e1ef04bcff94fd02a606a6ab267027d4e799f9510b3f8cec32ed8dd32b5a6a88

Analysis

max time kernel
182s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SAK CLEANER/3- Del Logs.bat
Size 892B
Sample260905-cpmv2a11dy
SHA256 e1ef04bcff94fd02a606a6ab267027d4e799f9510b3f8cec32ed8dd32b5a6a88
MD5 1a77a87536950f7b5bce7a7a81a00486
SHA1 dd295dfa0ed012780204c4c3ca24c76ffb180bd8
SHA512 abb0298fd2bd18aaf592751e81cda699078b45f304bb8efa15f845ced8fc12842e307b4e4ac3a041097b8b80970bfc4ffce17e7becb56ba377db665e028a91b0
TLSH
T1DC1190051D898A2233B6D5B0D7122144E66FF347781888B4F1A2A0909DA8284DEFEAE8
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1360	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 3108	1360	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SAK CLEANER\3- Del Logs.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads