fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1.exe
Size 1.4MB
Sample260930-ml7q5szfnd
SHA256 fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1
MD5 20a8bbee79c73315b44cb5ec0e698cfc
SHA1 40a4e43448153b072d490096b67c9ec2d888bb14
SHA512 7429a1a31aeddabfe185001f3615375f46057dd81db82663457d6057edb3a3a3c4d51fab0ac1685d6bcde2bef5c9013fb690e0518e3001727ad671e9fe89d42e
SSDEEP 24576:hYab5Kd+DiUDex3nXOTfO87lsuZ0DizKciF:+ab57DiUDeVnXOTfO8RZ0D
TLSH
T156653A17E3A240ECC5BFC13486579B72BA30F46D0534BE6E1A94DB312F25E609B6EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4388	cmd.exe
3400	cmd.exe
3476	cmd.exe
2428	cmd.exe
3216	cmd.exe
4852	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4852	3092	fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1.exe	90
PID 3092 wrote to memory of 4388	3092	fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1.exe	91
PID 3092 wrote to memory of 3400	3092	fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1.exe	92
PID 3092 wrote to memory of 3476	3092	fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1.exe	93
PID 3092 wrote to memory of 2428	3092	fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1.exe	94
PID 3092 wrote to memory of 3216	3092	fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1.exe	95

C:\Users\Admin\AppData\Local\Temp\fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1.exe
"C:\Users\Admin\AppData\Local\Temp\fee81e06d4660af91d2af99e45a35e6509e95debafdd72882f3581f1dccfdea1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cat /etc/os-release | grep PRETTY_NAME 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c uname -a 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cat /etc/os-release | grep PRETTY_NAME 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c uname -a 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cat /etc/os-release | grep PRETTY_NAME 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c uname -a 2>NUL
  2⤵
  - Executes a command shell one-liner
  PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3092-0-0x00007FF7E5040000-0x00007FF7E51B0000-memory.dmp

Download