b39e218a47f4615cabf4cb9ec996949a4ad6064894f97f4f68b3b2bb2a3fbcb8

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
retrac-fb45af35c9fe9d34.exe
Size 153KB
Sample260822-jbdtjasdka
SHA256 b39e218a47f4615cabf4cb9ec996949a4ad6064894f97f4f68b3b2bb2a3fbcb8
MD5 8ddfaa6b52f773a76067918d01362704
SHA1 ce3c3f408e62889c2172eecc7f91abf881a79657
SHA512 0ada661d0b548b5663e51a0515cebdc3ba25f24b442a28ebc08c034ee4b07904d65e873065be9720587d8627204fb10aa3dff86def48cfe9ee0a8e08e257a2e5
SSDEEP 1536:GvDqmsmsZzDfDp5nTy5EoT2h46/K0HsZek+vC2PG7icS86DoHiVpcI1gqDeEf4Ad:GvYfDp7th46XqOgSPkDBO
TLSH
T150F3F94AEE226AF4C176E17401523113FDB07D1DA3B622FB1BC14BAA1E126D8F739716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4652	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4652	1272	retrac-fb45af35c9fe9d34.exe	91

C:\Users\Admin\AppData\Local\Temp\retrac-fb45af35c9fe9d34.exe
"C:\Users\Admin\AppData\Local\Temp\retrac-fb45af35c9fe9d34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads