385f0a7113f2faa0018cecd163cf859f6752055dd46c12f06138059a6da89f0c

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clean.bat
Size 11KB
Sample260909-p5d92seq51
SHA256 385f0a7113f2faa0018cecd163cf859f6752055dd46c12f06138059a6da89f0c
MD5 edae7c705f78cb947fce468c9de618bb
SHA1 269ccc96c180c48df8d660b1a3ca731f9a8481af
SHA512 eac51cb7f5c728dbad7193786107646ab9e5585f49090cbe98cfd3ab8c112702ebf4325bbb1ffc5d2581f022bd2bdbaf4ef4049c55a831bdc2e368fe4b177446
SSDEEP 192:yK7f1OYSitcCZUt9mmNUH+SQHtVb9Q2Ze/gjcrxuxoUT7bkjkZcPoaQrwSqtyU6A:ykOYSScCZUt9mmNUeSQNVb9Q2Ze/gjcL
TLSH
T13F32C9573E485E2B419861E5B6EB84022FD9818F01037FD691E395E9A027BF48377BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5256	tasklist.exe
4996	tasklist.exe
2420	tasklist.exe
4280	tasklist.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4600	sc.exe
968	sc.exe
5044	sc.exe
5936	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3156	cmd.exe
4948	cmd.exe
5780	cmd.exe
3580	cmd.exe
1548	cmd.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
488	ipconfig.exe
3952	ipconfig.exe
4648	ipconfig.exe

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
4848	taskkill.exe
2996	taskkill.exe
472	taskkill.exe
5792	taskkill.exe
1720	taskkill.exe
3972	taskkill.exe
4668	taskkill.exe
4484	taskkill.exe
4784	taskkill.exe
936	taskkill.exe
2404	taskkill.exe
5632	taskkill.exe
5104	taskkill.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4668	taskkill.exe
Token: SeDebugPrivilege	4484	taskkill.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2996	taskkill.exe
Token: SeDebugPrivilege	472	taskkill.exe
Token: SeDebugPrivilege	5632	taskkill.exe
Token: SeDebugPrivilege	5792	taskkill.exe
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	5256	tasklist.exe
Token: SeDebugPrivilege	5104	taskkill.exe
Token: SeDebugPrivilege	4996	tasklist.exe
Token: SeDebugPrivilege	2420	tasklist.exe
Token: SeDebugPrivilege	4848	taskkill.exe
Token: SeDebugPrivilege	4280	tasklist.exe
Token: SeDebugPrivilege	3972	taskkill.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4276	3156	cmd.exe	90
PID 3156 wrote to memory of 4856	3156	cmd.exe	91
PID 3156 wrote to memory of 2728	3156	cmd.exe	92
PID 3156 wrote to memory of 5172	3156	cmd.exe	93
PID 3156 wrote to memory of 5464	3156	cmd.exe	94
PID 3156 wrote to memory of 2960	3156	cmd.exe	95
PID 3156 wrote to memory of 1320	3156	cmd.exe	96
PID 3156 wrote to memory of 3752	3156	cmd.exe	97
PID 3156 wrote to memory of 2500	3156	cmd.exe	98
PID 3156 wrote to memory of 6036	3156	cmd.exe	99
PID 3156 wrote to memory of 2096	3156	cmd.exe	100
PID 3156 wrote to memory of 3252	3156	cmd.exe	101
PID 3156 wrote to memory of 3016	3156	cmd.exe	102
PID 3156 wrote to memory of 4604	3156	cmd.exe	103
PID 3156 wrote to memory of 3120	3156	cmd.exe	104
PID 3156 wrote to memory of 1884	3156	cmd.exe	105
PID 3156 wrote to memory of 4600	3156	cmd.exe	106
PID 3156 wrote to memory of 968	3156	cmd.exe	107
PID 3156 wrote to memory of 5044	3156	cmd.exe	108
PID 3156 wrote to memory of 5936	3156	cmd.exe	109
PID 3156 wrote to memory of 3952	3156	cmd.exe	110
PID 3156 wrote to memory of 4648	3156	cmd.exe	111
PID 3156 wrote to memory of 488	3156	cmd.exe	112
PID 3156 wrote to memory of 5036	3156	cmd.exe	113
PID 3156 wrote to memory of 3284	3156	cmd.exe	114
PID 3156 wrote to memory of 5584	3156	cmd.exe	115
PID 3156 wrote to memory of 5812	3156	cmd.exe	116
PID 3156 wrote to memory of 5652	3156	cmd.exe	117
PID 3156 wrote to memory of 1940	3156	cmd.exe	118
PID 3156 wrote to memory of 4668	3156	cmd.exe	119
PID 3156 wrote to memory of 4484	3156	cmd.exe	121
PID 3156 wrote to memory of 4784	3156	cmd.exe	122
PID 3156 wrote to memory of 936	3156	cmd.exe	123
PID 3156 wrote to memory of 2404	3156	cmd.exe	124
PID 3156 wrote to memory of 2996	3156	cmd.exe	125
PID 3156 wrote to memory of 472	3156	cmd.exe	126
PID 3156 wrote to memory of 5632	3156	cmd.exe	127
PID 3156 wrote to memory of 5792	3156	cmd.exe	128
PID 3156 wrote to memory of 1720	3156	cmd.exe	129
PID 3156 wrote to memory of 4948	3156	cmd.exe	130
PID 4948 wrote to memory of 5256	4948	cmd.exe	131
PID 3156 wrote to memory of 5104	3156	cmd.exe	132
PID 3156 wrote to memory of 5780	3156	cmd.exe	133
PID 5780 wrote to memory of 4996	5780	cmd.exe	134
PID 3156 wrote to memory of 3580	3156	cmd.exe	135
PID 3580 wrote to memory of 2420	3580	cmd.exe	136
PID 3156 wrote to memory of 4848	3156	cmd.exe	137
PID 3156 wrote to memory of 1548	3156	cmd.exe	138
PID 1548 wrote to memory of 4280	1548	cmd.exe	139
PID 3156 wrote to memory of 3972	3156	cmd.exe	140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clean.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4276
- C:\Windows\system32\mode.com
  mode con: cols=70 lines=25
  2⤵
  PID:4856
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\CheatEngine" /f
  2⤵
  PID:2728
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\CheatEngine" /f
  2⤵
  PID:5172
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\FiveM\cheats" /f
  2⤵
  PID:5464
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\FiveM\cheats" /f
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\FiveM\scripts" /f
  2⤵
  PID:1320
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\FiveM\scripts" /f
  2⤵
  PID:3752
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\FiveM\ragemp" /f
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\FiveM\ragemp" /f
  2⤵
  PID:6036
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FiveMCheat" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "FiveMScript" /f
  2⤵
  PID:3252
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "FiveMCheat" /f
  2⤵
  PID:3016
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "FiveMScript" /f
  2⤵
  PID:4604
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "FiveMCheat" /f
  2⤵
  PID:3120
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "FiveMCheat" /f
  2⤵
  PID:1884
- C:\Windows\system32\sc.exe
  sc delete WbioSrvc
  2⤵
  - Launches sc.exe
  PID:4600
- C:\Windows\system32\sc.exe
  sc delete mapsvc
  2⤵
  - Launches sc.exe
  PID:968
- C:\Windows\system32\sc.exe
  sc delete FiveMService
  2⤵
  - Launches sc.exe
  PID:5044
- C:\Windows\system32\sc.exe
  sc delete FXServerService
  2⤵
  - Launches sc.exe
  PID:5936
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:3952
- C:\Windows\system32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:4648
- C:\Windows\system32\ipconfig.exe
  ipconfig /renew
  2⤵
  - Gathers network information
  PID:488
- C:\Windows\system32\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5036
- C:\Windows\system32\netsh.exe
  netsh int ip reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3284
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
  2⤵
  PID:5584
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /f
  2⤵
  PID:5812
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
  2⤵
  PID:5652
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /f
  2⤵
  PID:1940
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "cheatengine*.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "fivem_cheat*.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4484
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "fxserver*.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "fivem.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "RedM.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "FXServer.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "FiveM.Server.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:472
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "lua*.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5632
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "scripthook*.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5792
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "dotnet.exe" /fi "IMAGENAME eq dotnet.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq fivem*" /fo csv 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq fivem*" /fo csv
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5256
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "INFO: No tasks are running which match the specified criteria."
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq fx*" /fo csv 2>nul for %i in ('tasklist /fi "imagename eq fx*" /fo csv 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq fx*" /fo csv for %i in ('tasklist /fi "imagename eq fx*" /fo csv
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq fxserver*" /fo csv 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq fxserver*" /fo csv
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "INFO: No tasks are running which match the specified criteria."
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq redm*" /fo csv 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq redm*" /fo csv
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "INFO: No tasks are running which match the specified criteria."
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3972