Analysis

  • max time kernel
    148s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/09/2026, 18:15

General

  • Target
    indexer_8bd4.cmd
  • Size 1KB
  • Sample260919-wwbwwsek21
  • SHA256 26f6531a66629514f7df0bfa2dbc4fd4634cd97640a5ea48c404631f0d6bd5a6
  • MD5 SHA1 SHA512 TLSH

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\indexer_8bd4.cmd"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Windows\system32\chcp.com
      chcp 65001
      2⤵
        PID:5588
      • C:\Windows\system32\where.exe
        where conhost.exe
        2⤵
          PID:2364
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3412
          • C:\Windows\system32\reg.exe
            reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
            3⤵
              PID:2432
            • C:\Windows\system32\find.exe
              find "CurrentBuildNumber"
              3⤵
                PID:4204
            • C:\Windows\System32\conhost.exe
              "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\indexer_8bd4.cmd" /launched
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4632
              • C:\Windows\System32\cmd.exe
                cmd.exe /c C:\Users\Admin\AppData\Local\Temp\indexer_8bd4.cmd /launched
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:2324
                • C:\Windows\system32\chcp.com
                  chcp 65001
                  4⤵
                    PID:2488
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\InsuranceVerifier.csproj" /nologo /v:q /nodereuse:false /noconlog
                    4⤵
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of AdjustPrivilegeToken
                    PID:544
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe
              1⤵
                PID:2588

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    d37abbff-c6f4-4649-a5c0-316a3171c8d3.tmp

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\InsuranceVerifier\d37abbff-c6f4-4649-a5c0-316a3171c8d3.tmp
                    • Size 10KB
                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .03f0kteq.nwc

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.03f0kteq.nwc
                    • Size 441KB
                    • SHA256 59ebea76656420684ec65477e61611c7a1da3664487c9a3ef1a528106482233d
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .1rx2in24.eyi

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.1rx2in24.eyi
                    • Size 470KB
                    • SHA256 80fb9b2e24c019cf46e85e6b9f56c6de352e2dca48aaed4215e0951cf1eadfb4
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .2le1yloy.24j

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.2le1yloy.24j
                    • Size 95KB
                    • SHA256 cc9be485cbffb197d3431879661c584be7ccbeaa3446f4f57fff17566ab387b4
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .2nqlqgsl.be1

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.2nqlqgsl.be1
                    • Size 908KB
                    • SHA256 676bd9aefa00c67e75e052ea68b6922ee124c7891c89439c7bcdf39c0d7c1b96
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .2y5rcb4m.cw1

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.2y5rcb4m.cw1
                    • Size 849KB
                    • SHA256 cdc3c63a3389ef6ea099e7d9dfa378fbf715658014f770d998a3387d391652e7
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .4s42a3ih.ygq

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.4s42a3ih.ygq
                    • Size 60KB
                    • SHA256 337f56acf67c6b34c0c7681a36a3fb6cc86e542e5e6c86eff47d89a5df47bc22
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .bdstllv0.noh

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.bdstllv0.noh
                    • Size 120KB
                    • SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .bdu3lke2.gbd

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.bdu3lke2.gbd
                    • Size 105KB
                    • SHA256 4f8df9c30101bf358133e940ca6e87be0be082d41b8150cc14aa1cccc62d1512
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .biowuzjn.dqx

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.biowuzjn.dqx
                    • Size 10KB
                    • SHA256 3ba0b58628c5475542dace03b31c3d5215eb89463683211ba1183da0d344516b
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .c0nty5kv.iay

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.c0nty5kv.iay
                    • Size 413KB
                    • SHA256 7ebd3d6fc7a2edf06257e66d0bc26f2e3311660a653201dcee838cec6e862d6c
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .ciadplww.yxe

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.ciadplww.yxe
                    • Size 11KB
                    • SHA256 5e271e6e3b8c4ee5411615c9b502748bb7c4b20decc636e3502e48168e8452d6
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .cpabu3vr.2yt

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.cpabu3vr.2yt
                    • Size 15KB
                    • SHA256 89bacf25ce42d5a3dd3fd8390d525ca1b3939d4794e5bf51cf59c63102113813
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .cxj3tokw.ibq

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.cxj3tokw.ibq
                    • Size 170KB
                    • SHA256 3844a415c431ec5c7aeaf756b4d9e988ff687bc3819895b22b26c6d285bb96e3
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .dzii0iwb.jnz

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.dzii0iwb.jnz
                    • Size 15KB
                    • SHA256 2fe2963ef9a2696293c7dcb50cb8c8b4c41789b5632eb00358bb42478be78259
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .eb5w4ppx.3qz

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.eb5w4ppx.3qz
                    • Size 847KB
                    • SHA256 68bd1e41be8a5c79e94a457a4e7265f8abcf8542879dd6c5a071b5376c09686c
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .epof0djl.ubw

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.epof0djl.ubw
                    • Size 427KB
                    • SHA256 6b84e7fcb374236ee738e6eac2f8caa00b5523fa9639f2dfaa4a4eb35f8cc40e
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .guwojaew.b2h

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.guwojaew.b2h
                    • Size 11KB
                    • SHA256 5dae4c4ddf752b24c400eb5e0c7b4f7ad77f705b059df3ea8dccd003295ee13b
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .ihpkp2wz.tg3

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.ihpkp2wz.tg3
                    • Size 16KB
                    • SHA256 205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .iis425ga.523

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.iis425ga.523
                    • Size 6KB
                    • SHA256 ca0fcc99f517e2d4d0a2f1bbcd254dc3d369d1d0d06431629cbb8c0827b34371
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .ka0n3zfy.xut

