70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018.exe
Size 22KB
Sample260808-p3112axcnc
SHA256 70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018
MD5 798b13a5be9b30a3502580c1f49501a1
SHA1 d1f20de0851ed3569e53f072802154650063fecf
SHA512 63f84148f00cdece6f2f1112c94503a0a4711b69439b7cf05be27db0d85d5bf90cdd1124b341936d93ad3580d20c3c07b17667bdcfcd238507aeb463f05db605
SSDEEP 384:85o2Qbtj/kfngq+HKhQ01Q04wlLJ4jz7:o+tjsLzhQaQ046sz
TLSH
T174A229561E9505EEF807C57EC2218E2A9831FA30A761A0FF4693933B9C52FD4CA3C2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5628	srvhost05C1r.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4792	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1184	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4232	70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018.exe
4232	70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018.exe
4792	powershell.exe
4792	powershell.exe
4792	powershell.exe
5628	srvhost05C1r.exe
5628	srvhost05C1r.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeIncreaseQuotaPrivilege	4792	powershell.exe
Token: SeSecurityPrivilege	4792	powershell.exe
Token: SeTakeOwnershipPrivilege	4792	powershell.exe
Token: SeLoadDriverPrivilege	4792	powershell.exe
Token: SeSystemProfilePrivilege	4792	powershell.exe
Token: SeSystemtimePrivilege	4792	powershell.exe
Token: SeProfSingleProcessPrivilege	4792	powershell.exe
Token: SeIncBasePriorityPrivilege	4792	powershell.exe
Token: SeCreatePagefilePrivilege	4792	powershell.exe
Token: SeBackupPrivilege	4792	powershell.exe
Token: SeRestorePrivilege	4792	powershell.exe
Token: SeShutdownPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeSystemEnvironmentPrivilege	4792	powershell.exe
Token: SeRemoteShutdownPrivilege	4792	powershell.exe
Token: SeUndockPrivilege	4792	powershell.exe
Token: SeManageVolumePrivilege	4792	powershell.exe
Token: 33	4792	powershell.exe
Token: 34	4792	powershell.exe
Token: 35	4792	powershell.exe
Token: 36	4792	powershell.exe
Token: SeIncreaseQuotaPrivilege	4792	powershell.exe
Token: SeSecurityPrivilege	4792	powershell.exe
Token: SeTakeOwnershipPrivilege	4792	powershell.exe
Token: SeLoadDriverPrivilege	4792	powershell.exe
Token: SeSystemProfilePrivilege	4792	powershell.exe
Token: SeSystemtimePrivilege	4792	powershell.exe
Token: SeProfSingleProcessPrivilege	4792	powershell.exe
Token: SeIncBasePriorityPrivilege	4792	powershell.exe
Token: SeCreatePagefilePrivilege	4792	powershell.exe
Token: SeBackupPrivilege	4792	powershell.exe
Token: SeRestorePrivilege	4792	powershell.exe
Token: SeShutdownPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeSystemEnvironmentPrivilege	4792	powershell.exe
Token: SeRemoteShutdownPrivilege	4792	powershell.exe
Token: SeUndockPrivilege	4792	powershell.exe
Token: SeManageVolumePrivilege	4792	powershell.exe
Token: 33	4792	powershell.exe
Token: 34	4792	powershell.exe
Token: 35	4792	powershell.exe
Token: 36	4792	powershell.exe
Token: SeIncreaseQuotaPrivilege	4792	powershell.exe
Token: SeSecurityPrivilege	4792	powershell.exe
Token: SeTakeOwnershipPrivilege	4792	powershell.exe
Token: SeLoadDriverPrivilege	4792	powershell.exe
Token: SeSystemProfilePrivilege	4792	powershell.exe
Token: SeSystemtimePrivilege	4792	powershell.exe
Token: SeProfSingleProcessPrivilege	4792	powershell.exe
Token: SeIncBasePriorityPrivilege	4792	powershell.exe
Token: SeCreatePagefilePrivilege	4792	powershell.exe
Token: SeBackupPrivilege	4792	powershell.exe
Token: SeRestorePrivilege	4792	powershell.exe
Token: SeShutdownPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeSystemEnvironmentPrivilege	4792	powershell.exe
Token: SeRemoteShutdownPrivilege	4792	powershell.exe
Token: SeUndockPrivilege	4792	powershell.exe
Token: SeManageVolumePrivilege	4792	powershell.exe
Token: 33	4792	powershell.exe
Token: 34	4792	powershell.exe
Token: 35	4792	powershell.exe
Token: 36	4792	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 1184	4232	70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018.exe	89
PID 1184 wrote to memory of 4792	1184	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018.exe
"C:\Users\Admin\AppData\Local\Temp\70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s05C1.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\t.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792

