Analysis
- max time kernel
898s - max time network
900s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/08/2026, 11:44
General
- Target crow(Copy 11).bat
- Size 95B
- Sample260816-nv55caam3v
- SHA256 01416853f9ba35a80ea108be16c4633b3ddbb24c3c32b9de44d6298adf0b1711
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\crow(Copy 11).bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unm.exeunm.exe -o stratum.cereblix.com:3333 -u crb1b62acb9189f3103efd537ff23d76046ee480bff9 -threads 82⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unm.exeunm.exe -o stratum.cereblix.com:3333 -u crb1b62acb9189f3103efd537ff23d76046ee480bff9 -threads 83⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl --version >NUL 2>&14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl --version5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -s --max-time 20 "https://github.com/CereblixCRB/cereblix/releases/latest/download/unm.manifest"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -s --max-time 20 "https://github.com/CereblixCRB/cereblix/releases/latest/download/unm.manifest"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -s --max-time 20 "https://cereblix.com/unm.manifest"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -s --max-time 20 "https://cereblix.com/unm.manifest"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/800-0-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-1-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-3-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-5-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-7-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-9-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-11-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-13-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-15-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-17-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-19-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-21-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-23-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-25-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-27-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-29-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-31-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-33-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-35-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-37-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-39-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-41-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-43-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-45-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-47-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-49-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-51-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-53-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-55-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-57-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-59-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-61-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-63-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-65-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-67-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-69-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-71-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-73-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-75-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-77-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-79-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-81-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-83-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-85-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-87-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-89-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-91-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-93-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-95-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-97-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-99-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-101-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-103-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-105-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-107-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-109-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-111-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-113-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-115-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-117-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-119-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-121-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-123-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp
memory/1596-125-0x00007FF628AC0000-0x00007FF628BFF000-memory.dmp