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.ka0n3zfy.xut
                    • Size 13B
                    • SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
                    • MD5 SHA1 SHA512

                    .kvbgkzup.g43

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.kvbgkzup.g43
                    • Size 69B
                    • SHA256 ae14c4598112dcb9731e9afae5ca62036e42b80dc3b1db703ad41d4e3300253a
                    • MD5 SHA1 SHA512 TLSH

                    .leeprqod.enk

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.leeprqod.enk
                    • Size 1KB
                    • SHA256 26f6531a66629514f7df0bfa2dbc4fd4634cd97640a5ea48c404631f0d6bd5a6
                    • MD5 SHA1 SHA512 TLSH

                    .lsroq3bg.v0d

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.lsroq3bg.v0d
                    • Size 551KB
                    • SHA256 37360118d8f090f6cd51b9606239f36801307c3638af1495045a38db087f7210
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .lsrwbx1e.c0b

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.lsrwbx1e.c0b
                    • Size 1KB
                    • SHA256 2c97eb93c7eca22225b74187c22e31b0656dcccb2a786f98bb25faf8308ebf87
                    • MD5 SHA1 SHA512 TLSH

                    .nrjqhndy.p4e

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.nrjqhndy.p4e
                    • Size 14KB
                    • SHA256 69bb70836496d453033413285f37978fae0ace73596a59685d4988f2a964bda4
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .pkg2pezx.msq

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.pkg2pezx.msq
                    • Size 109KB
                    • SHA256 13f407549f35859ba7822a130b609eacd2a8bf91cf80f6fb36ac16a8ca498cdf
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .pu04lnrw.bas

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.pu04lnrw.bas
                    • Size 163KB
                    • SHA256 277bea173521d48677cfa1d604513853186820c03fa98fb0d58b251a950016f6
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .qgouvl0m.kkw

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.qgouvl0m.kkw
                    • Size 805B
                    • SHA256 edb8c0016103cf69ce75451ef8d2f1bb3380934529e71b1e9982d665b6f371b9
                    • MD5 SHA1 SHA512 TLSH

                    .qvgjjpsj.grv

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.qvgjjpsj.grv
                    • Size 15KB
                    • SHA256 bccbf8481c6337ea9b87b1aa00058fcccaf4b2bde865a05dc386d1ae2425ac59
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .rp3mkdnh.5yr

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.rp3mkdnh.5yr
                    • Size 470KB
                    • SHA256 4056fc6184cf32cfd375ad86568608a442fa341d0e1b4bc194be117d91d40a76
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .rvq2f0ow.sjh

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.rvq2f0ow.sjh
                    • Size 32.5MB
                    • SHA256 2531347e093fd1e82df1f1174cea3aa55c8975919e4dc1b19944b8ce3ae57c41
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .sv1sdyun.uql

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.sv1sdyun.uql
                    • Size 1KB
                    • SHA256 5bee36cc4418cc7ebcb93e54f1bb98c8bfd35e9ec33c8b0f851c0d1747052fee
                    • MD5 SHA1 SHA512 TLSH

                    .tfvnqmyu.icr

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.tfvnqmyu.icr
                    • Size 13KB
                    • SHA256 cb3d88272f582e3c81fc5f3e670a8cd0ff8d0f019cb82ed6c280f05df5d41119
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .tj2slftb.2bp

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.tj2slftb.2bp
                    • Size 94KB
                    • SHA256 51fc116c73da08910d1a38afb77036f5805568f9cdd34a5cc791d74afff8c011
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .vdsfjunt.tle

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.vdsfjunt.tle
                    • Size 157KB
                    • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .vizfrj5w.l0z

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.vizfrj5w.l0z
                    • Size 109KB
                    • SHA256 d5bfa85f9e6780d04dc0b0b379549377ea03c01900d14ce099c9ce35a7ac98ef
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .wqjd03bx.32b

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.wqjd03bx.32b
                    • Size 95KB
                    • SHA256 8fcac4991d9255afc682495751c2901bd24d614a4bb7cf6c901bb25f4f16b38a
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .y3uegkxp.5x3

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.y3uegkxp.5x3
                    • Size 242KB
                    • SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .ygq4jr0n.bpd

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.ygq4jr0n.bpd
                    • Size 95KB
                    • SHA256 e0f645670c4a62166f79811c4fc3b78deeb559e5f92a094ed9ab5ddec447419a
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .yjzmro1q.dez

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.yjzmro1q.dez
                    • Size 852KB
                    • SHA256 f0a0aeb642000fd00e867f86dcf44791883b5ab91c0a1c505af8ce20899c07ad
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    .ztvfq3oc.qdu

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\.ztvfq3oc.qdu
                    • Size 697B
                    • SHA256 816f07abd9161c087f2c6c5a87317b6b27b84fd9e1fbbc141407c6123ce1f0f4
                    • MD5 SHA1 SHA512 TLSH

                    Internal.props

                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\InsuranceVerifier\Internal.props
                    • Size 147KB
                    • SHA256 61dc1c586394c890b981c819fa32486459158f11d50f388016860d5615389bce
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    memory/544-5-0x0000022D7B020000-0x0000022D7B7E8000-memory.dmp

                    memory/544-4-0x0000022D48A50000-0x0000022D48AD2000-memory.dmp

                    memory/544-3-0x0000022D30810000-0x0000022D30840000-memory.dmp

                    memory/544-2-0x0000022D49110000-0x0000022D4926A000-memory.dmp

                    memory/544-1-0x0000022D2EED0000-0x0000022D2EEEA000-memory.dmp

                    memory/544-0-0x0000022D2EA30000-0x0000022D2EA6E000-memory.dmp