e18ab5c1470d075e2d1bed4b8d4da4d65aa1c2825a558f4f27d99dd5b0a5bce7

Analysis

user interaction
yes
max time kernel
58s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.bat
Size 532KB
Sample260805-e1bm9ayald
SHA256 e18ab5c1470d075e2d1bed4b8d4da4d65aa1c2825a558f4f27d99dd5b0a5bce7
MD5 369211263f07ab3fff1f967f38187f9e
SHA1 942cecea5394820edf92d12a1e08471a6272f555
SHA512 443567c2a02a6e7fa5f010c6050d72e852bcf8eb54b7e85dd3435ffaa2e58ee92a73c2afd0d8a0dff20aefa87fed3e2df4ce44df300a6e052e717df118ad4fd5
SSDEEP 12288:djoFOcQtoN0xFSX7aHJdtPWY3DV+Wm91m8Sx:VoFOcQt40g7ajtOYzV+Wt/x
TLSH
T1D8C4FC51FEDC060F349E4847B0EDC682FAF56F17D5E2B4822B8B6366240FE6E652D085
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1964	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Executes a command shell one-liner
PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads