f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce.exe
Size 1.4MB
Sample260810-qbd8mat1es
SHA256 f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce
MD5 eb8eee2599529315fc727a089a88e783
SHA1 a910e7faceb2136004eb39285dd3465c0ac85120
SHA512 a35248581383a4c3f7cad3fe847a1063c7427dae26520a609bf291b10f7127f820f49968f02ba7e879deb9067070ad26703dfdfaea7ebfc1afa45b51856b2a93
SSDEEP 24576:dDw7qpUzgIqvutrpPwU1vsp7/TRvCAyzUodJet:dDwC4gIqvutrpPwUOjTRvC
TLSH
T176654A67E7A344ECC5AFC1348256D772BA30F46D0534BE6E1AA4D7322F21E609B2E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1420	cmd.exe
936	cmd.exe
5624	cmd.exe
3012	cmd.exe
4852	cmd.exe
2484	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 2484	448	f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce.exe	90
PID 448 wrote to memory of 1420	448	f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce.exe	91
PID 448 wrote to memory of 936	448	f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce.exe	92
PID 448 wrote to memory of 5624	448	f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce.exe	93
PID 448 wrote to memory of 3012	448	f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce.exe	94
PID 448 wrote to memory of 4852	448	f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce.exe	95

C:\Users\Admin\AppData\Local\Temp\f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce.exe
"C:\Users\Admin\AppData\Local\Temp\f695f970004c148b08e202ef1283d31c464af6ea14bb9569a52650591f7716ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cat /etc/os-release | grep PRETTY_NAME 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c uname -a 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cat /etc/os-release | grep PRETTY_NAME 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c uname -a 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cat /etc/os-release | grep PRETTY_NAME 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c uname -a 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/448-0-0x00007FF7A5540000-0x00007FF7A56AE000-memory.dmp

Download