51f6be6279594e0dfddc705d6c3cadfd7fb387daa056b86de7dd271df4fe7a57

Analysis

max time kernel
898s
max time network
849s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/08/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.exe
Size 964KB
Sample260804-v8625aee26
SHA256 51f6be6279594e0dfddc705d6c3cadfd7fb387daa056b86de7dd271df4fe7a57
MD5 30c023e1fee74b9bce6af1ea04c9fa1f
SHA1 22107c835c344377bee85e3ad8dc9c58bfdfbd65
SHA512 1b48c061fd2c583a7b37176823437b232b5e8f39b2c4e08d74dadd69236d9c30f7340d809ba708b417b2045dc7bcafe3b0d72d6b8ac3f8516c228967da2b3512
SSDEEP 12288:vuvAPwRRvUJbJ6ICqZz3gOtRDp0Aj6mB9UoC0mvb:WIWUJoIZd3gSRDp0Q9UP0mD
TLSH
T1FE253A5BE36344EDC57BC170876B9372BA30F86512346A7E1E85CB312F21E705A6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	client.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4672	cmd.exe
4684	cmd.exe
4336	cmd.exe
2228	cmd.exe
1976	cmd.exe
1008	cmd.exe
224	cmd.exe
2124	cmd.exe
3668	cmd.exe
1484	cmd.exe
4460	cmd.exe
2160	cmd.exe
2388	cmd.exe
4388	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 28 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3212	PING.EXE
4684	cmd.exe
4336	cmd.exe
564	PING.EXE
1008	cmd.exe
2132	PING.EXE
2768	PING.EXE
4388	cmd.exe
4672	cmd.exe
1424	PING.EXE
2228	cmd.exe
2840	PING.EXE
1484	cmd.exe
4460	cmd.exe
2388	cmd.exe
2124	cmd.exe
640	PING.EXE
1976	cmd.exe
1708	PING.EXE
224	cmd.exe
3028	PING.EXE
4260	PING.EXE
3668	cmd.exe
3284	PING.EXE
2160	cmd.exe
3948	PING.EXE
2032	PING.EXE
1692	PING.EXE

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
3948	PING.EXE
2768	PING.EXE
3212	PING.EXE
640	PING.EXE
1424	PING.EXE
2840	PING.EXE
1708	PING.EXE
3284	PING.EXE
2132	PING.EXE
3028	PING.EXE
2032	PING.EXE
1692	PING.EXE
4260	PING.EXE
564	PING.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 2388	3944	client.exe	91
PID 2388 wrote to memory of 2768	2388	cmd.exe	93
PID 3944 wrote to memory of 224	3944	client.exe	94
PID 224 wrote to memory of 3028	224	cmd.exe	96
PID 3944 wrote to memory of 2124	3944	client.exe	97
PID 2124 wrote to memory of 2032	2124	cmd.exe	99
PID 3944 wrote to memory of 4388	3944	client.exe	100
PID 4388 wrote to memory of 1692	4388	cmd.exe	102
PID 3944 wrote to memory of 4672	3944	client.exe	103
PID 4672 wrote to memory of 3212	4672	cmd.exe	105
PID 3944 wrote to memory of 4684	3944	client.exe	106
PID 4684 wrote to memory of 4260	4684	cmd.exe	108
PID 3944 wrote to memory of 3668	3944	client.exe	109
PID 3668 wrote to memory of 640	3668	cmd.exe	111
PID 3944 wrote to memory of 4336	3944	client.exe	112
PID 4336 wrote to memory of 1424	4336	cmd.exe	114
PID 3944 wrote to memory of 2228	3944	client.exe	115
PID 2228 wrote to memory of 564	2228	cmd.exe	117
PID 3944 wrote to memory of 1976	3944	client.exe	118
PID 1976 wrote to memory of 2840	1976	cmd.exe	120
PID 3944 wrote to memory of 1484	3944	client.exe	121
PID 1484 wrote to memory of 1708	1484	cmd.exe	123
PID 3944 wrote to memory of 1008	3944	client.exe	124
PID 1008 wrote to memory of 3284	1008	cmd.exe	126
PID 3944 wrote to memory of 4460	3944	client.exe	127
PID 4460 wrote to memory of 2132	4460	cmd.exe	129
PID 3944 wrote to memory of 2160	3944	client.exe	130
PID 2160 wrote to memory of 3948	2160	cmd.exe	132

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3948