aa924a6919fe3c59d10d5df940fddba5b8f6e0f4db93553bd85571904258446b

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BloodyRat.exe
Size 110KB
Sample260929-wstyastzby
SHA256 aa924a6919fe3c59d10d5df940fddba5b8f6e0f4db93553bd85571904258446b
MD5 dd217a73710dbcaf125083c5460c822b
SHA1 c9c9143a17600d06dd79186afe4485237e3f9c85
SHA512 4c49ef9588d37a3e311e3722d70f5b96147a5e53fb59d0fb49ebde980bca762ad461ec3d3b3cc1c0baf153ba494acbbe87e7b9b722fed78653c471de8a2e2927
SSDEEP 3072:L7DhdC6kzWypvaQ0FxyNTBf7jlWR8sbefe:LBlkZvaF4NTBzZWRFefe
TLSH
T1F8B39E41F3E201F7EAF1053100EA626F973A63349764A9EBC74C2D529903AD5963D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BloodyRat.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1188	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 2984	3392	BloodyRat.exe	89
PID 2984 wrote to memory of 1188	2984	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\BloodyRat.exe
"C:\Users\Admin\AppData\Local\Temp\BloodyRat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2D0.tmp\2D1.tmp\2D2.bat C:\Users\Admin\AppData\Local\Temp\BloodyRat.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2D2.bat

Path C:\Users\Admin\AppData\Local\Temp\2D0.tmp\2D1.tmp\2D2.bat
Size 153B
SHA256 f6bf1f8d851e3cca6eb9c47d6e13e95fd99d686e4a91c26d9f785339ff1434f4
MD5 0d602d2f50b409069db48817f1ee1387
SHA1 095381d54e01312f6390fcc5117b24a1c7080eaa
SHA512 7c6bbdf5e3c08e6a70555e0a07623c07d170ce956d752d268e6b15fa625a44e3d94a7d98d3f98217fad7c5f04415bcf8e205d5af4c5739339a612c421339c998
TLSH
T140C02B70742BF0C21AF00C1289B70C6DF26151C30143EE51F0CF40B173801D0F019710
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3392-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download