Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 12:53
General
- Target f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe
- Size 1.9MB
- Sample260820-p4pdmaxdrh
- SHA256 f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 49 IoCs
- Enumerates connected drives 3 TTPs 63 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 55 IoCs
- Executes a command shell one-liner 1 TTPs 46 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3389.bat2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3697.bat4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39B4.bat6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D9C.bat8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4201.bat10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43F5.bat12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45F8.bat14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66AF.bat16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67F7.bat18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6901.bat20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DB4.bat22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EAE.bat24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a713E.bat26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7277.bat28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74C9.bat30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a764F.bat32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7778.bat34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78D0.bat36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C3B.bat38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a811D.bat40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a837E.bat42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8469.bat44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8534.bat46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a860E.bat48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86CA.bat50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87B4.bat52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a890C.bat54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A45.bat56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"57⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B10.bat58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BFA.bat60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CB6.bat62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"63⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DB0.bat64⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E4C.bat66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"67⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF8.bat68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FD2.bat70⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a908E.bat72⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a913A.bat74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91C6.bat76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"77⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9292.bat78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"79⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a933D.bat80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93F9.bat82⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"83⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94B4.bat84⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9551.bat86⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a960C.bat88⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96C8.bat90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97B2.bat92⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"C:\Users\Admin\AppData\Local\Temp\f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe"93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe40⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"41⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"42⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe28⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"29⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"30⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 76829⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 99229⤵
- Program crash
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2692 -ip 26921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2692 -ip 26921⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
$$a3389.bat
$$a3697.bat
$$a39B4.bat
$$a3D9C.bat
$$a4201.bat
$$a43F5.bat
$$a45F8.bat
$$a66AF.bat
$$a67F7.bat
$$a6901.bat
$$a6DB4.bat
$$a6EAE.bat
$$a713E.bat
$$a7277.bat
$$a74C9.bat
$$a764F.bat
$$a7778.bat
$$a78D0.bat
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
f58e5cce73eecc7f39f9b16691340ba1e1af24511190de1e84986c542ee57ee8.exe.exe
Dll.dll
Logo1_.exe
_desktop.ini
memory/108-6132-0x0000000000400000-0x0000000000445000-memory.dmp
memory/576-6249-0x0000000000400000-0x0000000000445000-memory.dmp
memory/708-6074-0x0000000000400000-0x0000000000445000-memory.dmp
memory/828-34-0x0000000000400000-0x0000000000445000-memory.dmp
memory/880-6127-0x0000000000400000-0x0000000000445000-memory.dmp
memory/920-6214-0x0000000000400000-0x0000000000445000-memory.dmp
memory/948-6063-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1488-19-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1488-24-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1528-6224-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2176-6194-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2232-6256-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2232-6257-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2232-6169-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2236-6229-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2376-6049-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2520-6239-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2692-6112-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2880-6121-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2908-5546-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2960-6199-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3140-5562-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3620-6174-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3748-6147-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3764-6039-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3776-6179-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3780-6137-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3788-6092-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3824-6163-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3940-6184-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4116-6142-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4180-13-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4180-0-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4228-6100-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4276-6158-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4308-10-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4308-6044-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4308-1133-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4308-3537-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4356-5554-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4384-6255-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4384-6250-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4596-71-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4616-6189-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4672-49-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4780-6110-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4804-6219-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4948-6082-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5080-6204-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5464-6244-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5512-6209-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5692-6234-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5856-6153-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5860-6168-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5884-6031-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5972-61-0x0000000000400000-0x0000000000445000-memory.dmp
memory/6120-79-0x0000000000400000-0x0000000000445000-memory.dmp