ea23973b67ad9aba26c1f31a303fc544cc96840c1286be1d80335b9845e40c4d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
erectile.bat
Size 425B
Sample260822-fmapga1dkd
SHA256 ea23973b67ad9aba26c1f31a303fc544cc96840c1286be1d80335b9845e40c4d
MD5 7c8172fce72ec1fdff0443a91ef6d1dd
SHA1 010dcc5e9e412e76950f3cb84507a387ffd5ef24
SHA512 bac19d4e78cea642a2d3658472ddc02345727b4665eaba1d5106e09b0f09eb98f2df6cc709b7ea7fa0a06ed8981e06c4ded36291caf3867447b3230e34164f23
TLSH
T181E0E5D77461341100CDB893DB40B7027D2850A706932AFD001B0BE4E6D63EAB67E493
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4284	cmd.exe
5100	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2780	4284	cmd.exe	90
PID 4284 wrote to memory of 5100	4284	cmd.exe	91
PID 5100 wrote to memory of 4996	5100	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\erectile.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\system32\netsh.exe
  netsh wlan show networks mode=bssid
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr "SSID" temp_networks.txt
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\findstr.exe
    findstr "SSID" temp_networks.txt
    3⤵
    PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

temp_networks.txt

Path C:\Users\Admin\AppData\Local\Temp\temp_networks.txt
Size 59B
SHA256 6b6dd8b11f84fb78e3e8cfaa7c5fca569d79402b9fc5861b00960b25607c911e
MD5 409930721dbce1ee58227d109cca4570
SHA1 767f86ffec769d8415f07b4372a108cba1bf7221
SHA512 4875187fce9545a92df636e384f92dcb403dfe80f3cad4a68e79329a1f42e12e9d04948f2a52b939638481da6d3e3b5f5096fe6dfd674ee53cca7c655ec03f17
TLSH
T148A0028672E285B501922A03C6D590731F9411FD4065DF2915DC204256C942DAF15C15
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads