ae91a65dcdbd009d1760a385c553fcc0d51ba1027afd4697304416bd19370dd3

Analysis

max time kernel
28s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lol_obf.bat
Size 293KB
Sample260818-e9l6caej9s
SHA256 ae91a65dcdbd009d1760a385c553fcc0d51ba1027afd4697304416bd19370dd3
MD5 13bec15934473c8aa5662235a3e594be
SHA1 581d9a6380cd2a88e94363d18e31efacccbf69c2
SHA512 80afcdf83691526c31b31aae0e25e03e85773200f675dcf52785df1bd46cc8d865121ee7d3c5bee5ed89010baa181fe90c62e545df0ab79e42a94842b4ddaff7
SSDEEP 6144:a4C+WeY6ujMv8BBqxu2r1jh+JYeKrBkFfAlg:++WeY321kJqg
TLSH
T16754D112861D4D3F63E863AE14A91F5E6AC84CC400722FD8D5785F8B778E9132BBE19D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1680	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 4040	1680	cmd.exe	82
PID 1680 wrote to memory of 1804	1680	cmd.exe	83
PID 1680 wrote to memory of 4716	1680	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lol_obf.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\AppData\Local\Temp\lol_obf.bat"
  2⤵
  PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo \\DADDYSERVER "
  2⤵
  PID:1804
- C:\Windows\system32\findstr.exe
  findstr /i "DADDYSERVER"
  2⤵
  PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kdotjwPFxO.bat

Path C:\Users\Admin\AppData\Local\Temp\kdotjwPFxO.bat
Size 174B
SHA256 c3f38935c11c9b44cfe3fdac2ab04ebcd241b8239542530fc03b6816cc84548d
MD5 246d65f15b9fd8a13d09e378888149e2
SHA1 8eaa188ee8c5ea61f874321d5d5cf59f2ba119d9
SHA512 49892bc77cf7de46cfab2fd7e902b52e38877db9e113a38e43b7b662399dd5ba734d6e45c707724eaaa21d9b9c2c3f62c7834b0de7394e6d501b400e36d71495
TLSH
T12DC080531457931FC417571754D540CFE27CC4C35F653640915954F5176359CEDD3385
MD5 SHA1 SHA512 TLSH

Submit Download