fb433d0b0035234ab82b0bf7a610b89b88e660714df01409ff2135d9cc005500

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mysterious Retrac/PATCH.bat
Size 324B
Sample260809-2nkrqaep2y
SHA256 fb433d0b0035234ab82b0bf7a610b89b88e660714df01409ff2135d9cc005500
MD5 3409e0a96094afa88bc1c30feebd8f1a
SHA1 c40ac05c6e67b0f05dce0ed762d14c6258fe9184
SHA512 d94b686071acb42e2d42a8292b9f3154e66a37a908f5b7921be2a9ec583210f44a27b1d1304046ad8f3d78c1c4f555ce998e177c6644c317d7babc1130e66844
TLSH
T1F0E07D9B61CF464A59E012212B2F36D1F49B522BB804244A3476D2AA0747ADA624D98D
MD5 SHA1 SHA512 TLSH

Score

5^/10

defense_evasion execution

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
992	Mysterious (2).exe
992	Mysterious (2).exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3144	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2364	timeout.exe
1788	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4276	1337patcher.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	1337patcher.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 992	3144	cmd.exe	87
PID 3144 wrote to memory of 2364	3144	cmd.exe	88
PID 3144 wrote to memory of 1788	3144	cmd.exe	89
PID 3144 wrote to memory of 4276	3144	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Mysterious Retrac\PATCH.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\Mysterious Retrac\Mysterious (2).exe
  "Mysterious (2).exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:992
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2364
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\Mysterious Retrac\1337patcher.exe
  1337patcher.exe patch.1337 -ns "Mysterious (2).exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-0-0x00007FF77BFF1000-0x00007FF77C08F000-memory.dmp

Download

memory/992-1-0x00007FF77C0BE000-0x00007FF77C8A2000-memory.dmp

Download

memory/992-4-0x00007FF77C0BE000-0x00007FF77C8A2000-memory.dmp

Download

memory/4276-2-0x00000000008F0000-0x00000000008FA000-memory.dmp

Download