eb0379d9abb2f294c9d8cf3fe41a6dfb37a5f89e807c6a1ce0fbca6dbcfcf644

Analysis

max time kernel
149s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
java-qEKUrj.exe
Size 155.8MB
Sample260808-zpmxcsdm3x
SHA256 eb0379d9abb2f294c9d8cf3fe41a6dfb37a5f89e807c6a1ce0fbca6dbcfcf644
MD5 72d3a666b5e88f03b14fd9c8f49c197d
SHA1 dd6b42a020b6512aa5bb2e82ebf96291562edba8
SHA512 e246ea48784252cf23aa13c2f69cd8aa2d6e006f3b71119fdf9e63e5e1df48837d6a1a69fb25a7c409f3fd3189758b125052d69d513d7c14af64bf1c6361f095
SSDEEP 1572864:MVU4t/Ct6JMgabao+nh+bw4FlWMZBZHuoM2t52kOUeEbaVO7GJbdHDexdypGT+LY:KYUJkH0sEQ
TLSH
T16F788B03E29A40E9E05DD1B587578237EE72B8864738A6DF2754075A2F77FE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1268	tasklist.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4480	cmd.exe
2668	cmd.exe
1628	cmd.exe
1528	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4408	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3076	WMIC.exe
Token: SeSecurityPrivilege	3076	WMIC.exe
Token: SeTakeOwnershipPrivilege	3076	WMIC.exe
Token: SeLoadDriverPrivilege	3076	WMIC.exe
Token: SeSystemProfilePrivilege	3076	WMIC.exe
Token: SeSystemtimePrivilege	3076	WMIC.exe
Token: SeProfSingleProcessPrivilege	3076	WMIC.exe
Token: SeIncBasePriorityPrivilege	3076	WMIC.exe
Token: SeCreatePagefilePrivilege	3076	WMIC.exe
Token: SeBackupPrivilege	3076	WMIC.exe
Token: SeRestorePrivilege	3076	WMIC.exe
Token: SeShutdownPrivilege	3076	WMIC.exe
Token: SeDebugPrivilege	3076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3076	WMIC.exe
Token: SeRemoteShutdownPrivilege	3076	WMIC.exe
Token: SeUndockPrivilege	3076	WMIC.exe
Token: SeManageVolumePrivilege	3076	WMIC.exe
Token: 33	3076	WMIC.exe
Token: 34	3076	WMIC.exe
Token: 35	3076	WMIC.exe
Token: 36	3076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3076	WMIC.exe
Token: SeSecurityPrivilege	3076	WMIC.exe
Token: SeTakeOwnershipPrivilege	3076	WMIC.exe
Token: SeLoadDriverPrivilege	3076	WMIC.exe
Token: SeSystemProfilePrivilege	3076	WMIC.exe
Token: SeSystemtimePrivilege	3076	WMIC.exe
Token: SeProfSingleProcessPrivilege	3076	WMIC.exe
Token: SeIncBasePriorityPrivilege	3076	WMIC.exe
Token: SeCreatePagefilePrivilege	3076	WMIC.exe
Token: SeBackupPrivilege	3076	WMIC.exe
Token: SeRestorePrivilege	3076	WMIC.exe
Token: SeShutdownPrivilege	3076	WMIC.exe
Token: SeDebugPrivilege	3076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3076	WMIC.exe
Token: SeRemoteShutdownPrivilege	3076	WMIC.exe
Token: SeUndockPrivilege	3076	WMIC.exe
Token: SeManageVolumePrivilege	3076	WMIC.exe
Token: 33	3076	WMIC.exe
Token: 34	3076	WMIC.exe
Token: 35	3076	WMIC.exe
Token: 36	3076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4408	WMIC.exe
Token: SeSecurityPrivilege	4408	WMIC.exe
Token: SeTakeOwnershipPrivilege	4408	WMIC.exe
Token: SeLoadDriverPrivilege	4408	WMIC.exe
Token: SeSystemProfilePrivilege	4408	WMIC.exe
Token: SeSystemtimePrivilege	4408	WMIC.exe
Token: SeProfSingleProcessPrivilege	4408	WMIC.exe
Token: SeIncBasePriorityPrivilege	4408	WMIC.exe
Token: SeCreatePagefilePrivilege	4408	WMIC.exe
Token: SeBackupPrivilege	4408	WMIC.exe
Token: SeRestorePrivilege	4408	WMIC.exe
Token: SeShutdownPrivilege	4408	WMIC.exe
Token: SeDebugPrivilege	4408	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4408	WMIC.exe
Token: SeRemoteShutdownPrivilege	4408	WMIC.exe
Token: SeUndockPrivilege	4408	WMIC.exe
Token: SeManageVolumePrivilege	4408	WMIC.exe
Token: 33	4408	WMIC.exe
Token: 34	4408	WMIC.exe
Token: 35	4408	WMIC.exe
Token: 36	4408	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4408	WMIC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2140	2824	java-qEKUrj.exe	81
PID 2824 wrote to memory of 1528	2824	java-qEKUrj.exe	82
PID 1528 wrote to memory of 3076	1528	cmd.exe	84
PID 2824 wrote to memory of 4480	2824	java-qEKUrj.exe	86
PID 4480 wrote to memory of 4408	4480	cmd.exe	88
PID 2824 wrote to memory of 2668	2824	java-qEKUrj.exe	89
PID 2668 wrote to memory of 1268	2668	cmd.exe	91
PID 2824 wrote to memory of 1628	2824	java-qEKUrj.exe	92
PID 1628 wrote to memory of 3724	1628	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\java-qEKUrj.exe
"C:\Users\Admin\AppData\Local\Temp\java-qEKUrj.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\java-qEKUrj.exe
  "C:\Users\Admin\AppData\Local\Temp\java-qEKUrj.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\java-qEKUrj" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1684 --field-trial-handle=1688,i,16170730943700094068,8472936582113568148,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name /value
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model /value
    3⤵
    PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads