3ea01bbbaf950a0cda10ef60ef398564074ba1444818e185edb2068aa2317b97

Resubmissions

29/09/2026, 18:24

260929-w2bs3svxdz5

29/09/2026, 18:13

260929-wt7wjsvx5p5

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client_10_0_f7e9ed06.exe
Size 47KB
Sample260929-wt7wjsvx5p
SHA256 3ea01bbbaf950a0cda10ef60ef398564074ba1444818e185edb2068aa2317b97
MD5 cd230ec8f7388df4afa6c1ffa011b03f
SHA1 cd2428b90b6be2842f9df8aba2ae00d9c104447a
SHA512 7ffb96d76888c21b3f8803cc63cb01ae03f66ebf39ec0726ab95d6ee190484f5eca54dea4d143d64d1e6a2d69ff318c2c9a2b2eae5c3bbe41a31f9690da266a7
SSDEEP 768:O3XxvE0Av6g8qDY9K4gwf83IMXEx1fdalDz/iVl7Bhopab/qjyJ+Dy5GESi:OBqjDWK4gwE3IAlDbiV5opaejyJayoi
TLSH
T19223F17A7A89362AE09D46B5C6DF805DB070FC8CC7D0C26B0F55706728377CEAA19654
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery execution

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3280	client_10_0_f7e9ed06.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2796	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2796	cmd.exe
3372	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3372	PING.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 2796	3280	client_10_0_f7e9ed06.exe	90
PID 2796 wrote to memory of 3372	2796	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\client_10_0_f7e9ed06.exe
"C:\Users\Admin\AppData\Local\Temp\client_10_0_f7e9ed06.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 3 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\client_10_0_f7e9ed06.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3280-0-0x00007FF7B0A00000-0x00007FF7B0A2B000-memory.dmp

Download

memory/3280-2-0x00007FF7B0A00000-0x00007FF7B0A2B000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads