7707b813418b72efd31dc52d2e4c0f541242799959a1ef72d7a24931ce3edf9e

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/08/2026, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DrawBot/Include/pyconfig.bat
Size 20KB
Sample260801-xjs53stfph
SHA256 7707b813418b72efd31dc52d2e4c0f541242799959a1ef72d7a24931ce3edf9e
MD5 d0c477f63bd3a0b2d60ffbb6ce4be37e
SHA1 ab51df267a97e95da36f7a4c8cefd7ceecf52119
SHA512 9ffa156a26ba4f3a1388aaa8b47870c87070e1f316a73a3d05dcf0e736d3769d5fc77690958a59b4271a4da0c3def4775fd4e807e22bab3ccbf4c99bf1560a57
SSDEEP 384:rG3tApdkHRMYURInMk/8BsRV4ig8as8Ji2MgsdgsXgDV:rG3tApWaSE+aPfZpV
TLSH
T14592212A8DCB32F64077D151620D2656D686EEFB425131EC381C9D0C3F35A8A96FE6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4520	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DrawBot\Include\pyconfig.bat"
1⤵
- Executes a command shell one-liner
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads