dc0fa671305111ea6aaffe515bb05964c0a9a7d6ce6258d52ba5df11bd14d63b

Analysis

user interaction
yes
max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
login.bat
Size 587B
Sample260910-shaj5adk7s
SHA256 dc0fa671305111ea6aaffe515bb05964c0a9a7d6ce6258d52ba5df11bd14d63b
MD5 8cb50059beb8a800eab5cb2f222a0228
SHA1 0fd4caec3ca2c0a2c799245e835194ce45d2232a
SHA512 84896e2ac4c72d812b1b9a312a21701670937707261a5bf5643c866a2cb4cd0d9d0726f5ea2410349422690516630a7081626ae8b72b892237b1d44cd5c21262
TLSH
T13FF09ABA7016040B16733EFA2D3B61EF750C448B9A0D9FA0B1EF70A9936B68D605A514
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2560	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1780	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 3988	2560	cmd.exe	81
PID 2560 wrote to memory of 1780	2560	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\login.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3988
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads