97a0fdca1f2cba2589625f21dfe72894a25e49884347cc3b3b6a131d2ad06e5b

Analysis

max time kernel
298s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
29/07/2026, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fsgitmmqw/qeScClkwFV
Size 1.5MB
Sample260729-crpgmsdf37
SHA256 97a0fdca1f2cba2589625f21dfe72894a25e49884347cc3b3b6a131d2ad06e5b
MD5 ed8197e75ef6e7898bbf27c06788faf3
SHA1 2b7d79841d5de9097af893e03297842900f6ab52
SHA512 f8237e9878e7550441e74b55e15c09a2086f5f205aefcc65f049cef1c659946ac2676047dc398623e0600151aeb2145eefcde1df1a8602e21c33947881278e4b
SSDEEP 24576:0J1BOfmRi3GFRMSNJxC+O96IOdymHYcIAKIRNI4g4wi8mxlvGAqEIOwWqtnYKP7k:0JvxRmGx/xC+O7Yv4vNm3vGqIhWqtnBo
TLSH
T145653389B40C1E1D06E27D0959B4AFD61E79DF7AAF320D8ABA4B1F4C210576B760E0D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4972	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Fsgitmmqw\qeScClkwFV
1⤵
- Executes a command shell one-liner
PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads