0b01ae83f1f3fb1a719024f9db1eea143bed8b4d43191d5f09d9162dd3184cc0

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
udm.bat
Size 2.6MB
Sample260731-pnrh2sshqc
SHA256 0b01ae83f1f3fb1a719024f9db1eea143bed8b4d43191d5f09d9162dd3184cc0
MD5 faa7c59292d14c19f3446c26c08b0a57
SHA1 9116ff526eda404f87a3e4463d9e1bb6ff80cda2
SHA512 900edf293f8195e9acb2c52884bcbf5f2d222cab2eac46c8a5c81b37516cd064c935c5b0f21b0a96de3eaa1ef56efc5b29591f40e5beb8183e354c49d7c88b45
SSDEEP 3072:uCvPB8wO1BAfB+vXvHnWCWZ1orl0GkRx2pkw8DrApBro0i7yC4qu7lOM8lRbndgy:22
TLSH
T1DEC5F96007433E66B2589159C34345A7FDEFA8FD643E6807BBAC74987FE024EE2451B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2100	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
720	cmd.exe
6008	cmd.exe
4636	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	powershell.exe
2100	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4900	4636	cmd.exe	89
PID 4636 wrote to memory of 5876	4636	cmd.exe	91
PID 4636 wrote to memory of 720	4636	cmd.exe	92
PID 4636 wrote to memory of 5632	4636	cmd.exe	93
PID 4636 wrote to memory of 2180	4636	cmd.exe	94
PID 4636 wrote to memory of 4724	4636	cmd.exe	95
PID 4636 wrote to memory of 5664	4636	cmd.exe	96
PID 4636 wrote to memory of 5460	4636	cmd.exe	97
PID 4636 wrote to memory of 6008	4636	cmd.exe	98
PID 4636 wrote to memory of 2100	4636	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\udm.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\chcp.com
  chcp.com 437
  2⤵
  PID:4900
- C:\Windows\system32\find.exe
  find
  2⤵
  PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type tmp
  2⤵
  - Executes a command shell one-liner
  PID:720
- C:\Windows\system32\find.exe
  find
  2⤵
  PID:5632
- C:\Windows\system32\findstr.exe
  findstr /L /I set C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:2180
- C:\Windows\system32\findstr.exe
  findstr /L /I goto C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:4724
- C:\Windows\system32\findstr.exe
  findstr /L /I echo C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:5664
- C:\Windows\system32\findstr.exe
  findstr /L /I pause C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type tmp
  2⤵
  - Executes a command shell one-liner
  PID:6008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "C:\Users\Public\Documemt\python C:\Users\Public\Documemt\Lib\sim.py"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp
Size 14B
SHA256 589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3
MD5 ce585c6ba32ac17652d2345118536f9c
SHA1 be0e41b3690c42e4c0cdb53d53fc544fb46b758d
SHA512 d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752
MD5 SHA1 SHA512

Submit Download

memory/2100-8-0x000001FB68A40000-0x000001FB68A62000-memory.dmp

Download