385f0a7113f2faa0018cecd163cf859f6752055dd46c12f06138059a6da89f0c

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clean.bat
Size 11KB
Sample260909-p5d92seq51
SHA256 385f0a7113f2faa0018cecd163cf859f6752055dd46c12f06138059a6da89f0c
MD5 edae7c705f78cb947fce468c9de618bb
SHA1 269ccc96c180c48df8d660b1a3ca731f9a8481af
SHA512 eac51cb7f5c728dbad7193786107646ab9e5585f49090cbe98cfd3ab8c112702ebf4325bbb1ffc5d2581f022bd2bdbaf4ef4049c55a831bdc2e368fe4b177446
SSDEEP 192:yK7f1OYSitcCZUt9mmNUH+SQHtVb9Q2Ze/gjcrxuxoUT7bkjkZcPoaQrwSqtyU6A:ykOYSScCZUt9mmNUeSQNVb9Q2Ze/gjcL
TLSH
T13F32C9573E485E2B419861E5B6EB84022FD9818F01037FD691E395E9A027BF48377BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4796	tasklist.exe
1888	tasklist.exe
1084	tasklist.exe
4616	tasklist.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2392	sc.exe
4380	sc.exe
5116	sc.exe
3396	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5068	cmd.exe
3636	cmd.exe
2796	cmd.exe
3000	cmd.exe
4956	cmd.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3404	ipconfig.exe
2540	ipconfig.exe
1384	ipconfig.exe

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
3748	taskkill.exe
2328	taskkill.exe
2352	taskkill.exe
1216	taskkill.exe
1728	taskkill.exe
2936	taskkill.exe
632	taskkill.exe
4440	taskkill.exe
416	taskkill.exe
1316	taskkill.exe
212	taskkill.exe
3272	taskkill.exe
3704	taskkill.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	2936	taskkill.exe
Token: SeDebugPrivilege	632	taskkill.exe
Token: SeDebugPrivilege	1316	taskkill.exe
Token: SeDebugPrivilege	4440	taskkill.exe
Token: SeDebugPrivilege	416	taskkill.exe
Token: SeDebugPrivilege	212	taskkill.exe
Token: SeDebugPrivilege	3272	taskkill.exe
Token: SeDebugPrivilege	4796	tasklist.exe
Token: SeDebugPrivilege	3704	taskkill.exe
Token: SeDebugPrivilege	1888	tasklist.exe
Token: SeDebugPrivilege	1084	tasklist.exe
Token: SeDebugPrivilege	3748	taskkill.exe
Token: SeDebugPrivilege	4616	tasklist.exe
Token: SeDebugPrivilege	2328	taskkill.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 1784	3636	cmd.exe	86
PID 3636 wrote to memory of 1588	3636	cmd.exe	87
PID 3636 wrote to memory of 4232	3636	cmd.exe	88
PID 3636 wrote to memory of 4412	3636	cmd.exe	89
PID 3636 wrote to memory of 4132	3636	cmd.exe	90
PID 3636 wrote to memory of 3908	3636	cmd.exe	91
PID 3636 wrote to memory of 2104	3636	cmd.exe	92
PID 3636 wrote to memory of 4000	3636	cmd.exe	93
PID 3636 wrote to memory of 1628	3636	cmd.exe	94
PID 3636 wrote to memory of 4144	3636	cmd.exe	95
PID 3636 wrote to memory of 4624	3636	cmd.exe	96
PID 3636 wrote to memory of 1624	3636	cmd.exe	97
PID 3636 wrote to memory of 4080	3636	cmd.exe	98
PID 3636 wrote to memory of 1672	3636	cmd.exe	99
PID 3636 wrote to memory of 640	3636	cmd.exe	100
PID 3636 wrote to memory of 5092	3636	cmd.exe	101
PID 3636 wrote to memory of 4380	3636	cmd.exe	102
PID 3636 wrote to memory of 5116	3636	cmd.exe	103
PID 3636 wrote to memory of 3396	3636	cmd.exe	104
PID 3636 wrote to memory of 2392	3636	cmd.exe	105
PID 3636 wrote to memory of 2540	3636	cmd.exe	106
PID 3636 wrote to memory of 1384	3636	cmd.exe	107
PID 3636 wrote to memory of 3404	3636	cmd.exe	108
PID 3636 wrote to memory of 4100	3636	cmd.exe	109
PID 3636 wrote to memory of 2364	3636	cmd.exe	111
PID 3636 wrote to memory of 3016	3636	cmd.exe	112
PID 3636 wrote to memory of 4884	3636	cmd.exe	113
PID 3636 wrote to memory of 760	3636	cmd.exe	114
PID 3636 wrote to memory of 4176	3636	cmd.exe	115
PID 3636 wrote to memory of 2352	3636	cmd.exe	116
PID 3636 wrote to memory of 1216	3636	cmd.exe	118
PID 3636 wrote to memory of 1728	3636	cmd.exe	119
PID 3636 wrote to memory of 2936	3636	cmd.exe	120
PID 3636 wrote to memory of 632	3636	cmd.exe	121
PID 3636 wrote to memory of 1316	3636	cmd.exe	122
PID 3636 wrote to memory of 4440	3636	cmd.exe	123
PID 3636 wrote to memory of 416	3636	cmd.exe	124
PID 3636 wrote to memory of 212	3636	cmd.exe	125
PID 3636 wrote to memory of 3272	3636	cmd.exe	126
PID 3636 wrote to memory of 2796	3636	cmd.exe	127
PID 2796 wrote to memory of 4796	2796	cmd.exe	128
PID 3636 wrote to memory of 3704	3636	cmd.exe	129
PID 3636 wrote to memory of 3000	3636	cmd.exe	130
PID 3000 wrote to memory of 1888	3000	cmd.exe	131
PID 3636 wrote to memory of 4956	3636	cmd.exe	132
PID 4956 wrote to memory of 1084	4956	cmd.exe	133
PID 3636 wrote to memory of 3748	3636	cmd.exe	134
PID 3636 wrote to memory of 5068	3636	cmd.exe	135
PID 5068 wrote to memory of 4616	5068	cmd.exe	136
PID 3636 wrote to memory of 2328	3636	cmd.exe	137

