f083a3a925281fbf546dae1a2e45b802322db786e581f2573847d51a1362578e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Start_Launcher.bat
Size 4KB
Sample260807-wtly3stxev
SHA256 f083a3a925281fbf546dae1a2e45b802322db786e581f2573847d51a1362578e
MD5 41ac38742785ae17fcf3a619840d65a3
SHA1 da7160875028d050f56c195394a6395c4ba5cb12
SHA512 35ac86679e6c1b48334e1935e81b274b2eef5c4bb343e36e3bf9bdd19a400e2477c11e8b895f036a6b4eb42da729acbbf8621a84470c21e1039eefef360300bf
SSDEEP 96:X1yv6cwuY6dY6ZNLKI/pqc5d+rtuBAu9e7dupUkmhmKh5uVhJr0J9N:Fc6cwv6u63Lfqc5dM1raULAdDJr0J9N
TLSH
T15BA173827D04C9268C75F4D0A8390807E79B41C76753D6F6316339A6760D6CF02BE6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2524	cmd.exe
3848	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 956	2524	cmd.exe	86
PID 2524 wrote to memory of 3136	2524	cmd.exe	87
PID 2524 wrote to memory of 3400	2524	cmd.exe	88
PID 2524 wrote to memory of 3848	2524	cmd.exe	89
PID 3848 wrote to memory of 2848	3848	cmd.exe	90
PID 3848 wrote to memory of 3176	3848	cmd.exe	91
PID 2524 wrote to memory of 2060	2524	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client_Game_TTDL\TruyenThuyetDoLong\LauncherClient\Start_Launcher.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
  2⤵
  PID:956
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
  2⤵
  PID:3136
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client" /v Release
  2⤵
  PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /ve 2>nul | find "REG_SZ"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /ve
    3⤵
    PID:2848
- - C:\Windows\system32\find.exe
    find "REG_SZ"
    3⤵
    PID:3176
- C:\Windows\system32\choice.exe
  choice /c YN /n /m "Mo CAI_DAT.bat ngay bay gio? [Y/N] "
  2⤵
  PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads