a1bf604a469196eb00394184c01ba2ff64c76f836cc79ee1049a8e9c12b04599

Analysis

max time kernel
30s
max time network
22s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lol_obf.bat
Size 355KB
Sample260818-e7yflaej7y
SHA256 a1bf604a469196eb00394184c01ba2ff64c76f836cc79ee1049a8e9c12b04599
MD5 4c184e67e46a04302441327e51213c7e
SHA1 22ba3be4354f006ac1eb10f014fc46cdcef4eada
SHA512 a998dbf388adafef058682481466f028194917c43ccff189f9534c16993f809b3b47a1e87eddff15b2243e5f49b7f35ebb74522bd0b827dc51b017785074a495
SSDEEP 6144:tBHwAF6dBrtosxmjfZaVXkfOVKTPcFoh8QxRoMzeOAq:vwckLUjf8XXVKTkShXgCQq
TLSH
T11274D122821D4E3F63E463AE58BD1B1E6EC88CC040B61FDCD5785E8B774E9071BA919D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation	cscript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4960	cscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4672	cmd.exe
4256	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4960	4256	cmd.exe	85
PID 4960 wrote to memory of 4672	4960	cscript.exe	86
PID 4672 wrote to memory of 4048	4672	cmd.exe	88
PID 4672 wrote to memory of 3736	4672	cmd.exe	89
PID 4672 wrote to memory of 3456	4672	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lol_obf.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\system32\cscript.exe
  cscript //nologo temp.vbs
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lol_obf.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\system32\findstr.exe
      findstr /i "echo" "C:\Users\Admin\AppData\Local\Temp\lol_obf.bat"
      4⤵
      PID:4048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo \\DADDYSERVER "
      4⤵
      PID:3736
  - - C:\Windows\system32\findstr.exe
      findstr /i "DADDYSERVER"
      4⤵
      PID:3456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kdotRQCClE.bat

Path C:\Users\Admin\AppData\Local\Temp\kdotRQCClE.bat
Size 174B
SHA256 c3f38935c11c9b44cfe3fdac2ab04ebcd241b8239542530fc03b6816cc84548d
MD5 246d65f15b9fd8a13d09e378888149e2
SHA1 8eaa188ee8c5ea61f874321d5d5cf59f2ba119d9
SHA512 49892bc77cf7de46cfab2fd7e902b52e38877db9e113a38e43b7b662399dd5ba734d6e45c707724eaaa21d9b9c2c3f62c7834b0de7394e6d501b400e36d71495
TLSH
T12DC080531457931FC417571754D540CFE27CC4C35F653640915954F5176359CEDD3385
MD5 SHA1 SHA512 TLSH

Submit Download

temp.vbs

Path C:\Users\Admin\AppData\Local\Temp\temp.vbs
Size 95B
SHA256 66b98738db4859fa2013aeca2a0ded5ea729d8ee7c25cb88fb0936526e4c6d21
MD5 23dc64699d2817dd9601a3d86b0f0319
SHA1 5cc81d18a129c23203624887df3147a2a30a1beb
SHA512 c9831e20015bf01ebb3b5472cfaf111e4a9a6a6bc669ac84ca505bfab7ef4e34ea441307a7ba29b8c1902a57d431c272fc8a3a39af11326fd17b8ecb63cea30b
TLSH
T12BB01200EC89CB2B153481460630884CC8608CA83F40BB000350C51C13B1B0C9E4A201
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads