01647342dde52b3fde14d55258e33cf5dc6c1a59465cf5f8ba49a10488dc5e9e

Analysis

max time kernel
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cisteni.bat
Size 12KB
Sample260809-jg3d3staqf
SHA256 01647342dde52b3fde14d55258e33cf5dc6c1a59465cf5f8ba49a10488dc5e9e
MD5 1a389b66d19755378805d69a1e2f0e17
SHA1 f614cfee8a383365ffb06e434a6e65cbb94f299b
SHA512 8eeb589d65056573cc03e1cc0d997ad5e5bf7951bd4bef48ab20a57fb8eb338ae7edeebeb8a69361dbebc1729984e85c0d47fcfd8f58a1728dec98b714ff598f
SSDEEP 192:wf/4e4ndfOI9nskJZ3zQfOUeOzOjOfFK5oVnT13rNo/vBpMLQB+PCnUbJ2VHn:wv6N9nsssveyi44mnnH4Hn
TLSH
T102423E0D3E4148569AB0E248D53E4051E367978B1851FB8871EFF0B5EB3239872BE4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

execution

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
548	cmd.exe

Runs net.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 5724	548	cmd.exe	90
PID 5724 wrote to memory of 5160	5724	net.exe	91
PID 548 wrote to memory of 4912	548	cmd.exe	92
PID 548 wrote to memory of 3800	548	cmd.exe	93
PID 548 wrote to memory of 3660	548	cmd.exe	94
PID 3660 wrote to memory of 3124	3660	Dism.exe	95
PID 548 wrote to memory of 2828	548	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Cisteni.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5160
- C:\Windows\system32\choice.exe
  choice /c AN /t 20 /d A /m "Chcete nyni spustit udrzbu a audit systemu?"
  2⤵
  PID:4912
- C:\Windows\system32\choice.exe
  choice /c 12 /t 10 /d 1 /m "Zadejte cislo volby (1 nebo 2, po 10s automaticky 1): "
  2⤵
  PID:3800
- C:\Windows\system32\Dism.exe
  dism /online /cleanup-image /restorehealth
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {50C4B258-78BD-48BB-AC99-8314F3B1F89D}
    3⤵
    - Drops file in Windows directory
    PID:3124
- C:\Windows\system32\sfc.exe
  sfc /scannow
  2⤵
  PID:2828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 284KB
SHA256 627025a1a8495fbc58ce22c39d79c9bde36e924889bd5fe705d24c576c50be82
MD5 fdbbad3636e40ebf8a477ea7dc4e00fc
SHA1 7371818f0e68c6fad885ed99f563408751cb0094
SHA512 e1a183c7ba35932c85c0df5e9ef511c04c3d939663b511d968c40ef9b5363cbfacf6ddd1b988efe947ee3eb6e86e8f8436f0f02e0af74ac70ff9a451e7338259
SSDEEP 6144:ynI8LbLgP1x1O1mLML4qLF2UUmLU+Tfu1G11lzBMbq9bKPWDCtP4flDDUoZ4A:yV4A
TLSH
T14C54AC1E57AF09B1A149C40372759AFDA2D6B483A6C8F354772FD2297BC258B8F1F180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download