51f6be6279594e0dfddc705d6c3cadfd7fb387daa056b86de7dd271df4fe7a57

Analysis

max time kernel
898s
max time network
848s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.exe
Size 964KB
Sample260804-v8625aee26
SHA256 51f6be6279594e0dfddc705d6c3cadfd7fb387daa056b86de7dd271df4fe7a57
MD5 30c023e1fee74b9bce6af1ea04c9fa1f
SHA1 22107c835c344377bee85e3ad8dc9c58bfdfbd65
SHA512 1b48c061fd2c583a7b37176823437b232b5e8f39b2c4e08d74dadd69236d9c30f7340d809ba708b417b2045dc7bcafe3b0d72d6b8ac3f8516c228967da2b3512
SSDEEP 12288:vuvAPwRRvUJbJ6ICqZz3gOtRDp0Aj6mB9UoC0mvb:WIWUJoIZd3gSRDp0Q9UP0mD
TLSH
T1FE253A5BE36344EDC57BC170876B9372BA30F86512346A7E1E85CB312F21E705A6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	client.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	client.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1504	cmd.exe
4048	cmd.exe
4492	cmd.exe
4976	cmd.exe
1540	cmd.exe
1060	cmd.exe
1640	cmd.exe
1568	cmd.exe
5208	cmd.exe
3564	cmd.exe
3864	cmd.exe
6040	cmd.exe
4484	cmd.exe
1888	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 28 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5888	PING.EXE
4048	cmd.exe
4836	PING.EXE
3800	PING.EXE
6040	cmd.exe
4132	PING.EXE
1888	cmd.exe
4028	PING.EXE
1640	cmd.exe
1504	cmd.exe
5208	cmd.exe
1176	PING.EXE
1540	cmd.exe
4128	PING.EXE
4484	cmd.exe
1060	cmd.exe
4264	PING.EXE
1568	cmd.exe
3564	cmd.exe
5332	PING.EXE
4740	PING.EXE
4272	PING.EXE
3864	cmd.exe
4540	PING.EXE
4492	cmd.exe
4976	cmd.exe
3908	PING.EXE
3912	PING.EXE

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
3912	PING.EXE
5888	PING.EXE
4836	PING.EXE
4540	PING.EXE
1176	PING.EXE
3908	PING.EXE
4128	PING.EXE
4740	PING.EXE
4028	PING.EXE
4272	PING.EXE
5332	PING.EXE
3800	PING.EXE
4132	PING.EXE
4264	PING.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1540	2424	client.exe	79
PID 1540 wrote to memory of 3908	1540	cmd.exe	81
PID 2424 wrote to memory of 6040	2424	client.exe	82
PID 6040 wrote to memory of 4128	6040	cmd.exe	84
PID 2424 wrote to memory of 4484	2424	client.exe	85
PID 4484 wrote to memory of 4132	4484	cmd.exe	87
PID 2424 wrote to memory of 1060	2424	client.exe	88
PID 1060 wrote to memory of 4740	1060	cmd.exe	90
PID 2424 wrote to memory of 1888	2424	client.exe	91
PID 1888 wrote to memory of 4028	1888	cmd.exe	93
PID 2424 wrote to memory of 1640	2424	client.exe	94
PID 1640 wrote to memory of 4264	1640	cmd.exe	96
PID 2424 wrote to memory of 1568	2424	client.exe	97
PID 1568 wrote to memory of 4272	1568	cmd.exe	99
PID 2424 wrote to memory of 1504	2424	client.exe	100
PID 1504 wrote to memory of 3912	1504	cmd.exe	102
PID 2424 wrote to memory of 5208	2424	client.exe	103
PID 5208 wrote to memory of 5888	5208	cmd.exe	105
PID 2424 wrote to memory of 3564	2424	client.exe	106
PID 3564 wrote to memory of 5332	3564	cmd.exe	108
PID 2424 wrote to memory of 4048	2424	client.exe	109
PID 4048 wrote to memory of 4836	4048	cmd.exe	111
PID 2424 wrote to memory of 3864	2424	client.exe	112
PID 3864 wrote to memory of 4540	3864	cmd.exe	114
PID 2424 wrote to memory of 4492	2424	client.exe	115
PID 4492 wrote to memory of 3800	4492	cmd.exe	117
PID 2424 wrote to memory of 4976	2424	client.exe	118
PID 4976 wrote to memory of 1176	4976	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1176