606c60f1bdb75f96b2cebffe2636d0caae464ed7bc083ebe4492dbe896ea758d

Analysis

max time kernel
899s
max time network
900s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d149f869-d1df-4a37-a865-eb7f21dd23a2.exe
Size 5.7MB
Sample260730-1slzxagk21
SHA256 606c60f1bdb75f96b2cebffe2636d0caae464ed7bc083ebe4492dbe896ea758d
MD5 6e29abe27c26ac345f475e7b329cc8b0
SHA1 af98fde1486010733aea8a5afc029a3efbe70392
SHA512 b550d20445ac512cb619ef4f80ac9ca739098906bd9c164e04b83e6bb1f3e5bf36a720dacaf5709a122c046c3c2a3db7b9e4107c69ea8bb7ed9cfbaffcf6833e
SSDEEP 49152:15m6S4GXcCaqudIV9tQu+M+CaSa8XLH4gw6yykYuwBb6GjW5EWOCL1nQysBeiL:quqHRf7D4gwdBFrEW5nnk
TLSH
T162563947E8A505E8C0EED63589629252BE717C884F3163D73FA0F7282F76BD06AB5740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3612	cmd.exe
3796	cmd.exe
5608	cmd.exe
5008	cmd.exe
3344	cmd.exe
5764	cmd.exe
5984	cmd.exe
252	cmd.exe
4512	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4816	ipconfig.exe

GoLang User-Agent 14 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	44	Go-http-client/1.1
HTTP User-Agent header	2	Go-http-client/1.1
HTTP User-Agent header	5	Go-http-client/1.1
HTTP User-Agent header	6	Go-http-client/1.1
HTTP User-Agent header	34	Go-http-client/1.1
HTTP User-Agent header	38	Go-http-client/1.1
HTTP User-Agent header	39	Go-http-client/1.1
HTTP User-Agent header	42	Go-http-client/1.1
HTTP User-Agent header	43	Go-http-client/1.1
HTTP User-Agent header	1	Go-http-client/1.1
HTTP User-Agent header	7	Go-http-client/1.1
HTTP User-Agent header	30	Go-http-client/1.1
HTTP User-Agent header	40	Go-http-client/1.1
HTTP User-Agent header	41	Go-http-client/1.1

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	whoami.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 4512	3992	d149f869-d1df-4a37-a865-eb7f21dd23a2.exe	90
PID 3992 wrote to memory of 3612	3992	d149f869-d1df-4a37-a865-eb7f21dd23a2.exe	92
PID 3992 wrote to memory of 3796	3992	d149f869-d1df-4a37-a865-eb7f21dd23a2.exe	94
PID 3992 wrote to memory of 3344	3992	d149f869-d1df-4a37-a865-eb7f21dd23a2.exe	96
PID 3992 wrote to memory of 5764	3992	d149f869-d1df-4a37-a865-eb7f21dd23a2.exe	104
PID 3992 wrote to memory of 5608	3992	d149f869-d1df-4a37-a865-eb7f21dd23a2.exe	106
PID 3992 wrote to memory of 5984	3992	d149f869-d1df-4a37-a865-eb7f21dd23a2.exe	113
PID 3992 wrote to memory of 5008	3992	d149f869-d1df-4a37-a865-eb7f21dd23a2.exe	115
PID 5008 wrote to memory of 4816	5008	cmd.exe	117
PID 3992 wrote to memory of 252	3992	d149f869-d1df-4a37-a865-eb7f21dd23a2.exe	118
PID 252 wrote to memory of 2984	252	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\d149f869-d1df-4a37-a865-eb7f21dd23a2.exe
"C:\Users\Admin\AppData\Local\Temp\d149f869-d1df-4a37-a865-eb7f21dd23a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\system32\cmd.exe
  cmd /C check_admin
  2⤵
  - Executes a command shell one-liner
  PID:4512
- C:\Windows\system32\cmd.exe
  cmd /C persist
  2⤵
  - Executes a command shell one-liner
  PID:3612
- C:\Windows\system32\cmd.exe
  cmd /C unpersist
  2⤵
  - Executes a command shell one-liner
  PID:3796
- C:\Windows\system32\cmd.exe
  cmd /C persist
  2⤵
  - Executes a command shell one-liner
  PID:3344
- C:\Windows\system32\cmd.exe
  cmd /C persist
  2⤵
  - Executes a command shell one-liner
  PID:5764
- C:\Windows\system32\cmd.exe
  cmd /C elevate
  2⤵
  - Executes a command shell one-liner
  PID:5608
- C:\Windows\system32\cmd.exe
  cmd /C elevate
  2⤵
  - Executes a command shell one-liner
  PID:5984
- C:\Windows\system32\cmd.exe
  cmd /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4816
- C:\Windows\system32\cmd.exe
  cmd /C whoami
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6028

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads