4f5ce73065d63ac57c34c2c24282caeee737b0790036da4dbab19d90c4c379dc

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.bat
Size 1KB
Sample260909-pg3mqswway
SHA256 4f5ce73065d63ac57c34c2c24282caeee737b0790036da4dbab19d90c4c379dc
MD5 84144ad71c8a290c729961d583bae4c1
SHA1 a2f80ffddaba19db51a66dabf48b087278a909b9
SHA512 85b3c40a5f85f91c26b6c6625533d9b60c7fe0646c245e3576a65c75e0affac343b26c9fda7f0799fa010c464a6d92f94d97c7ef42f2bb14d271bb4f0386bd7d
TLSH
T14641255F784EAE2EB96473D091A38919878D53AB1810EBCCF3D8A4833A09303C755E96
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1336	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
4768	rsetup64.exe
2276	raddrvv3.sys
3056	rserver3.exe
832	rsetup64.exe

Loads dropped DLL 2 IoCs

pid	Process
3056	rserver3.exe
3056	rserver3.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rserver30\FamItrfc.Exe	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\WinLpcDl2.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\mirrorv3.inf	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\rsetup64.exe	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\FamItrf2.Exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\rschatx.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\rsl.exe	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\voicex.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\WinLpcDl.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\raddrvv3.sys	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\rminiv3.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\raudiox.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\WinLpcDl2.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\install1.reg	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\Fam64Helper.exe	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\mirrorv3.cat	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\eula.txt	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\FirewallInstallHelper.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\voicex.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\install1.reg	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\install2.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\rsetup64.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\nts64helper.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\mirrorv3.inf	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\FirewallInstallHelper.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\rchatx.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\wsock32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\Fam64Helper.exe	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\mirrorv3.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\Radm_log.htm	rserver3.exe
File created	C:\Windows\SysWOW64\rserver30\FamItrfc.Exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\RCursor.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\vcintcx.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\vcintsx.dll	cmd.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	rsetup64.exe
File created	C:\Windows\SysWOW64\rserver30\2052.lng_rad	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\raudiox.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\install.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\install.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\ChatLPCx.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\rsaudiox.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\rschatx.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\rserver3.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\rsl.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\mirrorv3.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\2052.lng_rad	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\ChatLPCx.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\rchatx.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\rserver3.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\R_sui.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\FamItrf2.Exe	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\RCursor.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\rsaudiox.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\nts64helper.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\mirrorv3.cat	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\vcintsx.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\install2.reg	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\wsock32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\raddrvv3.sys	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\R_sui.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\vcintcx.dll	cmd.exe
File created	C:\Windows\SysWOW64\rserver30\eula.txt	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\WinLpcDl.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rserver30\rminiv3.sys	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2720	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rserver3.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3056	rserver3.exe
3056	rserver3.exe
3056	rserver3.exe
3056	rserver3.exe
3056	rserver3.exe
3056	rserver3.exe
3056	rserver3.exe
3056	rserver3.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
824	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4768	rsetup64.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 5972	4928	cmd.exe	90
PID 5972 wrote to memory of 2936	5972	net.exe	91
PID 4928 wrote to memory of 3348	4928	cmd.exe	92
PID 4928 wrote to memory of 2776	4928	cmd.exe	93
PID 4928 wrote to memory of 1336	4928	cmd.exe	94
PID 4928 wrote to memory of 4768	4928	cmd.exe	95
PID 4928 wrote to memory of 4216	4928	cmd.exe	100
PID 4928 wrote to memory of 2720	4928	cmd.exe	101
PID 4928 wrote to memory of 832	4928	cmd.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.bat"
1⤵
- Drops file in System32 directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver "
  2⤵
  PID:3348
- C:\Windows\system32\findstr.exe
  findstr /R "5\.[0-9]\."
  2⤵
  PID:2776
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=Radmin Server 3 dir=in action=allow program=C:\Windows\SysWOW64\rserver30\rserver3.exe enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1336
- C:\Windows\SysWOW64\rserver30\rsetup64.exe
  "C:\Windows\SysWOW64\rserver30\rsetup64.exe" /intsetup
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Windows\system32\reg.exe
  reg import "C:\Windows\SysWOW64\rserver30\install.reg" /reg:32
  2⤵
  PID:4216
- C:\Windows\system32\sc.exe
  sc failure RServer3 reset= 0 actions= restart/3000/restart/3000/restart/3000
  2⤵
  - Launches sc.exe
  PID:2720
- C:\Windows\SysWOW64\rserver30\rsetup64.exe
  "C:\Windows\SysWOW64\rserver30\rsetup64.exe" /start
  2⤵
  - Executes dropped EXE
  PID:832

