4261d75ea3ee271ba4313a53f3f8f0be4c15f3ee62ff6d54096212e306a8a749

Analysis

max time kernel
149s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lua/vehicle/powertrain/automaticHevGearbox.bat
Size 27KB
Sample260803-lddmnatbmf
SHA256 4261d75ea3ee271ba4313a53f3f8f0be4c15f3ee62ff6d54096212e306a8a749
MD5 6f65e1f618316aa45355fe83131b3b35
SHA1 5d5ee9b44f3f62c005796dadab0021f9a54f8b83
SHA512 72695f7e90d5ed79082f736c8c665d67e16b8ec544b5fcb0de5ea757a53d3dbaef20e5b441a32008aea2d98b69dd6f39744ddb45ec90cf83d97598dd3fceff15
SSDEEP 768:Zg9GDNjxAbRkIeG2mYj6FODTW1/bukbQ6MdVAhavC0:Zr5v60
TLSH
T1A2C25577161B08C974FB7E61ACA25417F737809730190ED13A6908852F96F2C5BBEBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4948	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lua\vehicle\powertrain\automaticHevGearbox.bat"
1⤵
- Executes a command shell one-liner
PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads