5ea239964133266725136ac3439b8506c32a1912fb497a6bd0c3d096d0385809

Analysis

max time kernel
298s
max time network
290s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/08/2026, 20:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RSGl3PFSz.cmd
Size 1KB
Sample260804-yw6sdaxtfv
SHA256 5ea239964133266725136ac3439b8506c32a1912fb497a6bd0c3d096d0385809
MD5 78551a42555e8d103d30ccbc75299f2f
SHA1 e70b85839b9022974e29d23d44035acc22a39492
SHA512 d4afa5c2be756ac6b9401538d77b986ff47f82b63f59408408787b80150f85f2690602d08b2596f3f67f9ae85997abfd4761f3cb1439255d2dc86d862b4fe858
TLSH
T144214996B022492994B0337A4B354733970E72C33980F5BCB1B0C89D74CF52DBAB22D4
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	discord.com
22	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3552	MSBuild.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2140	cmd.exe
4572	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	MSBuild.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1656	2140	cmd.exe	83
PID 2140 wrote to memory of 5184	2140	cmd.exe	84
PID 5184 wrote to memory of 4572	5184	conhost.exe	85
PID 4572 wrote to memory of 3552	4572	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RSGl3PFSz.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\system32\where.exe
  where conhost.exe
  2⤵
  PID:1656
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RSGl3PFSz.cmd" /launched
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Windows\System32\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\RSGl3PFSz.cmd /launched
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\FluentAssertions.csproj" /nologo /v:q
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3552-0-0x000002D324B50000-0x000002D324B8E000-memory.dmp

Download

memory/3552-1-0x000002D324F30000-0x000002D324F4A000-memory.dmp

Download

memory/3552-2-0x000002D33F1B0000-0x000002D33F30A000-memory.dmp

Download

memory/3552-3-0x000002D324FD0000-0x000002D324FE0000-memory.dmp

Download

memory/3552-4-0x000002D3251A0000-0x000002D3251D0000-memory.dmp

Download

memory/3552-5-0x000002D33F410000-0x000002D33F48C000-memory.dmp

Download

memory/3552-6-0x000002D324FD0000-0x000002D324FE0000-memory.dmp

Download

memory/3552-7-0x000002D33E990000-0x000002D33ECA8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads