99a300006e92b0ee4ba62c5a7ee63baad4869cd11a9a381ea08b5363bad9c583

Analysis

max time kernel
899s
max time network
445s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.exe
Size 87KB
Sample260925-va45wawsfx
SHA256 99a300006e92b0ee4ba62c5a7ee63baad4869cd11a9a381ea08b5363bad9c583
MD5 cc99adaecade5bec3992ff0c9c48faa2
SHA1 b466967e9e13f6676d1340e2bf1c8f18813207cf
SHA512 1b2803dd1347848182239060f450fbca2548018ab435590baabd62698001ee66021936b488617065d2940fbd6c18321b4faa5af311e8a6f151c3b2a4712b635c
SSDEEP 1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfvxrF:Hq6+ouCpk2mpcWJ0r+QNTBfvX
TLSH
T1E5937C45F3D242F7EAF10A7100A6712FA73666249724E8DBC34C3D829553AD4AA7C3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2968	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 2968	4724	start.exe	90
PID 2968 wrote to memory of 4148	2968	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\start.exe
"C:\Users\Admin\AppData\Local\Temp\start.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6056.tmp\6057.tmp\6058.bat C:\Users\Admin\AppData\Local\Temp\start.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java "-Dorg.lwjgl.librarypath=C:\Users\Admin\AppData\Local\Temp\\natives" -jar "C:\Users\Admin\AppData\Local\Temp\\minecraft.jar"
    3⤵
    PID:4148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4932

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6058.bat

Path C:\Users\Admin\AppData\Local\Temp\6056.tmp\6057.tmp\6058.bat
Size 83B
SHA256 89102734e1748fcfa5492d0abf1fe43c569bd4277b870ce2d72652f7523aa47c
MD5 b4b434f15ea077cfd7c7a567818f34cb
SHA1 e71c55b4b3b7f75e05389fa1f25cbede21b4622d
SHA512 f9ed18327e6de7f8171ce796e9f72eba8348597dc83107acc993be71002e17e1cc971ec82e8bd4256eb3a9ed6714382553e762874aee1936841277c60e4ef847
TLSH
T1E4A0121046476200729B810B50504434716CC9ABC50A40913090933030888C42342160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4724-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download