8e806cde83a61f277692cefa70ad5cb8d8fec9527015f12ba3a1d2034a23ce40

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vendor/bin/carbon.bat
Size 118B
Sample260819-ph86xaar3w
SHA256 8e806cde83a61f277692cefa70ad5cb8d8fec9527015f12ba3a1d2034a23ce40
MD5 7137a321a173632389d254d07b34cf84
SHA1 93bba14835e1dbb5d00529460d176a97e400fbc0
SHA512 b62af10c6c6e0ea894b76ccd3fe518815cca81f5a60c33c786ee9206b142ce096c40354be31175b801e8ba65244bfa25cf91f701782330ddaf7f3f710b408fed
TLSH
T10AB02B58A273B210BC10083C8C4F0047A373D0B10F894A875010C54000043845D0F01C
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6004	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vendor\bin\carbon.bat"
1⤵
- Executes a command shell one-liner
PID:6004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads