fee576a6c6fbb39b46e3f7e69c3fdd4114027de07cbbad45db9c9433f01072df

Resubmissions

08/08/2026, 16:24

260808-twkspaed493

08/08/2026, 16:20

260808-ttcz3ahr7s3

Analysis

user interaction
yes
max time kernel
898s
max time network
502s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0x21 viewbot.exe
Size 9.5MB
Sample260808-twkspaed49
SHA256 fee576a6c6fbb39b46e3f7e69c3fdd4114027de07cbbad45db9c9433f01072df
MD5 669b64952ee4ce24023fde6f4c827726
SHA1 109b45ddf0806a4678a6da3bf7e9e5c250472a19
SHA512 12068052b76707e63b88e90b913cf0b83ab5c12036129242ebd1992dcd2e1c4151cda4f7078ded4ee7a659f00a5663c2679dc2b9cbfce5fa64ee4b345a0c167e
SSDEEP 98304:aSJc1ea706SkHwZEYLs5yIzb456S2P8S41GBPQFwM7:avk6SkZYLTI345WPx
TLSH
T1D4A67B03EC6564E9C1ADE2308AA39262BB757C480B3227D32B90F6747E77BD06D79354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2128	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 2128	688	0x21 viewbot.exe	87

C:\Users\Admin\AppData\Local\Temp\0x21 viewbot.exe
"C:\Users\Admin\AppData\Local\Temp\0x21 viewbot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads