97fa07976eb48a5f37ed447ee28683caaa8fb64787516a08efc51be757a87145

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
slayers-2-fishing-windows/src/find_python.bat
Size 1KB
Sample260928-ebp5cathpc
SHA256 97fa07976eb48a5f37ed447ee28683caaa8fb64787516a08efc51be757a87145
MD5 a1199bee33f4ca69bfa434235b4af159
SHA1 928a10f986a6deaffe1ba84f11027c538ee2fd48
SHA512 d32e537041bc5b0b0d6d5f30b81cada6ce4d9acbb876b72e71638cb7c7a4f2b1dcc6276a57491fb5b6e998a9d9e5dbbc444e15a483db8c9474276845627f8f14
TLSH
T1CF11CC092601C13240390BEC7E5C42B3B3D754F3212359F3706986B8BF48A71717EBA4
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
832	cmd.exe
2724	cmd.exe
1152	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 832	1152	cmd.exe	87
PID 1152 wrote to memory of 2724	1152	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\slayers-2-fishing-windows\src\find_python.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads