eebd81b5b4eaacd363f36637d6e02226b6d93fe931a7fb66306a044acd4902d4

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SquadSeed-2.1.1/SquadSeed.cmd
Size 293B
Sample260807-phzbpsfg83
SHA256 eebd81b5b4eaacd363f36637d6e02226b6d93fe931a7fb66306a044acd4902d4
MD5 7afab99243cba2ee221aab6bef52f87e
SHA1 cb1396407c6f7385021abff04cc6775f96589351
SHA512 c9b4d198cab9ff320cbb325e22a426ddb9f58e8cc75e94b47bed1b0da467cec4bcd80bdf8fe3ce7df4b35928ac00a4b82fceb29d0eee404c7eb46884154c45fd
TLSH
T17DE0C24294D9835C7AA7CC3574E261B86C2F91176300996230E0432D3A0E768C9E61C9
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4812	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4812	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2776	cmd.exe
3296	cmd.exe
3524	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4812	powershell.exe
4812	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4812	2776	cmd.exe	89
PID 4812 wrote to memory of 3492	4812	powershell.exe	91
PID 3492 wrote to memory of 5456	3492	csc.exe	92
PID 4812 wrote to memory of 3296	4812	powershell.exe	93
PID 3296 wrote to memory of 5432	3296	cmd.exe	94
PID 4812 wrote to memory of 3524	4812	powershell.exe	95
PID 3524 wrote to memory of 4940	3524	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SquadSeed-2.1.1\SquadSeed.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\SquadSeed-2.1.1\Check-SquadSeedPlayers.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qixudedt\qixudedt.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22B1.tmp" "c:\Users\Admin\AppData\Local\Temp\qixudedt\CSC8EBC068D47E644F1B9F7DE3C3CB41A97.TMP"
      4⤵
      PID:5456
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "chcp 65001 >nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5432
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "chcp 65001 >nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES22B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES22B1.tmp
Size 1KB
SHA256 2d9fc13fdb0b883d6fc576bf09cd59fbd0ddcf4828bed361fa97788422834d11
MD5 248fad51597f66879b6a5ebd95a86cad
SHA1 304228c32f5bc45fd7a5eeb9276e8c95be5d809d
SHA512 c97987aa2a62cdf97274066ec48401389a0178c2552a43f92785bc0f8054cc65f969e7d096592fcbc8c9aeb0c78a85a01faefc31dbff454d7d13118a933e8a8a
TLSH
T10421CC05A7E9871FF0B75B3169F6132B9365FD68EF65A36A8900422D2C01304DEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

qixudedt.dll

Path C:\Users\Admin\AppData\Local\Temp\qixudedt\qixudedt.dll
Size 4KB
SHA256 9e518692f5c3b64abf92d14fae865a6c5eeba2dc015327de493f464869c4078f
MD5 d7357d1172e3be15c3234593aaab4aff
SHA1 6d3ed05ab201bff720edb359ba8e31f94bfda9e0
SHA512 972992bd2c6ccb820ff728cefc14aee4ee65b74801121199b3c24c1386eb9a2a9793b69d06e4d6ac20ae3560a8895d3894b59cf7f4f4c0ea0a5ccbe1e49cab91
TLSH
T140816613DBE54656E0760B30ACF3471673B0E8105F63931A16A1032DBCA13A56E32FF0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8EBC068D47E644F1B9F7DE3C3CB41A97.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qixudedt\CSC8EBC068D47E644F1B9F7DE3C3CB41A97.TMP
Size 652B
SHA256 52e476e2981b67227e4bdf2d56f0ca28b57f60902c43e08a49f7717654254cec
MD5 fde59861a741b39a6cee2d95a60d0f63
SHA1 a10171a2e815e8a662ea710174731ec5ba083435
SHA512 e025ea6f371df13020570f99e756b060c39d42fbb55df8bd9c182143f932c45b5bbd6bdcd0c15973c33f21a6b8d38c43c7492b8ea28d7f167417046d772c90a8
TLSH
T114F05E0967F8520EF0F34F30BDF6436391A9BC65DE3293ED2840131D2C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qixudedt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qixudedt\qixudedt.0.cs
Size 1KB
SHA256 f456878d7c6020c9e20581d5d5a2096dc31a698861cc15b1c4f5bf82c6958cbf
MD5 0cd55077ca0c69f11dc8a5900ce29d9e
SHA1 97180214add7442a02589833cf6aa1d3f6a69947
SHA512 b58990f9da36a2f6e247d02653709ca0ee901087756f7823104b364d47ebd3d30418c40a7bf25f1fc7dc49115ffc554a8a7562eb99294f80dd5fd59ff07cf37a
TLSH
T149219E506E92859004B6502CDFCB65AABA17402B277E3C10B63E1221AF9706BE57DFDC
MD5 SHA1 SHA512 TLSH

Submit Download

qixudedt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qixudedt\qixudedt.cmdline
Size 607B
SHA256 3c144233745046119f2e4f18b76135ec4178a00be11d88a038c411d8183fec94
MD5 4f5c981630ea8567caa12a2e1162de63
SHA1 d8986f6c41ef2b1d8c2671811dc23b5c62833f03
SHA512 467e814fa2a1b710bf8e730859cec57f1c52904499d51c43fba6e607219d8f196bb26360850e8ed331318e6c988399a7b66f4d4ae3db9a0ecdd5ff78deff8c33
TLSH
T12FF0A239023BC5BE45FD3403256E8AECD233134B3481EF5C6598881EFD574140F50794
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4812-16-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-4-0x0000022AD0850000-0x0000022AD0872000-memory.dmp

Download

memory/4812-9-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-10-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-11-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-12-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-13-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-0-0x00007FF845DBF000-0x00007FF845DC0000-memory.dmp

Download

memory/4812-7-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-6-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-20-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-8-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-26-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-29-0x0000022AD0D60000-0x0000022AD0D68000-memory.dmp

Download

memory/4812-5-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-30-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-1-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-31-0x0000022AEC270000-0x0000022AEC432000-memory.dmp

Download

memory/4812-32-0x0000022AEC970000-0x0000022AECE98000-memory.dmp

Download

memory/4812-33-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-34-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/4812-35-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download