C:\Users\Admin\AppData\Local\WinLogs\srvhost05C1r.exe
"C:\Users\Admin\AppData\Local\WinLogs\srvhost05C1r.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

s05C1.bat

Path C:\Users\Admin\AppData\Local\Temp\s05C1.bat
Size 771B
SHA256 3d7a54f68509e1e6a8d5d6562a307b4bf3411d0e08ba202f41676c3c4496f004
MD5 c76ab04ba961e6e793687232e189a4df
SHA1 d1f1a057b2ec34306eae34738f99c162a812e8a8
SHA512 65184d60f2fee6ff52a43244a7358f1fb8bb0333851cf37597d2d8d258309040bc07ab90e2332bb1010bfc07376ee64b7c5802f47f0063910080bb5dd8a153b1
TLSH
T14101897BA324A231CC8A1C5CD59E0C120C76182991279EA8211B0073D8B3AB5C3DA6CF
MD5 SHA1 SHA512 TLSH

Submit Download

t.ps1

Path C:\Users\Admin\AppData\Local\Temp\t.ps1
Size 486B
SHA256 ebac4e371c01e02ed570b6fd0e9631d34c6b722c88c575eef6719b342f8f236a
MD5 960b269e3b76d79dcca273f558f2b4cb
SHA1 ba386856470de431de4fb9eeaf88632b63d7ba7f
SHA512 8d4bc908fe716cf23382c11e357f328b7d8d463dde396f1f351eeaa207c91e907239bd79f93c6b17c4b3cc275064ec8225167ca186430c0e2678a6583dc3b750
TLSH
T125F09737FA349031C9976C6EC4A665940C291C29ED67A60C221F8034E5BB42AE2CE80A
MD5 SHA1 SHA512 TLSH

Submit Download

srvhost05C1r.exe

Path C:\Users\Admin\AppData\Local\WinLogs\srvhost05C1r.exe
Size 22KB
SHA256 70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018
MD5 798b13a5be9b30a3502580c1f49501a1
SHA1 d1f20de0851ed3569e53f072802154650063fecf
SHA512 63f84148f00cdece6f2f1112c94503a0a4711b69439b7cf05be27db0d85d5bf90cdd1124b341936d93ad3580d20c3c07b17667bdcfcd238507aeb463f05db605
SSDEEP 384:85o2Qbtj/kfngq+HKhQ01Q04wlLJ4jz7:o+tjsLzhQaQ046sz
TLSH
T174A229561E9505EEF807C57EC2218E2A9831FA30A761A0FF4693933B9C52FD4CA3C2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4792-21-0x0000020038A20000-0x0000020038A2A000-memory.dmp

Download

memory/4792-23-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-14-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-12-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-18-0x0000020038A00000-0x0000020038A1E000-memory.dmp

Download

memory/4792-19-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-20-0x0000020038C70000-0x0000020038D22000-memory.dmp

Download

memory/4792-11-0x0000020038970000-0x0000020038992000-memory.dmp

Download

memory/4792-22-0x0000020038E80000-0x0000020038E9E000-memory.dmp

Download

memory/4792-13-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-24-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-25-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-26-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-27-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-28-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-29-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-30-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-32-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp

Download

memory/4792-8-0x00007FFBD6F7F000-0x00007FFBD6F80000-memory.dmp

Download