Overview

overview

10

Static

static

1

memz.bat

windows10-2004-x64

memz.bat

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    47s
  • max time network
    42s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/09/2026, 08:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    memz.bat
  • Size 22KB
  • Sample260925-knm4eace24
  • SHA256 e1ccf67c2a92c333d5616421d1d8d4a17be6f37098d2b0e7e1b5a5788bcd3559
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bootkitdefense_evasiondiscoveryexecutionkillmbrpersistencetrojanwiper

Malware Config

Signatures

  • Family: KillMBR

    KillMBR is a trojan that attempts to overwrite the Master Boot Record.

    wipertrojankillmbr
  • Detects KillMBR 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\memz.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4652
    • C:\Windows\system32\certutil.exe
      certutil -decode c installer.exe
      2⤵
      • Deobfuscate/Decode Files or Information
      PID:2664
    • C:\Users\Admin\AppData\Local\Temp\installer.exe
      installer.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Users\Admin\AppData\Local\Temp\installer.exe
        "C:\Users\Admin\AppData\Local\Temp\installer.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:964
      • C:\Users\Admin\AppData\Local\Temp\installer.exe
        "C:\Users\Admin\AppData\Local\Temp\installer.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3668
      • C:\Users\Admin\AppData\Local\Temp\installer.exe
        "C:\Users\Admin\AppData\Local\Temp\installer.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4648
      • C:\Users\Admin\AppData\Local\Temp\installer.exe
        "C:\Users\Admin\AppData\Local\Temp\installer.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2420
      • C:\Users\Admin\AppData\Local\Temp\installer.exe
        "C:\Users\Admin\AppData\Local\Temp\installer.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2340
      • C:\Users\Admin\AppData\Local\Temp\installer.exe
        "C:\Users\Admin\AppData\Local\Temp\installer.exe" /main
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\Windows\SysWOW64\notepad.exe
          "C:\Windows\System32\notepad.exe" \note.txt
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4664
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3340
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3300

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
        • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
        • Size 64KB
        • SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
        • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
        • Size 4B
        • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
        • MD5 SHA1 SHA512
        Submit Download

        F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
        • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
        • Size 944B
        • SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        c
        • Path C:\Users\Admin\AppData\Local\Temp\c
        • Size 20KB
        • SHA256 ac4fa2b814601bf7914ee0dde1059c77a70de66693a758240c182d6c45a4d946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c
        • Path C:\Users\Admin\AppData\Local\Temp\c
        • Size 4KB
        • SHA256 fc3389aad1ce867a1651a0cdc72ff33073501ec34a3bd36611984540dc611441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\installer.exe
        • Size 14KB
        • SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        note.txt
        • Path C:\note.txt
        • Size 218B
        • SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3300-345-0x000002013C420000-0x000002013C421000-memory.dmp
        Download

        memory/3300-350-0x000002013C420000-0x000002013C421000-memory.dmp
        Download

        memory/3300-346-0x000002013C420000-0x000002013C421000-memory.dmp
        Download

        memory/3300-347-0x000002013C420000-0x000002013C421000-memory.dmp
        Download

        memory/3300-348-0x000002013C420000-0x000002013C421000-memory.dmp
        Download

        memory/3300-349-0x000002013C420000-0x000002013C421000-memory.dmp
        Download

        memory/3300-340-0x000002013C420000-0x000002013C421000-memory.dmp
        Download

        memory/3300-338-0x000002013C420000-0x000002013C421000-memory.dmp
        Download

        memory/3300-339-0x000002013C420000-0x000002013C421000-memory.dmp
        Download

        memory/3340-326-0x000002A0FADA0000-0x000002A0FADA1000-memory.dmp
        Download

        memory/3340-323-0x000002A0FADA0000-0x000002A0FADA1000-memory.dmp
        Download

        memory/3340-324-0x000002A0FADA0000-0x000002A0FADA1000-memory.dmp
        Download

        memory/3340-325-0x000002A0FADA0000-0x000002A0FADA1000-memory.dmp
        Download

        memory/3340-327-0x000002A0FADA0000-0x000002A0FADA1000-memory.dmp
        Download

        memory/3340-328-0x000002A0FADA0000-0x000002A0FADA1000-memory.dmp
        Download

        memory/3340-329-0x000002A0FADA0000-0x000002A0FADA1000-memory.dmp
        Download

        memory/3340-317-0x000002A0FADA0000-0x000002A0FADA1000-memory.dmp
        Download

        memory/3340-318-0x000002A0FADA0000-0x000002A0FADA1000-memory.dmp
        Download

        memory/3340-319-0x000002A0FADA0000-0x000002A0FADA1000-memory.dmp
        Download