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clean.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1784
- C:\Windows\system32\mode.com
  mode con: cols=70 lines=25
  2⤵
  PID:1588
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\CheatEngine" /f
  2⤵
  PID:4232
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\CheatEngine" /f
  2⤵
  PID:4412
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\FiveM\cheats" /f
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\FiveM\cheats" /f
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\FiveM\scripts" /f
  2⤵
  PID:2104
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\FiveM\scripts" /f
  2⤵
  PID:4000
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\FiveM\ragemp" /f
  2⤵
  PID:1628
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\FiveM\ragemp" /f
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FiveMCheat" /f
  2⤵
  PID:4624
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FiveMScript" /f
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "FiveMCheat" /f
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "FiveMScript" /f
  2⤵
  PID:1672
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "FiveMCheat" /f
  2⤵
  PID:640
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "FiveMCheat" /f
  2⤵
  PID:5092
- C:\Windows\system32\sc.exe
  sc delete WbioSrvc
  2⤵
  - Launches sc.exe
  PID:4380
- C:\Windows\system32\sc.exe
  sc delete mapsvc
  2⤵
  - Launches sc.exe
  PID:5116
- C:\Windows\system32\sc.exe
  sc delete FiveMService
  2⤵
  - Launches sc.exe
  PID:3396
- C:\Windows\system32\sc.exe
  sc delete FXServerService
  2⤵
  - Launches sc.exe
  PID:2392
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:2540
- C:\Windows\system32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:1384
- C:\Windows\system32\ipconfig.exe
  ipconfig /renew
  2⤵
  - Gathers network information
  PID:3404
- C:\Windows\system32\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4100
- C:\Windows\system32\netsh.exe
  netsh int ip reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2364
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
  2⤵
  PID:3016
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /f
  2⤵
  PID:4884
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
  2⤵
  PID:760
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /f
  2⤵
  PID:4176
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "cheatengine*.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "fivem_cheat*.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "fxserver*.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "fivem.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "RedM.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "FXServer.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1316
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "FiveM.Server.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "lua*.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:416
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "scripthook*.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "dotnet.exe" /fi "IMAGENAME eq dotnet.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq fivem*" /fo csv 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq fivem*" /fo csv
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "INFO: No tasks are running which match the specified criteria."
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq fx*" /fo csv 2>nul for %i in ('tasklist /fi "imagename eq fx*" /fo csv 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq fx*" /fo csv for %i in ('tasklist /fi "imagename eq fx*" /fo csv
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq fxserver*" /fo csv 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq fxserver*" /fo csv
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "INFO: No tasks are running which match the specified criteria."
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq redm*" /fo csv 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq redm*" /fo csv
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "INFO: No tasks are running which match the specified criteria."
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2328