f083a3a925281fbf546dae1a2e45b802322db786e581f2573847d51a1362578e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Start_Launcher.bat
Size 4KB
Sample260807-wtly3stxev
SHA256 f083a3a925281fbf546dae1a2e45b802322db786e581f2573847d51a1362578e
MD5 41ac38742785ae17fcf3a619840d65a3
SHA1 da7160875028d050f56c195394a6395c4ba5cb12
SHA512 35ac86679e6c1b48334e1935e81b274b2eef5c4bb343e36e3bf9bdd19a400e2477c11e8b895f036a6b4eb42da729acbbf8621a84470c21e1039eefef360300bf
SSDEEP 96:X1yv6cwuY6dY6ZNLKI/pqc5d+rtuBAu9e7dupUkmhmKh5uVhJr0J9N:Fc6cwv6u63Lfqc5dM1raULAdDJr0J9N
TLSH
T15BA173827D04C9268C75F4D0A8390807E79B41C76753D6F6316339A6760D6CF02BE6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3196	cmd.exe
5368	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 5428	3196	cmd.exe	90
PID 3196 wrote to memory of 6068	3196	cmd.exe	91
PID 3196 wrote to memory of 5112	3196	cmd.exe	92
PID 3196 wrote to memory of 5368	3196	cmd.exe	93
PID 5368 wrote to memory of 4380	5368	cmd.exe	94
PID 5368 wrote to memory of 3428	5368	cmd.exe	95
PID 3196 wrote to memory of 3676	3196	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client_Game_TTDL\TruyenThuyetDoLong\LauncherClient\Start_Launcher.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
  2⤵
  PID:5428
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
  2⤵
  PID:6068
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client" /v Release
  2⤵
  PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /ve 2>nul | find "REG_SZ"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\InprocServer32" /ve
    3⤵
    PID:4380
- - C:\Windows\system32\find.exe
    find "REG_SZ"
    3⤵
    PID:3428
- C:\Windows\system32\choice.exe
  choice /c YN /n /m "Mo CAI_DAT.bat ngay bay gio? [Y/N] "
  2⤵
  PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads