f6f4a6f8db46eb1de0cf6af2de4e30b06369b2ad2fb29a679e529a442f88c605

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ping Boost.bat
Size 5.4MB
Sample260930-xv9bfaxy7k
SHA256 f6f4a6f8db46eb1de0cf6af2de4e30b06369b2ad2fb29a679e529a442f88c605
MD5 2ea0479e835d252d85eb8f9203131ada
SHA1 8e34f355fddc073872bba07f8beba338c5c60202
SHA512 346407db9b095f44acbcf9520adc208431201605cc5c53fa3e0dbd81111ad8a5a5f578e8f074ec109bea3940603267ae03bf4c81e6f4688e211baef3df49990f
SSDEEP 24576:y4r/9XFgXqnfL0IEvU2bLKYgUyTPvLWN+6EYVEqivTthJZB9wT8fl2RMWeXK+wvj:u3asjia317
TLSH
T1AF466BCED8E53EE49D789C776AB1962617B521C72D8D8F48DB2C54B924BBC7E0E03081
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4572	certutil.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4184	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4184	cmd.exe
468	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
468	PING.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4572	4184	cmd.exe	90
PID 4184 wrote to memory of 4600	4184	cmd.exe	92
PID 4184 wrote to memory of 468	4184	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Ping Boost.bat"
1⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\system32\certutil.exe
  CERTUTIL -f -decode "C:\Users\Admin\AppData\Local\Temp\Ping Boost.bat" "C:\Users\Admin\AppData\Local\Temp\iDetectPINGNÃODESOFUSCASUAVADIA.bat"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4572
- C:\Windows\system32\mode.com
  mode con: cols=116 lines=30
  2⤵
  PID:4600
- C:\Windows\system32\PING.EXE
  ping localhost -n 5
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iDetectPINGNÃODESOFUSCASUAVADIA.bat

Path C:\Users\Admin\AppData\Local\Temp\iDetectPINGNÃODESOFUSCASUAVADIA.bat
Size 3.9MB
SHA256 47902a68ce5cfc69dfcfe098b8c6d50e6765d1dfea9dad6b4084ad9673e3605a
MD5 1c7d623c0f76155da6e631b5ac691e32
SHA1 9fcb1562710fc31a05e2e5b2b6ba2074f2d9918d
SHA512 078690402e5bbe93c67ecad46894903bdcf15c3b9abb9fa12477ae2c16e6f43ec7a531d8cfc42a163eab1951884648f82f6545a4af5feeab7482e396c11e208a
SSDEEP 12288:cuwS7gWHWEWaW13+hL40OF0YonNWR4ljDFiYsJEaTd72taZt1:hgW2EWaW13+hL40+R4zsJESZt1
TLSH
T1A9169B2329F3074F98B07D85579B318BAA2731FD5A338A6C51C825F917F9E1A2077392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download