0209b18cd8fe768901ec2b7d0b9ca3f934d85d824a1ab8cca4d02d0cf9da6042

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0209b18cd8fe768901ec2b7d0b9ca3f934d85d824a1ab8cca4d02d0cf9da6042.exe
Size 206KB
Sample260825-2m2zlsfj4x
SHA256 0209b18cd8fe768901ec2b7d0b9ca3f934d85d824a1ab8cca4d02d0cf9da6042
MD5 f19b1b37f537347efcc97ebed174a21b
SHA1 2ae269a3bcdcc84a64ad4fb69385d5eec4e33872
SHA512 2e685f3d6fbac3afdbe7be461b87358068e01d1f72a49fc18bc67c157e362b1c6907777e548661f14a4a643ebfb2fca42b4de36ff820736a08d4f37a82ecc30d
SSDEEP 3072:mjK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfOPhBuYHg:mjK4TDUqgpqWDLZ5H+xuZ04QhAR
TLSH
T19D240702F2A810EDD1B7A37C99A20A01F37678164771D7CF33AC866A1FE66D09D7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3912	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 3912	2524	0209b18cd8fe768901ec2b7d0b9ca3f934d85d824a1ab8cca4d02d0cf9da6042.exe	91

C:\Users\Admin\AppData\Local\Temp\0209b18cd8fe768901ec2b7d0b9ca3f934d85d824a1ab8cca4d02d0cf9da6042.exe
"C:\Users\Admin\AppData\Local\Temp\0209b18cd8fe768901ec2b7d0b9ca3f934d85d824a1ab8cca4d02d0cf9da6042.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\0209b18cd8fe768901ec2b7d0b9ca3f934d85d824a1ab8cca4d02d0cf9da6042.bat"
  2⤵
  - Executes a command shell one-liner
  PID:3912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0209b18cd8fe768901ec2b7d0b9ca3f934d85d824a1ab8cca4d02d0cf9da6042.bat

Path C:\Users\Admin\AppData\Local\Temp\0209b18cd8fe768901ec2b7d0b9ca3f934d85d824a1ab8cca4d02d0cf9da6042.bat
Size 64KB
SHA256 ab7f7cb82237f1d629d79576f9375151b9f718f96dd25fcfa403d5a728ea5aab
MD5 2928c63e08042012d3ae2c27414a18f0
SHA1 07fe431882cfe2c801d3cb0ffb0ad30059b92973
SHA512 2e21e0c72158394fffb29ee294a8594e1091e9dd5f83453f5285ad4ba0c31eb60d107f3ac9744fcf80d4b38d478bd4af673557adf2e4abf448c427e02d39f8d1
SSDEEP 96:Ybqj4MPf6g7/EukvM/rNRJK/KemSpHBgNjvZfGOPVt54TUJVJhIVmmx+iVwdXUFB:Ys4M6NuT/roxm2wImthKDk+9FoSJx
TLSH
T13853D860FB01688885A15FBEEF20413468AC15734B95D9163BFF2E2217F92F3647E2D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download