566b3e81db2192b3c028557c5635fa6aeb9d3d9d64eb973b9380419eeb40495a

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:13

Target
5953.bat
Size 182B
Sample260830-142jqstsay
SHA256 566b3e81db2192b3c028557c5635fa6aeb9d3d9d64eb973b9380419eeb40495a
MD5 dbf43153f3b3823e54ccbdb9e3ad13db
SHA1 20a162d04ff35f30bba499fa70abf7ff27a2ecbf
SHA512 d829b2bb950cb7c065df3a60148938db00467315382b10c28f3e24ea429456a7687a2217bc72b0b764b688ae5204dac8119f555ef930994041c1f3969f344274
TLSH
T1A2C0C0073002866527FE08322FB670C930C70547391B558073A2D408C3320EE08127CA
MD5 SHA1 SHA512 TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
2280	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2380	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3328	2280	cmd.exe	90
PID 2280 wrote to memory of 2380	2280	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5953.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\system32\mshta.exe
  mshta vbscript:createobject("shell.application").shellexecute("","","","runas",1)(window.close)
  2⤵
  PID:3328
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2380