cf029ee66a839dddacc721b98ab3b3039533e64c2c4dee6d1fc45db38b0c781e

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/GO_CAI_DAT.bat
Size 2KB
Sample260807-wtly3stxev
SHA256 cf029ee66a839dddacc721b98ab3b3039533e64c2c4dee6d1fc45db38b0c781e
MD5 aa786af1754519c1bd2d4018f3b2b590
SHA1 05067ea1a79710971c2243320a340db16880cb09
SHA512 7bb8e8c31ff3b3d1444e2c7c72320ba452e851e3e7f136c5061f449abdc45859d020a7c10f362b06b4d14e6cb615fe867bf672425d02f55bd8cd6a8ea5acff41
TLSH
T11551530239225E068570B5C0D97A99637BAC429796337DC6B6D33635B88D3D933B87C8
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4152	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 464	4152	cmd.exe	90
PID 4152 wrote to memory of 256	4152	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client_Game_TTDL\TruyenThuyetDoLong\LauncherClient\GO_CAI_DAT.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:464
- C:\Windows\system32\choice.exe
  choice /c YN /n /m "Tiep tuc? [Y/N] "
  2⤵
  PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads