eebd81b5b4eaacd363f36637d6e02226b6d93fe931a7fb66306a044acd4902d4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SquadSeed-2.1.1/SquadSeed.cmd
Size 293B
Sample260807-phzbpsfg83
SHA256 eebd81b5b4eaacd363f36637d6e02226b6d93fe931a7fb66306a044acd4902d4
MD5 7afab99243cba2ee221aab6bef52f87e
SHA1 cb1396407c6f7385021abff04cc6775f96589351
SHA512 c9b4d198cab9ff320cbb325e22a426ddb9f58e8cc75e94b47bed1b0da467cec4bcd80bdf8fe3ce7df4b35928ac00a4b82fceb29d0eee404c7eb46884154c45fd
TLSH
T17DE0C24294D9835C7AA7CC3574E261B86C2F91176300996230E0432D3A0E768C9E61C9
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
14	3480	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3480	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2104	cmd.exe
3160	cmd.exe
4692	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3480	powershell.exe
3480	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3480	4692	cmd.exe	87
PID 3480 wrote to memory of 696	3480	powershell.exe	88
PID 696 wrote to memory of 3428	696	csc.exe	89
PID 3480 wrote to memory of 2104	3480	powershell.exe	91
PID 2104 wrote to memory of 432	2104	cmd.exe	92
PID 3480 wrote to memory of 3160	3480	powershell.exe	93
PID 3160 wrote to memory of 1028	3160	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SquadSeed-2.1.1\SquadSeed.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\SquadSeed-2.1.1\Check-SquadSeedPlayers.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0tcau5ch\0tcau5ch.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F58.tmp" "c:\Users\Admin\AppData\Local\Temp\0tcau5ch\CSC728046DC9FCC4A799AAD35FF4A3738.TMP"
      4⤵
      PID:3428
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "chcp 65001 >nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:432
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "chcp 65001 >nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0tcau5ch.dll

Path C:\Users\Admin\AppData\Local\Temp\0tcau5ch\0tcau5ch.dll
Size 4KB
SHA256 938c791cdfe445e3a9d9fd45d27ba64c967da3cf16a6a204c283fd4577acfc01
MD5 b4b82a0446d20e06b094e7ed036e44a3
SHA1 77c2e638ffd1b2ec60c6bff86312250aee4a10a0
SHA512 5187bec583e0becf20fb93c89f2ed35ff15bb8e2342d032397b386c1118073742f862bf6d1767249b68e633b5d5532a21a3ebeee97ad4c7c421be69217bbad65
TLSH
T14F8165138BE54666E07A0B30ADF357166374F8105F63A35A16A1032DBCA13A66E32BF0
MD5 SHA1 SHA512 TLSH

Submit Download

RES2F58.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2F58.tmp
Size 1KB
SHA256 70e8fcacf996ffa899d14ce85fb9e2edb3440a08851a49fba536049ac0cd0ec1
MD5 87a481f08190160117279cdae1c70c1e
SHA1 bc73c8adb15db7ebc05f3a58de8351fe05d4a3ca
SHA512 18374a0f93bb59a594041181cdcdd872493b364c8f12563e9872d0690c302daf05732fc75034e6840bb1293f445b2d2c630b3966884f31f693693a591598ed44
TLSH
T1FB21AA0683E8471EF07707316AF9072FA678FD68DF62636B8500422C2C90504EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1451d0uy.0m3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1451d0uy.0m3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0tcau5ch.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0tcau5ch\0tcau5ch.0.cs
Size 1KB
SHA256 f456878d7c6020c9e20581d5d5a2096dc31a698861cc15b1c4f5bf82c6958cbf
MD5 0cd55077ca0c69f11dc8a5900ce29d9e
SHA1 97180214add7442a02589833cf6aa1d3f6a69947
SHA512 b58990f9da36a2f6e247d02653709ca0ee901087756f7823104b364d47ebd3d30418c40a7bf25f1fc7dc49115ffc554a8a7562eb99294f80dd5fd59ff07cf37a
TLSH
T149219E506E92859004B6502CDFCB65AABA17402B277E3C10B63E1221AF9706BE57DFDC
MD5 SHA1 SHA512 TLSH

Submit Download

0tcau5ch.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0tcau5ch\0tcau5ch.cmdline
Size 607B
SHA256 e64954155d2116d870a8894bb9f6a77eef5daf2d9479c4d73807e5ad834e1a89
MD5 47016ca7cf3ca7403e4d8d630405c50f
SHA1 5eefa7f670e0ee9ba7acd30e70921cca0025c1d9
SHA512 7395d583dfd501aab9beb9328fd4f6b5b4b8c364f3c34587f760486075335ecff6849baf90f762ca8c1056e3f50013ca965a288b8dc67b8599040454a9538fc9
TLSH
T1B4F0AC35023BC9BE45ED3403156ECA9CC373034B3089BF6865A4882EE5731422FD1BD1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC728046DC9FCC4A799AAD35FF4A3738.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0tcau5ch\CSC728046DC9FCC4A799AAD35FF4A3738.TMP
Size 652B
SHA256 938c434b1f1e4ee2a08ba1cd8508024a65a4004e6f0d44ad94903df664ffd889
MD5 fe9221794f981c824f55a73326131c36
SHA1 a43370c3cad92a9d35133f842fe55f708beb50dc
SHA512 05d49a7ebb141bce577dbf0562d20b5de3c9e1e607158b47f8e1b00150b417c525241228551ebe5aeed9db3f691ad8943baf42d4ba5cf2c2c4951f4ced28e21b
TLSH
T19CF05E0A63F8420EF0F74B30BEF6436395A9BC65DE3293ED6440431D28649149A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3480-24-0x000001ED535E0000-0x000001ED535F0000-memory.dmp

Download

memory/3480-2-0x000001ED556D0000-0x000001ED556F2000-memory.dmp

Download

memory/3480-1-0x000001ED535E0000-0x000001ED535F0000-memory.dmp

Download

memory/3480-22-0x000001ED53590000-0x000001ED53598000-memory.dmp

Download

memory/3480-23-0x000001ED535E0000-0x000001ED535F0000-memory.dmp

Download

memory/3480-0-0x000001ED535E0000-0x000001ED535F0000-memory.dmp

Download

memory/3480-25-0x000001ED57860000-0x000001ED57A22000-memory.dmp

Download

memory/3480-26-0x000001ED57F60000-0x000001ED58488000-memory.dmp

Download

memory/3480-27-0x000001ED535E0000-0x000001ED535F0000-memory.dmp

Download

memory/3480-28-0x000001ED535E0000-0x000001ED535F0000-memory.dmp

Download

memory/3480-29-0x000001ED535E0000-0x000001ED535F0000-memory.dmp

Download

memory/3480-30-0x000001ED535E0000-0x000001ED535F0000-memory.dmp

Download