C:\Windows\SysWOW64\rserver30\raddrvv3.sys
C:\Windows\SysWOW64\rserver30\raddrvv3.sys
1⤵
- Executes dropped EXE
PID:2276

C:\Windows\SysWOW64\rserver30\rserver3.exe
"C:\Windows\SysWOW64\rserver30\RServer3.exe" /service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

raddrvv3.sys

Path C:\Windows\SysWOW64\rserver30\raddrvv3.sys
Size 93KB
SHA256 bf445dc49cc3be5d0fe8510d716fd540cb3b3c4ab4050c870fc240041c3af990
MD5 caf472668aaa46d7c0954808fa85cf30
SHA1 01ed007aaded5627f2e0b61ce180878bfad364fe
SHA512 3703f6d40a96ed19fcce0bd830f374e3e0af91b87187df520364db36e8630da5e79319a254480a83808fb49c70e3452e6538fd7118da58640cf124de8b811bcc
SSDEEP 1536:24+PRLO7XT1l7yQ3EtmJVFUmPX21V3MZfTzipXipqFzDVzbPKf2PEMYghfMK0W0A:n7XT1l7yQ3EtmJVFUmPX21V3MZfnipY+
TLSH
T100936CD3D1AC90D5DAABD1748AA1D193EAB0BD54176497DF23A48B211EC3BE43E3D308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rserver3.exe

Path C:\Windows\SysWOW64\rserver30\rserver3.exe
Size 1.1MB
SHA256 943b1ed865fcab8264d0e1d722d64e3c993bed5e8351136998003ec9d7020988
MD5 af09f35964779d47dc6624dbf57abaf1
SHA1 a8ab0b90adf02bfc23b5e95303cbba34e284c69c
SHA512 bb4b2bf3a2eb22e0723519cfbc8ad76054ddf0cd48add0ea81ceb557a75b978d6670e55e8e34d2c4fc9c17e0c68a5b3cfc7d5b3da3dca3d511e79a1c60d3083c
SSDEEP 24576:ScTon7IhWcpcpqL+7acPCgtATK55yQSlnaspjwnW:JTRhHmQ6F158XNh
TLSH
T18F4523A017E98693F6B68F306DF5C3761F307D586E39864B3180B56E2D72A608732397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rsetup64.exe

Path C:\Windows\SysWOW64\rserver30\rsetup64.exe
Size 80KB
SHA256 eda3ba7f919d01d5fdbc19cd206a0701e2c7aeaccb323e78f2cea14e288a8a71
MD5 a485f69f331a22a7781dc1371c8b416f
SHA1 b80a69a44cbb20f014aae2bb04561ecdd3e6e8e7
SHA512 702f9ca69c80a450f334be61dc6ace091c668aa96575f51c1aea4b294117d59024d368fa1c1fff4d86d4bce719e820cc8fc36c21542849d2770e9553a4b81d55
SSDEEP 1536:tKlRpMYd8M9hIPN5UxXUu//1mboL8AmGVZUoRghs:tU0YKMHIjUxXUu//1mboLI2ZUoF
TLSH
T1638339D3679440B1E2B7E638D1E59B26DAF2B42003B157CF2A7484261F93BD8A73E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsock32.dll

Path C:\Windows\SysWOW64\rserver30\wsock32.dll
Size 31KB
SHA256 a4c4c0fc6f6c8ea89aa39d6a974ab3009284b6d29db013274828af51b1cdfad8
MD5 8b304eb719e976ea9dd4e1f8367de0b0
SHA1 56452df3e9757d90f7fc83e9bad8efe14767ecca
SHA512 228c3fd4410da7d9075d0f5687bff6d1b29573981d1de623130e9a2e65885a1f43569fd35be4dcad02ddb21a5910737f3b8c8d939553ded8f44d1ae64fb95706
SSDEEP 384:Bi3aNu94p4kfzjrl/sT8PUmN16jfoUx/KULigYBktIFU8xTiUfXDe:M3aawD7fLPw90RCIVxiuXDe
TLSH
T16CE22A07FAD4C5B0E0A1CAFC4C58C76BF36CB5706ABA54A5BAD91FCDF82B1514218B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2276-4-0x0000000000010000-0x0000000000025000-memory.dmp

Download

memory/3056-8-0x0000000000C80000-0x0000000000C8E000-memory.dmp

Download

memory/3056-9-0x0000000001400000-0x00000000016FB000-memory.dmp

Download

memory/3056-15-0x0000000000C80000-0x0000000000C8E000-memory.dmp

Download