97c781dfaa813232a8d13f7dcdfd1490f355ab85823b2cd73b9dd259d3a1ad07

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tracers.bat
Size 902KB
Sample260910-alj9mavvbx
SHA256 97c781dfaa813232a8d13f7dcdfd1490f355ab85823b2cd73b9dd259d3a1ad07
MD5 602ac0bd731b2615933dde1442e96ff7
SHA1 586be9b5bb086aa301eea7df5ee998390756b912
SHA512 d5cee12b3c99cae442808c463636faa0f96cdae24d6caff13fd5e27a40f74ce58cd15f43430d5ebd15d968588d491dee17bb31b3f7c19ed7d55e2882a25d30eb
SSDEEP 3072:kOW9mafKzoz3g8gzRnvplYSc5mzozEzoz6zozn:5ykyuykyn
TLSH
T16E15764027214011D5B2364EE26FBD656F6EF18F71E06BC311EEBB09D89B91CC3652EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4432	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3212	cmd.exe

Kills process with taskkill 40 IoCs

defense_evasion

pid	Process
4608	taskkill.exe
1192	taskkill.exe
680	taskkill.exe
2856	taskkill.exe
3232	taskkill.exe
5056	taskkill.exe
820	taskkill.exe
3492	taskkill.exe
5004	taskkill.exe
4636	taskkill.exe
748	taskkill.exe
2648	taskkill.exe
1996	taskkill.exe
1892	taskkill.exe
3752	taskkill.exe
3524	taskkill.exe
3288	taskkill.exe
4528	taskkill.exe
4400	taskkill.exe
2292	taskkill.exe
2100	taskkill.exe
2156	taskkill.exe
4412	taskkill.exe
1516	taskkill.exe
3268	taskkill.exe
4428	taskkill.exe
1164	taskkill.exe
2332	taskkill.exe
4672	taskkill.exe
2080	taskkill.exe
2832	taskkill.exe
2996	taskkill.exe
2316	taskkill.exe
4764	taskkill.exe
4016	taskkill.exe
4628	taskkill.exe
4128	taskkill.exe
1808	taskkill.exe
2948	taskkill.exe
2932	taskkill.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3932	reg.exe
888	reg.exe
1628	reg.exe
4484	reg.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	2996	taskkill.exe
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeDebugPrivilege	4608	taskkill.exe
Token: SeDebugPrivilege	3752	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	3524	taskkill.exe
Token: SeDebugPrivilege	4428	taskkill.exe
Token: SeDebugPrivilege	2932	taskkill.exe
Token: SeDebugPrivilege	4764	taskkill.exe
Token: SeDebugPrivilege	1164	taskkill.exe
Token: SeDebugPrivilege	2332	taskkill.exe
Token: SeDebugPrivilege	2156	taskkill.exe
Token: SeDebugPrivilege	4016	taskkill.exe
Token: SeDebugPrivilege	4412	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe
Token: SeDebugPrivilege	4628	taskkill.exe
Token: SeDebugPrivilege	820	taskkill.exe
Token: SeDebugPrivilege	3288	taskkill.exe
Token: SeDebugPrivilege	748	taskkill.exe
Token: SeDebugPrivilege	1192	taskkill.exe
Token: SeDebugPrivilege	680	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	3492	taskkill.exe
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeDebugPrivilege	4400	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	3268	taskkill.exe
Token: SeDebugPrivilege	1996	taskkill.exe
Token: SeDebugPrivilege	2080	taskkill.exe
Token: SeDebugPrivilege	2856	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	3232	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	5004	taskkill.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4636	3212	cmd.exe	85
PID 3212 wrote to memory of 1892	3212	cmd.exe	87
PID 3212 wrote to memory of 2996	3212	cmd.exe	88
PID 3212 wrote to memory of 2100	3212	cmd.exe	89
PID 3212 wrote to memory of 5056	3212	cmd.exe	90
PID 3212 wrote to memory of 4608	3212	cmd.exe	91
PID 3212 wrote to memory of 3752	3212	cmd.exe	92
PID 3212 wrote to memory of 2316	3212	cmd.exe	93
PID 3212 wrote to memory of 3524	3212	cmd.exe	94
PID 3212 wrote to memory of 4428	3212	cmd.exe	95
PID 3212 wrote to memory of 2932	3212	cmd.exe	96
PID 3212 wrote to memory of 4764	3212	cmd.exe	97
PID 3212 wrote to memory of 1164	3212	cmd.exe	98
PID 3212 wrote to memory of 2332	3212	cmd.exe	99
PID 3212 wrote to memory of 2156	3212	cmd.exe	100
PID 3212 wrote to memory of 4016	3212	cmd.exe	101
PID 3212 wrote to memory of 4412	3212	cmd.exe	102
PID 3212 wrote to memory of 1516	3212	cmd.exe	103
PID 3212 wrote to memory of 4628	3212	cmd.exe	104
PID 3212 wrote to memory of 820	3212	cmd.exe	105
PID 3212 wrote to memory of 3288	3212	cmd.exe	106
PID 3212 wrote to memory of 748	3212	cmd.exe	107
PID 3212 wrote to memory of 1192	3212	cmd.exe	108
PID 3212 wrote to memory of 680	3212	cmd.exe	109
PID 3212 wrote to memory of 4128	3212	cmd.exe	110
PID 3212 wrote to memory of 3492	3212	cmd.exe	111
PID 3212 wrote to memory of 4528	3212	cmd.exe	112
PID 3212 wrote to memory of 4400	3212	cmd.exe	113
PID 3212 wrote to memory of 2648	3212	cmd.exe	114
PID 3212 wrote to memory of 4672	3212	cmd.exe	115
PID 3212 wrote to memory of 3268	3212	cmd.exe	116
PID 3212 wrote to memory of 1996	3212	cmd.exe	117
PID 3212 wrote to memory of 2080	3212	cmd.exe	118
PID 3212 wrote to memory of 2856	3212	cmd.exe	119
PID 3212 wrote to memory of 1808	3212	cmd.exe	120
PID 3212 wrote to memory of 2292	3212	cmd.exe	121
PID 3212 wrote to memory of 2948	3212	cmd.exe	122
PID 3212 wrote to memory of 3232	3212	cmd.exe	123
PID 3212 wrote to memory of 2832	3212	cmd.exe	124
PID 3212 wrote to memory of 5004	3212	cmd.exe	125
PID 3212 wrote to memory of 4432	3212	cmd.exe	126
PID 3212 wrote to memory of 4484	3212	cmd.exe	127
PID 3212 wrote to memory of 1628	3212	cmd.exe	128
PID 3212 wrote to memory of 888	3212	cmd.exe	129
PID 3212 wrote to memory of 3932	3212	cmd.exe	130
PID 3212 wrote to memory of 3600	3212	cmd.exe	131
PID 3212 wrote to memory of 4788	3212	cmd.exe	132
PID 3212 wrote to memory of 4348	3212	cmd.exe	133
PID 3212 wrote to memory of 1344	3212	cmd.exe	134
PID 3212 wrote to memory of 4532	3212	cmd.exe	135
PID 3212 wrote to memory of 4296	3212	cmd.exe	136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Tracers.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CEFProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3752
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\system32\taskkill.exe
  taskkill /f /im smartscreen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im smartscreen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\system32\taskkill.exe
  taskkill /f /im DNF.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4016
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CrossProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TenSafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:820
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tencentdl.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TenioDL.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:748
- C:\Windows\system32\taskkill.exe
  taskkill /f /im uishell.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1192
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BackgroundDownloader.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:680
- C:\Windows\system32\taskkill.exe
  taskkill /f /im conime.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Windows\system32\taskkill.exe
  taskkill /f /im QQDL.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\system32\taskkill.exe
  taskkill /f /im qqlogin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchina.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchinatest.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\system32\taskkill.exe
  taskkill /f /im txplatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TXPlatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginWebHelperService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Origin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginClientService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginER.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginThinSetupInternal.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginLegacyCLI.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3232
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Agent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Client.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\system32\sc.exe
  Sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:4432
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {11583-31121-23437-5747} /f
  2⤵
  - Modifies registry key
  PID:4484
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {25119-27952-6196-12080} /f
  2⤵
  - Modifies registry key
  PID:1628
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 27663-4649-8996-23048 /f
  2⤵
  - Modifies registry key
  PID:888
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 23761-28495-29627-19824 /f
  2⤵
  - Modifies registry key
  PID:3932
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
  2⤵
  PID:3600
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /f
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EpicGames" /f
  2⤵
  PID:4348
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /f
  2⤵
  PID:1344
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher" /f
  2⤵
  PID:4532
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
  2⤵
  PID:4296