51f6be6279594e0dfddc705d6c3cadfd7fb387daa056b86de7dd271df4fe7a57

Analysis

max time kernel
900s
max time network
846s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.exe
Size 964KB
Sample260804-v8625aee26
SHA256 51f6be6279594e0dfddc705d6c3cadfd7fb387daa056b86de7dd271df4fe7a57
MD5 30c023e1fee74b9bce6af1ea04c9fa1f
SHA1 22107c835c344377bee85e3ad8dc9c58bfdfbd65
SHA512 1b48c061fd2c583a7b37176823437b232b5e8f39b2c4e08d74dadd69236d9c30f7340d809ba708b417b2045dc7bcafe3b0d72d6b8ac3f8516c228967da2b3512
SSDEEP 12288:vuvAPwRRvUJbJ6ICqZz3gOtRDp0Aj6mB9UoC0mvb:WIWUJoIZd3gSRDp0Q9UP0mD
TLSH
T1FE253A5BE36344EDC57BC170876B9372BA30F86512346A7E1E85CB312F21E705A6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	client.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
11	pastebin.com

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1564	cmd.exe
868	cmd.exe
1484	cmd.exe
5516	cmd.exe
4784	cmd.exe
3200	cmd.exe
5736	cmd.exe
4444	cmd.exe
3316	cmd.exe
3556	cmd.exe
1992	cmd.exe
5016	cmd.exe
1004	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 26 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1992	cmd.exe
4164	PING.EXE
2848	PING.EXE
5604	PING.EXE
868	cmd.exe
4580	PING.EXE
1484	cmd.exe
1380	PING.EXE
5736	cmd.exe
4444	cmd.exe
1584	PING.EXE
3556	cmd.exe
5516	cmd.exe
5808	PING.EXE
3316	cmd.exe
1564	cmd.exe
1624	PING.EXE
4784	cmd.exe
3200	cmd.exe
1064	PING.EXE
852	PING.EXE
2532	PING.EXE
5016	cmd.exe
1004	cmd.exe
3220	PING.EXE
5880	PING.EXE

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
1380	PING.EXE
4164	PING.EXE
1064	PING.EXE
852	PING.EXE
2532	PING.EXE
5880	PING.EXE
5604	PING.EXE
4580	PING.EXE
5808	PING.EXE
1584	PING.EXE
2848	PING.EXE
3220	PING.EXE
1624	PING.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1992	2420	client.exe	89
PID 1992 wrote to memory of 4164	1992	cmd.exe	91
PID 2420 wrote to memory of 3200	2420	client.exe	92
PID 3200 wrote to memory of 1064	3200	cmd.exe	94
PID 2420 wrote to memory of 5736	2420	client.exe	95
PID 5736 wrote to memory of 852	5736	cmd.exe	97
PID 2420 wrote to memory of 4444	2420	client.exe	103
PID 4444 wrote to memory of 2532	4444	cmd.exe	105
PID 2420 wrote to memory of 3316	2420	client.exe	108
PID 3316 wrote to memory of 1584	3316	cmd.exe	110
PID 2420 wrote to memory of 5016	2420	client.exe	111
PID 5016 wrote to memory of 2848	5016	cmd.exe	113
PID 2420 wrote to memory of 1004	2420	client.exe	114
PID 1004 wrote to memory of 3220	1004	cmd.exe	116
PID 2420 wrote to memory of 3556	2420	client.exe	117
PID 3556 wrote to memory of 5880	3556	cmd.exe	119
PID 2420 wrote to memory of 1564	2420	client.exe	120
PID 1564 wrote to memory of 5604	1564	cmd.exe	122
PID 2420 wrote to memory of 868	2420	client.exe	126
PID 868 wrote to memory of 4580	868	cmd.exe	128
PID 2420 wrote to memory of 1484	2420	client.exe	129
PID 1484 wrote to memory of 1624	1484	cmd.exe	131
PID 2420 wrote to memory of 5516	2420	client.exe	132
PID 5516 wrote to memory of 1380	5516	cmd.exe	134
PID 2420 wrote to memory of 4784	2420	client.exe	135
PID 4784 wrote to memory of 5808	4784	cmd.exe	137

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5516
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PING
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\system32\PING.EXE
    PING
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3028

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5044