Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 18:15

General

  • Target
    V-Bot.bat
  • Size 314B
  • Sample260804-wvvmlsvsat
  • SHA256 dd1a056227d4e90a457538555f50f72e2015fda02776e0777eb501fdf1df5705
  • MD5 SHA1 SHA512 TLSH
Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Downloads MZ/PE file 1 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • cURL User-Agent 2 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\V-Bot.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -L --fail --progress-bar -o "C:\Users\Admin\AppData\Local\Temp\bin\gallery-dl.exe" "https://rmqirmbxawfwyrwkvndz.supabase.co/storage/v1/object/public/vbot/gallery-dl.exe"
      2⤵
      • Downloads MZ/PE file
      PID:5460
    • C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -L --fail --progress-bar -o "C:\Users\Admin\AppData\Local\Temp\ffmpeg-vbot.zip" "https://www.gyan.dev/ffmpeg/builds/ffmpeg-release-essentials.zip"
      2⤵
        PID:3512
      • C:\Windows\System32\tar.exe
        "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\ffmpeg-vbot.zip" -C "C:\Users\Admin\AppData\Local\Temp"
        2⤵
          PID:2076
        • C:\Windows\system32\PING.EXE
          ping -n 3 127.0.0.1
          2⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:6004
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\vbot-gui.ps1"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2340

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            LICENSE

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\LICENSE
            • Size 34KB
            • SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
            • MD5 SHA1 SHA512 SSDEEP TLSH

            README.txt

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\README.txt
            • Size 40KB
            • SHA256 eb44a453c699b7bc089dddf6b1d39b08beb8eb56180929d59218a90f7023e8dd
            • MD5 SHA1 SHA512 SSDEEP TLSH

            BOOTST~1.CSS

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\BOOTST~1.CSS
            • Size 106KB
            • SHA256 3cedecf2b8064b4a56ba47bda04544e1b21d71c83a12e7b5709e7c7976ead70e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            COMMUN~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\COMMUN~1.HTM
            • Size 13KB
            • SHA256 ed1a149ca1f5129e31b71f7bf6547a690bbefed1f94b24d3b6cf15b9b5e7cac6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            DEVELO~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\DEVELO~1.HTM
            • Size 64KB
            • SHA256 cc14a87cf4bb8d9e4509b4f9a7b2ade08015e8e93392dc72a0352a3daf0369ec
            • MD5 SHA1 SHA512 SSDEEP TLSH

            DRAWVG~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\DRAWVG~1.HTM
            • Size 143KB
            • SHA256 e63e3aa79935d162c5e29e8feac866ae899ae0073f45595b3a029b42a897db90
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FAQ~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FAQ~1.HTM
            • Size 63KB
            • SHA256 12e4eaa685c874b975e9ad774aabd588871088a877f531ba2f7aa628b1670c45
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FATE~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FATE~1.HTM
            • Size 18KB
            • SHA256 603ae75dc972d486d4901c222ec881d6bb903058311dfcc9cda9f6471c50e3aa
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FF1189~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FF1189~1.HTM
            • Size 212KB
            • SHA256 55652233f15f468e2ecfd8af15571de2f7aedc676110882e38a003c5fd968b41
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FF1275~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FF1275~1.HTM
            • Size 13KB
            • SHA256 ef33b5c00313e980fd8bef875e48ad49534f8d4da3acd62c2cb121cf2f767986
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FF274B~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FF274B~1.HTM
            • Size 12KB
            • SHA256 77a322683a61362bf302e67fe62560f6c5a4ccb7ef944f5fb7e2e797685436ff
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FF2FE4~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FF2FE4~1.HTM
            • Size 119KB
            • SHA256 df0bcefb9bdad2b4325513e6da4a8780e1043d2486bf59995e33cfe70309940c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FF3620~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FF3620~1.HTM
            • Size 54KB
            • SHA256 f0acb1ad146da71c65450b975f6e7e102eed03ee40eb9163e5d7b70df2e82146
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FF70C8~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FF70C8~1.HTM
            • Size 1.6MB
            • SHA256 47a2f160aa4a516f4a86f42d3d3716a7c9ce057df238f9f4c0014730fd19e189
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FFDA4B~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FFDA4B~1.HTM
            • Size 324KB
            • SHA256 d616325bad20d640e541ce89393da7a0ba9efa9f4677941fd97a2ad81e34ecdc
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FFMPEG~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FFMPEG~1.HTM
            • Size 2.9MB
            • SHA256 523dca8cbc2ad90281b8bc24c48fdd1e0dc22546519784fdc50fddc9cc03bb0c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FFMPEG~2.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FFMPEG~2.HTM
            • Size 61KB
            • SHA256 6783e37c2cafaec9337ac5188d72d1722b539f5bff9c08a1542ae0ec32bfb545
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FFMPEG~3.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FFMPEG~3.HTM
            • Size 340KB
            • SHA256 1e0c1482d7c0df446173268563f515dca6ed6dedf62b114a834d04ecb8aecfa9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FFMPEG~4.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FFMPEG~4.HTM
            • Size 110KB
            • SHA256 4cbeaf4948a0c267ea4de2f8bdaae49b169bd7d1a69202a4cf71fe79d9deb1a5
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FFPLAY~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FFPLAY~1.HTM
            • Size 2.3MB
            • SHA256 5741ada004b44ff55f156fe0e37cb8159ed6667da27869ef19ad72f4192708a3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FFPLAY~2.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FFPLAY~2.HTM
            • Size 41KB
            • SHA256 c94ff755a36c9028aeeaf93f853df75450c23962a7bea43b6ae0177684195c37
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FFPROB~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FFPROB~1.HTM
            • Size 2.3MB
            • SHA256 fe939a7dd6dbacf327611e497bb38f6e81a497eab73f0504287935c067efd2cc
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FFPROB~2.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\FFPROB~2.HTM
            • Size 57KB
            • SHA256 ca1dead6f3c6b93f6245ce6be3101ca2e176c69c768579a8d0d2383b57884763
            • MD5 SHA1 SHA512 SSDEEP TLSH

            GENERA~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\GENERA~1.HTM
            • Size 126KB
            • SHA256 0da20102efcc3435badffbe91d57672d3e41e459dc7122d583def2778be970dd
            • MD5 SHA1 SHA512 SSDEEP TLSH

            GIT-HO~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\GIT-HO~1.HTM
            • Size 27KB
            • SHA256 e44ed6484fa73f819c59494c68be232728319250bd86c6e32a760ddca620e108
            • MD5 SHA1 SHA512 SSDEEP TLSH

            LIBAVC~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\LIBAVC~1.HTM
            • Size 3KB
            • SHA256 faf8dd1ae157374e92a685970fa28f21e0df8a2dfb8c3ea99e58d6d956bee879
            • MD5 SHA1 SHA512 TLSH

            LIBAVD~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\LIBAVD~1.HTM
            • Size 2KB
            • SHA256 cea441629a753d099d8b1032f0814a87cfa113d830f8fcdebd047738cb5481ac
            • MD5 SHA1 SHA512 TLSH

            LIBAVF~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\LIBAVF~1.HTM
            • Size 3KB
            • SHA256 d02ec4ed1dddb7cb09f9c4e9f2bf38810b3050f6db5f839f398bd6561cab4322
            • MD5 SHA1 SHA512 TLSH

            LIBAVF~2.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\LIBAVF~2.HTM
            • Size 3KB
            • SHA256 49f9fdced269207bfd3a6bcb63738b3f1dcf2b3c7641eba509fd46f37c5cebcc
            • MD5 SHA1 SHA512 TLSH

