90ac1cfa19c74bf6d8ac53807d98d3b5ff7a7fad1e6bc7557d985e8f70475ce9

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dead Bat v1.0.exe
Size 8.6MB
Sample260813-bdgn7sydng
SHA256 90ac1cfa19c74bf6d8ac53807d98d3b5ff7a7fad1e6bc7557d985e8f70475ce9
MD5 d276f19ef15099bda7e3e9ce8d585754
SHA1 a38bfdfd9d11fbef742f1a6336020c0c39821ecc
SHA512 7ea5cabd1a08caf9e34ac7bc2b9459fb58cb2feab6020d93dc2449278a09ac5433bf5914c59255e5b9d29a4b1be00649bd84decdd804a77e29b288c28b1c2597
SSDEEP 196608:Z+QDRhAgKBOXbBgQNFfkclkczUi6CP7oYT:gGBYOrBgQFfpl4i6w
TLSH
T1E4963312F7A6DC90C74661B0A9D38FF2B0603C587420FD6B05E96A6C0B57AF1FA1764B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 10 IoCs

pid	Process
2408	Dead Bat v1.0.exe
2408	Dead Bat v1.0.exe
2408	Dead Bat v1.0.exe
2408	Dead Bat v1.0.exe
2408	Dead Bat v1.0.exe
2408	Dead Bat v1.0.exe
2408	Dead Bat v1.0.exe
2408	Dead Bat v1.0.exe
2408	Dead Bat v1.0.exe
2408	Dead Bat v1.0.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5864	cmd.exe
6072	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5476 wrote to memory of 2408	5476	Dead Bat v1.0.exe	90
PID 2408 wrote to memory of 6072	2408	Dead Bat v1.0.exe	92
PID 2408 wrote to memory of 5864	2408	Dead Bat v1.0.exe	93

C:\Users\Admin\AppData\Local\Temp\Dead Bat v1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Dead Bat v1.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Users\Admin\AppData\Local\Temp\Dead Bat v1.0.exe
  "C:\Users\Admin\AppData\Local\Temp\Dead Bat v1.0.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title SYSTEM32.dll
    3⤵
    - Executes a command shell one-liner
    PID:6072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
Size 30KB
SHA256 dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
MD5 7e871444ca23860a25b888ee263e2eaf
SHA1 aa43c9d3abdb1aabda8379f301f8116d0674b590
SHA512 2e260d3123f7ca612901513b90fe40739e85248da913297d4cca3b2ebd398d9697880d148830e168e474ebfc3d30ede10668c7316ed7668f8b39da7bca59e57d
SSDEEP 384:TRVBP9tKLhuosHfwTgDo90Y5IvQGsHQIYiSy1pCQzpuKAM+o/8E9VF0Ny33H:5FyMHfv2H5IvQGW5YiSyvIKAMxkEtH
TLSH
T108D28F536FA05885D963C972A8A64E26ED31B7568710C2CF3368C15D1F227C27FBA3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
Size 1.1MB
SHA256 64a162d6b11ba10cb11509f3cc445f17beb7acfd064f030b4d59faa1c9894b29
MD5 098cc6ad04199442c3e2a60e1243c2dc
SHA1 4c92c464a8e1e56e1c4d77cd30a0da474a026aaf
SHA512 73c28488b42a0bc2f0d2861fed3f5dcccf8959ce19d3121c13c998db496f2822deb40f36f86240c8d3954fd2dc2ba5d63c8a125b62324dcd92fb6c8ba49ff170
SSDEEP 12288:FrEHdcM6hbaCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcQoC:FrEX/Cjfk7bPNfv42BN6yzUQoC
TLSH
T10F354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dead Bat v1.0.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5476_134310565044131117\Dead Bat v1.0.dll
Size 9.3MB
SHA256 62eccfda673aaf804b410c6e6eb6285a87a23a9e6ad327f54ee08cb9d7ae0cd4
MD5 43f1540e17782bcaa15d5cfcb8858ae1
SHA1 bdcfefe208e0b369063d08f9f813404898effbbb
SHA512 71fd9d2d90638f779d900634826c351c470591a3a5d8f846f63f54173865a2a98db24464279a36f2774919525545dca4a1784440c10bb6496c6cce991f6a7d97
SSDEEP 98304:O/QNRemQznHTZsX4YLrU2Qqpz+jV1TUw4kzdD12Vq17UpJwIX4uzWObPPt17R:OYg1gJkRD1w1
TLSH
T1F5A64A82B6A2D0B7FD95F0F5481A165AF324F4767310EB6330AF80792F079A09E685DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5476_134310565044131117\_ctypes.pyd
Size 122KB
SHA256 8250b4c102abd1dba49fc5b52030caa93ca34e00b86cee6547cc0a7f22326807
MD5 302ddf5f83b5887ab9c4b8cc4e40b7a6
SHA1 0aa06af65d072eb835c8d714d0f0733dc2f47e20
SHA512 5ddc2488fa192d8b662771c698a63faaf109862c8a4dd0df10fb113aef839d012df58346a87178aff9a1b369f82d8ae7819cef4aad542d8bd3f91327feace596
SSDEEP 3072:4LIBXrBDuYifTbergyzjsckxf/EfCODh1NlL5IvLPJjL:XBbBDuBf2HfUxf/EfBDn0
TLSH
T124C36C1B739400A6EBA35179C4B32E17D7B1B41B171093CF12A4C69A2F637A36E7E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5476_134310565044131117\_socket.pyd
Size 81KB
SHA256 ce3090fff8575b21287df5fc69ae98806646fc302eefadf85e369ad3debad92b
MD5 632336eeead53cfad22eb57f795d5657
SHA1 62f5f73d21b86cd3b73b68e5faec032618196745
SHA512 77965b45060545e210cdb044f25e5fd68d6a9150caf1cad7645dbafcf1ce8e1ccbdf8436fbdcbf5f9c293321c8916e114de30ed8897c7db72df7f8d1f98dfb55
SSDEEP 1536:3OYxHEUZql2HLSyypHb9/s+S+pzG8iFWmIHJqKN5IvLw767SyZxqND:+dUZqzyypHb9/sT+pzG8CxIpdN5IvLwD
TLSH
T111835A11A69050F9DB63C0BAC2635E23FBB5B4C013D5939F1166C66A1F33783BE79A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5476_134310565044131117\_wmi.pyd
Size 37KB
SHA256 b0ed1c62b73b291a1b57e3d8882cc269b2fcbb1253f2947da18d9036e0c985d9
MD5 fda7d7aada1d15cab2add2f4bd2e59a1
SHA1 7e61473f2ad5e061ef59105bf4255dbe7db5117a
SHA512 95c2934a75507ea2d8c817da7e76ee7567ec29a52018aef195fac779b7ffb440c27722d162f8e416b6ef5d3fd0936c71a55776233293b3dd0124d51118a2b628
SSDEEP 768:kEkKWSx+lZb+7iNEpPlFIvCiS5YiSyvxPAMxkERJ:kE9W5XyiNEvFIvCiQ7SyJPxj
TLSH
T113037E56E7940854D937CABD88E64E27F9B1B5925B11C3CF3314825D0F32381BA7A3B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5476_134310565044131117\python312.dll
Size 6.6MB
SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
MD5 b243d61f4248909bc721674d70a633de
SHA1 1d2fb44b29c4ac3cfd5a7437038a0c541fce82fc
SHA512 10460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb
SSDEEP 49152:YeceS1L2qpQvgBciWdyVahNTjy8VtvUt1wX/n8gRymPMVTBl2XhXNtMH2lt6cSA/:+RzBHWwuVGij3vwHDMiEHtSzW
TLSH
T1BE666C567358C0A9C96B90B4CC13C68EE7B27C517F60930B70ABB71E2F73792969A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5476_134310565044131117\vcruntime140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2408-47-0x00007FF7F0170000-0x00007FF7F0A39000-memory.dmp

Download

memory/2408-48-0x00007FFA441A0000-0x00007FFA44B0B000-memory.dmp

Download

memory/5476-46-0x00007FF7F0170000-0x00007FF7F0A39000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads