821bad6ebf683c8948af31af1547d23f3b7ca15e48da763abad4809122f5a3ac

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BFsix_[unknowncheats.me]_.exe
Size 20KB
Sample260809-bskdmsfq6x
SHA256 821bad6ebf683c8948af31af1547d23f3b7ca15e48da763abad4809122f5a3ac
MD5 5a37ac826a2d9789be6aa727494f5bd3
SHA1 378f1246295b3b19fca79b654d14f2ab75a23ce0
SHA512 e520f3ca6936f5599c78fe781c0de99c9ab3b375ab4590f3a508a425412c72defda6bb4bf5ca7938586e61980bd1bc13668d1979d4e8752bb69d6ea344a9d73f
SSDEEP 384:F3gyJLPeed/v7gxCpiC1BAcZEY9ZItfQnn41/NAyEgWpAs1Fdbnn4gu33qK:7tpxvItfg4AyEdznd7nu33qK
TLSH
T1E5923B06E79609FAD6B6923DC1A3225EE2B27D051722E3CF1350837E1F726D0AC3A650
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 46 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3944	cmd.exe
4068	cmd.exe
3884	cmd.exe
4816	cmd.exe
1680	cmd.exe
1212	cmd.exe
2924	cmd.exe
1200	cmd.exe
2056	cmd.exe
2940	cmd.exe
2812	cmd.exe
3496	cmd.exe
1688	cmd.exe
4384	cmd.exe
1040	cmd.exe
3732	cmd.exe
692	cmd.exe
4828	cmd.exe
1524	cmd.exe
668	cmd.exe
3348	cmd.exe
4040	cmd.exe
3420	cmd.exe
4840	cmd.exe
1036	cmd.exe
3464	cmd.exe
2376	cmd.exe
3076	cmd.exe
4140	cmd.exe
740	cmd.exe
2716	cmd.exe
2512	cmd.exe
4148	cmd.exe
1984	cmd.exe
4888	cmd.exe
1728	cmd.exe
3684	cmd.exe
4648	cmd.exe
896	cmd.exe
2496	cmd.exe
3372	cmd.exe
2176	cmd.exe
4176	cmd.exe
5000	cmd.exe
4368	cmd.exe
2584	cmd.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3372	2172	BFsix_[unknowncheats.me]_.exe	92
PID 2172 wrote to memory of 2924	2172	BFsix_[unknowncheats.me]_.exe	93
PID 2172 wrote to memory of 3420	2172	BFsix_[unknowncheats.me]_.exe	94
PID 2172 wrote to memory of 3496	2172	BFsix_[unknowncheats.me]_.exe	95
PID 2172 wrote to memory of 4840	2172	BFsix_[unknowncheats.me]_.exe	96
PID 2172 wrote to memory of 3944	2172	BFsix_[unknowncheats.me]_.exe	97
PID 2172 wrote to memory of 1524	2172	BFsix_[unknowncheats.me]_.exe	100
PID 2172 wrote to memory of 4068	2172	BFsix_[unknowncheats.me]_.exe	101
PID 2172 wrote to memory of 3076	2172	BFsix_[unknowncheats.me]_.exe	102
PID 2172 wrote to memory of 1688	2172	BFsix_[unknowncheats.me]_.exe	103
PID 2172 wrote to memory of 1200	2172	BFsix_[unknowncheats.me]_.exe	104
PID 2172 wrote to memory of 2176	2172	BFsix_[unknowncheats.me]_.exe	108
PID 2172 wrote to memory of 4384	2172	BFsix_[unknowncheats.me]_.exe	110
PID 2172 wrote to memory of 668	2172	BFsix_[unknowncheats.me]_.exe	115
PID 2172 wrote to memory of 4888	2172	BFsix_[unknowncheats.me]_.exe	116
PID 2172 wrote to memory of 4176	2172	BFsix_[unknowncheats.me]_.exe	117
PID 2172 wrote to memory of 1036	2172	BFsix_[unknowncheats.me]_.exe	118
PID 2172 wrote to memory of 5000	2172	BFsix_[unknowncheats.me]_.exe	119
PID 2172 wrote to memory of 4368	2172	BFsix_[unknowncheats.me]_.exe	120
PID 2172 wrote to memory of 2056	2172	BFsix_[unknowncheats.me]_.exe	121
PID 2172 wrote to memory of 3464	2172	BFsix_[unknowncheats.me]_.exe	122
PID 2172 wrote to memory of 3348	2172	BFsix_[unknowncheats.me]_.exe	123
PID 2172 wrote to memory of 3884	2172	BFsix_[unknowncheats.me]_.exe	124
PID 2172 wrote to memory of 1728	2172	BFsix_[unknowncheats.me]_.exe	127
PID 2172 wrote to memory of 3684	2172	BFsix_[unknowncheats.me]_.exe	128
PID 2172 wrote to memory of 4140	2172	BFsix_[unknowncheats.me]_.exe	129
PID 2172 wrote to memory of 4816	2172	BFsix_[unknowncheats.me]_.exe	130
PID 2172 wrote to memory of 4648	2172	BFsix_[unknowncheats.me]_.exe	131
PID 2172 wrote to memory of 740	2172	BFsix_[unknowncheats.me]_.exe	132
PID 2172 wrote to memory of 1040	2172	BFsix_[unknowncheats.me]_.exe	133
PID 2172 wrote to memory of 896	2172	BFsix_[unknowncheats.me]_.exe	134
PID 2172 wrote to memory of 2716	2172	BFsix_[unknowncheats.me]_.exe	135
PID 2172 wrote to memory of 2940	2172	BFsix_[unknowncheats.me]_.exe	136
PID 2172 wrote to memory of 2376	2172	BFsix_[unknowncheats.me]_.exe	137
PID 2172 wrote to memory of 4040	2172	BFsix_[unknowncheats.me]_.exe	138
PID 2172 wrote to memory of 2512	2172	BFsix_[unknowncheats.me]_.exe	139
PID 2172 wrote to memory of 3732	2172	BFsix_[unknowncheats.me]_.exe	140
PID 2172 wrote to memory of 2812	2172	BFsix_[unknowncheats.me]_.exe	141
PID 2172 wrote to memory of 4148	2172	BFsix_[unknowncheats.me]_.exe	142
PID 2172 wrote to memory of 1984	2172	BFsix_[unknowncheats.me]_.exe	143
PID 2172 wrote to memory of 2584	2172	BFsix_[unknowncheats.me]_.exe	144
PID 2172 wrote to memory of 2496	2172	BFsix_[unknowncheats.me]_.exe	145
PID 2172 wrote to memory of 1680	2172	BFsix_[unknowncheats.me]_.exe	146
PID 2172 wrote to memory of 1212	2172	BFsix_[unknowncheats.me]_.exe	150
PID 2172 wrote to memory of 692	2172	BFsix_[unknowncheats.me]_.exe	151
PID 2172 wrote to memory of 4828	2172	BFsix_[unknowncheats.me]_.exe	152

C:\Users\Admin\AppData\Local\Temp\BFsix_[unknowncheats.me]_.exe
"C:\Users\Admin\AppData\Local\Temp\BFsix_[unknowncheats.me]_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads