97c781dfaa813232a8d13f7dcdfd1490f355ab85823b2cd73b9dd259d3a1ad07

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tracers.bat
Size 902KB
Sample260910-alj9mavvbx
SHA256 97c781dfaa813232a8d13f7dcdfd1490f355ab85823b2cd73b9dd259d3a1ad07
MD5 602ac0bd731b2615933dde1442e96ff7
SHA1 586be9b5bb086aa301eea7df5ee998390756b912
SHA512 d5cee12b3c99cae442808c463636faa0f96cdae24d6caff13fd5e27a40f74ce58cd15f43430d5ebd15d968588d491dee17bb31b3f7c19ed7d55e2882a25d30eb
SSDEEP 3072:kOW9mafKzoz3g8gzRnvplYSc5mzozEzoz6zozn:5ykyuykyn
TLSH
T16E15764027214011D5B2364EE26FBD656F6EF18F71E06BC311EEBB09D89B91CC3652EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4752	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
264	cmd.exe

Kills process with taskkill 40 IoCs

defense_evasion

pid	Process
1848	taskkill.exe
1228	taskkill.exe
5724	taskkill.exe
52	taskkill.exe
5648	taskkill.exe
2248	taskkill.exe
3720	taskkill.exe
3588	taskkill.exe
4504	taskkill.exe
6036	taskkill.exe
1488	taskkill.exe
5796	taskkill.exe
6072	taskkill.exe
1340	taskkill.exe
4200	taskkill.exe
1956	taskkill.exe
5552	taskkill.exe
2944	taskkill.exe
2932	taskkill.exe
2072	taskkill.exe
5316	taskkill.exe
4672	taskkill.exe
2148	taskkill.exe
4780	taskkill.exe
5544	taskkill.exe
4652	taskkill.exe
5904	taskkill.exe
2404	taskkill.exe
4608	taskkill.exe
4336	taskkill.exe
1300	taskkill.exe
2564	taskkill.exe
2176	taskkill.exe
2708	taskkill.exe
3424	taskkill.exe
5840	taskkill.exe
4108	taskkill.exe
3020	taskkill.exe
5900	taskkill.exe
2300	taskkill.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1372	reg.exe
1972	reg.exe
4080	reg.exe
4888	reg.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	taskkill.exe
Token: SeDebugPrivilege	1228	taskkill.exe
Token: SeDebugPrivilege	5796	taskkill.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	2932	taskkill.exe
Token: SeDebugPrivilege	5724	taskkill.exe
Token: SeDebugPrivilege	52	taskkill.exe
Token: SeDebugPrivilege	5544	taskkill.exe
Token: SeDebugPrivilege	5648	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	4504	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	6036	taskkill.exe
Token: SeDebugPrivilege	3424	taskkill.exe
Token: SeDebugPrivilege	2248	taskkill.exe
Token: SeDebugPrivilege	3720	taskkill.exe
Token: SeDebugPrivilege	3588	taskkill.exe
Token: SeDebugPrivilege	6072	taskkill.exe
Token: SeDebugPrivilege	5904	taskkill.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2072	taskkill.exe
Token: SeDebugPrivilege	4608	taskkill.exe
Token: SeDebugPrivilege	2176	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	4780	taskkill.exe
Token: SeDebugPrivilege	5552	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	5316	taskkill.exe
Token: SeDebugPrivilege	1340	taskkill.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	1488	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	5900	taskkill.exe
Token: SeDebugPrivilege	2300	taskkill.exe
Token: SeDebugPrivilege	4336	taskkill.exe
Token: SeDebugPrivilege	1848	taskkill.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 4200	264	cmd.exe	90
PID 264 wrote to memory of 1228	264	cmd.exe	92
PID 264 wrote to memory of 5796	264	cmd.exe	93
PID 264 wrote to memory of 1300	264	cmd.exe	94
PID 264 wrote to memory of 2932	264	cmd.exe	95
PID 264 wrote to memory of 5724	264	cmd.exe	96
PID 264 wrote to memory of 52	264	cmd.exe	97
PID 264 wrote to memory of 5544	264	cmd.exe	98
PID 264 wrote to memory of 5648	264	cmd.exe	99
PID 264 wrote to memory of 4652	264	cmd.exe	100
PID 264 wrote to memory of 4504	264	cmd.exe	101
PID 264 wrote to memory of 1956	264	cmd.exe	102
PID 264 wrote to memory of 6036	264	cmd.exe	103
PID 264 wrote to memory of 3424	264	cmd.exe	104
PID 264 wrote to memory of 2248	264	cmd.exe	105
PID 264 wrote to memory of 3720	264	cmd.exe	106
PID 264 wrote to memory of 3588	264	cmd.exe	107
PID 264 wrote to memory of 6072	264	cmd.exe	108
PID 264 wrote to memory of 5904	264	cmd.exe	109
PID 264 wrote to memory of 5840	264	cmd.exe	110
PID 264 wrote to memory of 2564	264	cmd.exe	111
PID 264 wrote to memory of 2404	264	cmd.exe	112
PID 264 wrote to memory of 2072	264	cmd.exe	113
PID 264 wrote to memory of 4608	264	cmd.exe	114
PID 264 wrote to memory of 2176	264	cmd.exe	115
PID 264 wrote to memory of 4108	264	cmd.exe	116
PID 264 wrote to memory of 2708	264	cmd.exe	117
PID 264 wrote to memory of 4780	264	cmd.exe	118
PID 264 wrote to memory of 5552	264	cmd.exe	119
PID 264 wrote to memory of 3020	264	cmd.exe	120
PID 264 wrote to memory of 5316	264	cmd.exe	121
PID 264 wrote to memory of 1340	264	cmd.exe	122
PID 264 wrote to memory of 4672	264	cmd.exe	123
PID 264 wrote to memory of 2944	264	cmd.exe	124
PID 264 wrote to memory of 1488	264	cmd.exe	125
PID 264 wrote to memory of 2148	264	cmd.exe	126
PID 264 wrote to memory of 5900	264	cmd.exe	127
PID 264 wrote to memory of 2300	264	cmd.exe	128
PID 264 wrote to memory of 4336	264	cmd.exe	129
PID 264 wrote to memory of 1848	264	cmd.exe	130
PID 264 wrote to memory of 4752	264	cmd.exe	131
PID 264 wrote to memory of 1372	264	cmd.exe	132
PID 264 wrote to memory of 4080	264	cmd.exe	133
PID 264 wrote to memory of 4888	264	cmd.exe	134
PID 264 wrote to memory of 1972	264	cmd.exe	135
PID 264 wrote to memory of 4636	264	cmd.exe	136
PID 264 wrote to memory of 3620	264	cmd.exe	137
PID 264 wrote to memory of 5968	264	cmd.exe	138
PID 264 wrote to memory of 3092	264	cmd.exe	139
PID 264 wrote to memory of 3488	264	cmd.exe	140
PID 264 wrote to memory of 5324	264	cmd.exe	141

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Tracers.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1228
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5796
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5724
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CEFProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:52
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5648
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4652
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im smartscreen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\system32\taskkill.exe
  taskkill /f /im smartscreen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\system32\taskkill.exe
  taskkill /f /im DNF.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3720
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CrossProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TenSafe_1.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5904
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tensafe_2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5840
- C:\Windows\system32\taskkill.exe
  taskkill /f /im tencentdl.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TenioDL.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\system32\taskkill.exe
  taskkill /f /im uishell.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BackgroundDownloader.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\system32\taskkill.exe
  taskkill /f /im conime.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\system32\taskkill.exe
  taskkill /f /im QQDL.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\system32\taskkill.exe
  taskkill /f /im qqlogin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchina.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnfchinatest.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im dnf.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im txplatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5316
- C:\Windows\system32\taskkill.exe
  taskkill /f /im TXPlatform.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1340
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginWebHelperService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Origin.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginClientService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginER.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginThinSetupInternal.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5900
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OriginLegacyCLI.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Agent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Client.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- C:\Windows\system32\sc.exe
  Sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:4752
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {11586-9101-8533-29811} /f
  2⤵
  - Modifies registry key
  PID:1372
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {2665-31878-9309-9153} /f
  2⤵
  - Modifies registry key
  PID:4080
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 11407-31269-8849-23092 /f
  2⤵
  - Modifies registry key
  PID:4888
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 13131-12273-19051-4395 /f
  2⤵
  - Modifies registry key
  PID:1972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /f
  2⤵
  PID:3620
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EpicGames" /f
  2⤵
  PID:5968
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /f
  2⤵
  PID:3092
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher" /f
  2⤵
  PID:3488
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
  2⤵
  PID:5324