5528a1993700cd0f4c9abcf037fc3b266c2a23736d106fc1b3c0f24dc015b4cb

Analysis

user interaction
yes
max time kernel
61s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/08/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deneme_patched.exe
Size 406KB
Sample260818-w49g5aybmd
SHA256 5528a1993700cd0f4c9abcf037fc3b266c2a23736d106fc1b3c0f24dc015b4cb
MD5 8a21cf40c38cacef93d749c4a9f7e451
SHA1 5b2f02f7f6835d8d738e5fd8d6743226f198eaf7
SHA512 da38b948ac11ef05ff4d31c23a030526a11225c01c160851ed5606c0c6fb6c85f206ed4223b3cc05615559618f6b6e99764ce6b478846b2907f171c6ecbc26c1
SSDEEP 6144:wRQKKINU4QtYSPRFB/+B4yZsiibkOgZYWbTijMEEWJPmkT+a:xQ0/bYDZVqkYaT0MZkT
TLSH
T1B5946D2AE69514F9E167D138CD564902EB727C4A03E1E6CF039859A51F337E0AE3EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5456	cmd.exe
4268	cmd.exe
928	cmd.exe
6028	cmd.exe
6072	cmd.exe
4496	cmd.exe
2052	cmd.exe
4500	cmd.exe
3556	cmd.exe
5160	cmd.exe
4488	cmd.exe
5684	cmd.exe
2364	cmd.exe
5720	cmd.exe
3544	cmd.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2052	1064	deneme_patched.exe	81
PID 1064 wrote to memory of 4488	1064	deneme_patched.exe	82
PID 4488 wrote to memory of 4892	4488	cmd.exe	83
PID 1064 wrote to memory of 5456	1064	deneme_patched.exe	84
PID 1064 wrote to memory of 4268	1064	deneme_patched.exe	85
PID 4268 wrote to memory of 5344	4268	cmd.exe	86
PID 1064 wrote to memory of 4500	1064	deneme_patched.exe	87
PID 1064 wrote to memory of 3556	1064	deneme_patched.exe	88
PID 3556 wrote to memory of 4604	3556	cmd.exe	89
PID 1064 wrote to memory of 5684	1064	deneme_patched.exe	90
PID 1064 wrote to memory of 2364	1064	deneme_patched.exe	91
PID 2364 wrote to memory of 112	2364	cmd.exe	92
PID 1064 wrote to memory of 5160	1064	deneme_patched.exe	93
PID 1064 wrote to memory of 5720	1064	deneme_patched.exe	94
PID 5720 wrote to memory of 4348	5720	cmd.exe	95
PID 1064 wrote to memory of 928	1064	deneme_patched.exe	96
PID 1064 wrote to memory of 6028	1064	deneme_patched.exe	97
PID 6028 wrote to memory of 4636	6028	cmd.exe	98
PID 1064 wrote to memory of 3544	1064	deneme_patched.exe	99
PID 1064 wrote to memory of 6072	1064	deneme_patched.exe	100
PID 6072 wrote to memory of 5848	6072	cmd.exe	101
PID 1064 wrote to memory of 4496	1064	deneme_patched.exe	102
PID 4496 wrote to memory of 2936	4496	cmd.exe	103
PID 1064 wrote to memory of 2052	1064	deneme_patched.exe	81
PID 1064 wrote to memory of 4488	1064	deneme_patched.exe	82
PID 4488 wrote to memory of 4892	4488	cmd.exe	83
PID 1064 wrote to memory of 5456	1064	deneme_patched.exe	84
PID 1064 wrote to memory of 4268	1064	deneme_patched.exe	85
PID 4268 wrote to memory of 5344	4268	cmd.exe	86
PID 1064 wrote to memory of 4500	1064	deneme_patched.exe	87
PID 1064 wrote to memory of 3556	1064	deneme_patched.exe	88
PID 3556 wrote to memory of 4604	3556	cmd.exe	89
PID 1064 wrote to memory of 5684	1064	deneme_patched.exe	90
PID 1064 wrote to memory of 2364	1064	deneme_patched.exe	91
PID 2364 wrote to memory of 112	2364	cmd.exe	92
PID 1064 wrote to memory of 5160	1064	deneme_patched.exe	93
PID 1064 wrote to memory of 5720	1064	deneme_patched.exe	94
PID 5720 wrote to memory of 4348	5720	cmd.exe	95
PID 1064 wrote to memory of 928	1064	deneme_patched.exe	96
PID 1064 wrote to memory of 6028	1064	deneme_patched.exe	97
PID 6028 wrote to memory of 4636	6028	cmd.exe	98
PID 1064 wrote to memory of 3544	1064	deneme_patched.exe	99
PID 1064 wrote to memory of 6072	1064	deneme_patched.exe	100
PID 6072 wrote to memory of 5848	6072	cmd.exe	101
PID 1064 wrote to memory of 4496	1064	deneme_patched.exe	102
PID 4496 wrote to memory of 2936	4496	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\deneme_patched.exe
"C:\Users\Admin\AppData\Local\Temp\deneme_patched.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=120 lines=50
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\mode.com
    mode con: cols=120 lines=50
    3⤵
    PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=120 lines=50
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\system32\mode.com
    mode con: cols=120 lines=50
    3⤵
    PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=120 lines=50
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\mode.com
    mode con: cols=120 lines=50
    3⤵
    PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=120 lines=50
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\system32\mode.com
    mode con: cols=120 lines=50
    3⤵
    PID:112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=120 lines=50
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\system32\mode.com
    mode con: cols=120 lines=50
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=120 lines=50
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\system32\mode.com
    mode con: cols=120 lines=50
    3⤵
    PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=120 lines=50
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Windows\system32\mode.com
    mode con: cols=120 lines=50
    3⤵
    PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface set interface "Ethernet" admin=disable >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\netsh.exe
    netsh interface set interface "Ethernet" admin=disable
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads