78621369c86caebe7e1101631ec9a7d5c745941d76606e220b8daeb2df2b6a8a

Analysis

user interaction
yes
max time kernel
30s
max time network
34s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/07/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno Perm Spoofer V1/Xeno Perm V1/Perm Woof.bat
Size 1KB
Sample260731-vggyxsysd1
SHA256 78621369c86caebe7e1101631ec9a7d5c745941d76606e220b8daeb2df2b6a8a
MD5 9ba727742f656b90aa1b329536778038
SHA1 e744932825b087ebee102b7c00b76cd03fb3f665
SHA512 18714800c1e61648184999ce12028d021821e1b10eaa30e912bed3794c39b947bbf581e8a4eb96324215b2617fb0770123014c43b145b997729767f2632db544
TLSH
T11B311B78D8ECD480CCF09DAB249368E4A89FFD9F5D1E5BF6FC9B1354060092A1256BC9
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3836	cmd.exe

Suspicious behavior: LoadsDriver 30 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 5056	3836	cmd.exe	83
PID 3836 wrote to memory of 5048	3836	cmd.exe	84
PID 3836 wrote to memory of 4964	3836	cmd.exe	85
PID 3836 wrote to memory of 3444	3836	cmd.exe	86
PID 3836 wrote to memory of 5096	3836	cmd.exe	87
PID 3836 wrote to memory of 5588	3836	cmd.exe	88
PID 3836 wrote to memory of 5652	3836	cmd.exe	90
PID 3836 wrote to memory of 1408	3836	cmd.exe	91
PID 3836 wrote to memory of 3924	3836	cmd.exe	93
PID 3836 wrote to memory of 4024	3836	cmd.exe	94
PID 3836 wrote to memory of 4352	3836	cmd.exe	95
PID 3836 wrote to memory of 4348	3836	cmd.exe	96
PID 3836 wrote to memory of 5064	3836	cmd.exe	97
PID 3836 wrote to memory of 4980	3836	cmd.exe	98
PID 3836 wrote to memory of 2012	3836	cmd.exe	100
PID 3836 wrote to memory of 3116	3836	cmd.exe	101
PID 3836 wrote to memory of 2148	3836	cmd.exe	102
PID 3836 wrote to memory of 3636	3836	cmd.exe	103
PID 3836 wrote to memory of 380	3836	cmd.exe	104
PID 3836 wrote to memory of 1844	3836	cmd.exe	105
PID 3836 wrote to memory of 2264	3836	cmd.exe	106
PID 3836 wrote to memory of 5220	3836	cmd.exe	107
PID 3836 wrote to memory of 1932	3836	cmd.exe	108
PID 3836 wrote to memory of 1432	3836	cmd.exe	109
PID 3836 wrote to memory of 2368	3836	cmd.exe	110
PID 3836 wrote to memory of 1044	3836	cmd.exe	111
PID 3836 wrote to memory of 5372	3836	cmd.exe	112
PID 3836 wrote to memory of 3968	3836	cmd.exe	113
PID 3836 wrote to memory of 3664	3836	cmd.exe	114
PID 3836 wrote to memory of 5960	3836	cmd.exe	115

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\Perm Woof.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IVN 9246-22828-6452
  2⤵
  PID:5056
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SP 19636-25562-9253
  2⤵
  PID:5048
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SV 16898-15456-16598
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SS 19060-21392-17802
  2⤵
  PID:3444
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SU AUTO
  2⤵
  PID:5096
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SK 2593-25975-11793
  2⤵
  PID:5588
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BM 678-32557-19056
  2⤵
  PID:5652
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BP 22290-4896-29068
  2⤵
  PID:1408
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BS 13622-18781-15272
  2⤵
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BT 13303-2858-31773
  2⤵
  PID:4024
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BLC 24781-31380-19053
  2⤵
  PID:4352
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CM 25924-4045-4217
  2⤵
  PID:4348
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CV 31056-31530-2475
  2⤵
  PID:5064
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CS 1644-10764-31094
  2⤵
  PID:4980
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CA 1155-16108-26292
  2⤵
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CSK 27970-5915-31606
  2⤵
  PID:3116
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PSN 6503-19578-698
  2⤵
  PID:2148
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PAT 20225-17610-7301
  2⤵
  PID:3636
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PPN 20285-6603-8373
  2⤵
  PID:380
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 1 27688-28007-29271
  2⤵
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 2 28461-9383-21369
  2⤵
  PID:2264
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 3 8118-7571-30253
  2⤵
  PID:5220
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 4 18434-2311-1562
  2⤵
  PID:1932
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 5 25453-20217-15930
  2⤵
  PID:1432
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 6 25983-12426-27913
  2⤵
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 7 32281-22772-14644
  2⤵
  PID:1044
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 8 13612-23944-30813
  2⤵
  PID:5372
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 9 29205-21627-29707
  2⤵
  PID:3968
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 10 24766-6507-4165
  2⤵
  PID:3664
- C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /OS 11 12682-17140-23286
  2⤵
  PID:5960

C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\amigendrv64.sys
"C:\Users\Admin\AppData\Local\Temp\Xeno Perm Spoofer V1\Xeno Perm V1\amigendrv64.sys"
1⤵
PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads