0981b8b0b3a9c70fb2c0b0c32b23dc8a1f0f870eca806d1ef7a4d029065c5ae4

Analysis

max time kernel
98s
max time network
101s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
retrac-b480441522e94b4e.exe
Size 91KB
Sample260809-wvb59staqh
SHA256 0981b8b0b3a9c70fb2c0b0c32b23dc8a1f0f870eca806d1ef7a4d029065c5ae4
MD5 ca2a8308b71ae9b3c99ea77f2e8a5bcf
SHA1 dce2d3035c773890999dcfe8637587169141473c
SHA512 0a2aa4836aedac56d3981bdba33ae42d3f3297a150ee46e534c3fc41dc74e911bacc441f167464087167d3c75c6c5c3ab252ebeb4c45af6ee9f454a2ba33544e
SSDEEP 768:tkNqK6zWmj8JpFMuFxFVsyAFhDBOlyc70utbCct40wm2xuDIJlJNkDSR+mA/b9o1:Uq9nDAUWDDy5uEJi2QmAKFJ1
TLSH
T12593D80BAB6FF92DE2625175F8601D51AF32BCAD03D37E4F8B500D924A5AFA09F115C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3568	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3568	1680	retrac-b480441522e94b4e.exe	82

C:\Users\Admin\AppData\Local\Temp\retrac-b480441522e94b4e.exe
"C:\Users\Admin\AppData\Local\Temp\retrac-b480441522e94b4e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads