0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f.exe
Size 1.4MB
Sample260810-me8d4afl8x
SHA256 0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f
MD5 4e29cf075dbcfa95f55d49616d0aa3dd
SHA1 a22982dcc206d351bd76b37ca192f202cd6b6b5a
SHA512 d5ac66ec49595b5180f5bc93a58d539944a11a2eff696da15097f98911a7ce19271e1c87c43db7986bf08bd28a10c9de8475a4863b8d7d6793fad8a3550adf98
SSDEEP 24576:oDw7qpUzgIqvutrpPwU1vsp7/TRvCAyzUodJet:oDwC4gIqvutrpPwUOjTRvC
TLSH
T1CD654A67E7A344ECC5AFC1348256D772BA30F46D0534BE6E1AA4D7322F21E609B2E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6100	cmd.exe
2340	cmd.exe
4548	cmd.exe
4272	cmd.exe
5288	cmd.exe
2780	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2340	4488	0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f.exe	90
PID 4488 wrote to memory of 4548	4488	0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f.exe	91
PID 4488 wrote to memory of 4272	4488	0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f.exe	92
PID 4488 wrote to memory of 5288	4488	0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f.exe	93
PID 4488 wrote to memory of 2780	4488	0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f.exe	94
PID 4488 wrote to memory of 6100	4488	0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f.exe	95

C:\Users\Admin\AppData\Local\Temp\0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f.exe
"C:\Users\Admin\AppData\Local\Temp\0ba102a2477ba6cf93dbdd5710bec65a7ab6b2ce5281905272640dfc8025393f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cat /etc/os-release | grep PRETTY_NAME 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:2340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c uname -a 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cat /etc/os-release | grep PRETTY_NAME 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c uname -a 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:5288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cat /etc/os-release | grep PRETTY_NAME 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c uname -a 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4488-0-0x00007FF62D430000-0x00007FF62D59E000-memory.dmp

Download