed20a
MD5 65e5c7f827460ebb2e3f180200afe86e
SHA1 776d739c2a0286844a4e8ea7cbac1e33e97afb4e
SHA512 124758083ba5b72fd896a7f468eafc5d9c7ed185a16c4bf5d3735123b0f7c663be20fc4e00f1e785d08fc65f316e123fb4d74c6a1758217ccbc9f6d1c0e52895
MD5 SHA1 SHA512

Submit Download