            LIBAVU~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\LIBAVU~1.HTM
            • Size 3KB
            • SHA256 ba59342959874520f152b8df5eedde47295929a43e29646392e03c6fcdc2d8e9
            • MD5 SHA1 SHA512 TLSH

            LIBSWR~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\LIBSWR~1.HTM
            • Size 3KB
            • SHA256 f66d2d2e5f29ba56f47d2855d5cd8f276bf207241d024a5a06d0564b96d52bf5
            • MD5 SHA1 SHA512 TLSH

            LIBSWS~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\LIBSWS~1.HTM
            • Size 3KB
            • SHA256 41859c7b95dd3d1089e2189c2dc81b1da920557e66ec181a1f8fe04dcc829118
            • MD5 SHA1 SHA512 TLSH

            MAILIN~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\MAILIN~1.HTM
            • Size 30KB
            • SHA256 e6a26273f248a5ca7f4354fc8b19e4d0bceeefc3c7aa492db58072fdc9e6a944
            • MD5 SHA1 SHA512 SSDEEP TLSH

            NUT~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\NUT~1.HTM
            • Size 11KB
            • SHA256 3c42c776be67cf21b69dd5a2fe3dd6b08cc196eb9bbb2a9886366b2efa139ce6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            PLATFO~1.HTM

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\PLATFO~1.HTM
            • Size 21KB
            • SHA256 8d6c71e3d28c52cddd7de85fcdbbdd87d22a02fa9905a6b3169ff9767033fd6d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            STYLEM~1.CSS

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\STYLEM~1.CSS
            • Size 6KB
            • SHA256 02496d7bdbd48d0f332dc94b62668906cbeabc3a8592253d5dfe2e5196522660
            • MD5 SHA1 SHA512 SSDEEP TLSH

            default.css

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\doc\default.css
            • Size 2KB
            • SHA256 504c4a0980e6ec809da02ce16b73151622a2fdfb4409098c7ce96c1cac9b3735
            • MD5 SHA1 SHA512 TLSH

            LI6BC5~1.FFP

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\presets\LI6BC5~1.FFP
            • Size 227B
            • SHA256 b08a5ae448cb3cccd23faa6f42c8dbf61ead1a8381fce65636aa01a4a142cb8e
            • MD5 SHA1 SHA512 TLSH

            LIBVPX~1.FFP

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\presets\LIBVPX~1.FFP
            • Size 227B
            • SHA256 cf0dca9d029e0aa29c242e5a7ecfb202a55ae41c1acdf5e2e59bf281a0136251
            • MD5 SHA1 SHA512 TLSH

            LIBVPX~2.FFP

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\presets\LIBVPX~2.FFP
            • Size 227B
            • SHA256 4d32bed9032caf8bf4ef8e4bcac427f482c6191396ef6b11f075a264da3a8def
            • MD5 SHA1 SHA512 TLSH

            LIBVPX~3.FFP

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\presets\LIBVPX~3.FFP
            • Size 219B
            • SHA256 c2ccd70a941c9b7003e364d7cc0296e8f3dea78cc3a87ccdcaae7c39a1a05b79
            • MD5 SHA1 SHA512 TLSH

            LIBVPX~4.FFP

            • Path C:\Users\Admin\AppData\Local\Temp\ffmpeg-9.0-essentials_build\presets\LIBVPX~4.FFP
            • Size 227B
            • SHA256 5bcac409c81ec0e11091801d5d1322b5ec6a9bb8617d7dda022acfea0d498d52
            • MD5 SHA1 SHA512 TLSH

            memory/2340-98-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-104-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-97-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-93-0x00007FFE4D74F000-0x00007FFE4D750000-memory.dmp

            memory/2340-99-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-100-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-101-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-102-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-103-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-96-0x0000013B84930000-0x0000013B84952000-memory.dmp

            memory/2340-105-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-106-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-107-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-108-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-109-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-110-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-112-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-113-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

            memory/2340-114-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp