0b01ae83f1f3fb1a719024f9db1eea143bed8b4d43191d5f09d9162dd3184cc0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
udm.bat
Size 2.6MB
Sample260731-pnrh2sshqc
SHA256 0b01ae83f1f3fb1a719024f9db1eea143bed8b4d43191d5f09d9162dd3184cc0
MD5 faa7c59292d14c19f3446c26c08b0a57
SHA1 9116ff526eda404f87a3e4463d9e1bb6ff80cda2
SHA512 900edf293f8195e9acb2c52884bcbf5f2d222cab2eac46c8a5c81b37516cd064c935c5b0f21b0a96de3eaa1ef56efc5b29591f40e5beb8183e354c49d7c88b45
SSDEEP 3072:uCvPB8wO1BAfB+vXvHnWCWZ1orl0GkRx2pkw8DrApBro0i7yC4qu7lOM8lRbndgy:22
TLSH
T1DEC5F96007433E66B2589159C34345A7FDEFA8FD643E6807BBAC74987FE024EE2451B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1852	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4792	cmd.exe
5628	cmd.exe
5784	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1852	powershell.exe
1852	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 6116	4792	cmd.exe	85
PID 4792 wrote to memory of 2540	4792	cmd.exe	86
PID 4792 wrote to memory of 5628	4792	cmd.exe	87
PID 4792 wrote to memory of 3472	4792	cmd.exe	88
PID 4792 wrote to memory of 3220	4792	cmd.exe	89
PID 4792 wrote to memory of 668	4792	cmd.exe	90
PID 4792 wrote to memory of 5048	4792	cmd.exe	91
PID 4792 wrote to memory of 4440	4792	cmd.exe	92
PID 4792 wrote to memory of 5784	4792	cmd.exe	93
PID 4792 wrote to memory of 1852	4792	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\udm.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\chcp.com
  chcp.com 437
  2⤵
  PID:6116
- C:\Windows\system32\find.exe
  find
  2⤵
  PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type tmp
  2⤵
  - Executes a command shell one-liner
  PID:5628
- C:\Windows\system32\find.exe
  find
  2⤵
  PID:3472
- C:\Windows\system32\findstr.exe
  findstr /L /I set C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:3220
- C:\Windows\system32\findstr.exe
  findstr /L /I goto C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:668
- C:\Windows\system32\findstr.exe
  findstr /L /I echo C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:5048
- C:\Windows\system32\findstr.exe
  findstr /L /I pause C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type tmp
  2⤵
  - Executes a command shell one-liner
  PID:5784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "C:\Users\Public\Documemt\python C:\Users\Public\Documemt\Lib\sim.py"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ypgf5iqg.4tl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ypgf5iqg.4tl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp
Size 14B
SHA256 589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3
MD5 ce585c6ba32ac17652d2345118536f9c
SHA1 be0e41b3690c42e4c0cdb53d53fc544fb46b758d
SHA512 d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752
MD5 SHA1 SHA512

Submit Download

memory/1852-6-0x0000027449590000-0x00000274495B2000-memory.dmp

Download