8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/10/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
limclean.bat
Size 6.1MB
Sample261005-p5btxstblc
SHA256 8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada
MD5 8a9ff886cb5880ed2e2345cb3948c73f
SHA1 cf902893a232de1c4e07b3d207e2fba81bf4aedf
SHA512 538c3993a5a800cdb6ddae9c2927dd1cb53169623b2d51e9a6c78acda6b55115495be066c2bf03bf09e69204da4e45bad06ee83aad2d3ed99f28572bbc5052dc
SSDEEP 49152:VbQ8XLQygKiRO5FzresM8c/9uWBVPH1FBfB+ZevBcF7rIvBKBR3Z:P
TLSH
T19356140E7E4C1656CF2165FF702E8F09767204CB0A61AC50BD67796AADEA7C0B10C9E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\_Microsoft67"	adv4iqbsd1fsq59w.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1660	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3196	tmp2EAE.tmp.exe
916	adv4iqbsd1fsq59w.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4864	certutil.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
4	api.ipify.org

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\_Microsoft67	adv4iqbsd1fsq59w.exe
File opened for modification	C:\Windows\_Microsoft67	adv4iqbsd1fsq59w.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2636	cmd.exe
1296	cmd.exe
1428	cmd.exe
4552	cmd.exe
516	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	adv4iqbsd1fsq59w.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	adv4iqbsd1fsq59w.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5788	PING.EXE
5708	PING.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2732	timeout.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5788	PING.EXE
5708	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5336	schtasks.exe
4980	schtasks.exe
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
916	adv4iqbsd1fsq59w.exe
916	adv4iqbsd1fsq59w.exe
916	adv4iqbsd1fsq59w.exe
916	adv4iqbsd1fsq59w.exe
916	adv4iqbsd1fsq59w.exe
916	adv4iqbsd1fsq59w.exe
916	adv4iqbsd1fsq59w.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	916	adv4iqbsd1fsq59w.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4864	1296	cmd.exe	90
PID 1296 wrote to memory of 1660	1296	cmd.exe	91
PID 1296 wrote to memory of 2732	1296	cmd.exe	92
PID 1660 wrote to memory of 3196	1660	powershell.exe	94
PID 3196 wrote to memory of 1428	3196	tmp2EAE.tmp.exe	95
PID 3196 wrote to memory of 916	3196	tmp2EAE.tmp.exe	97
PID 1428 wrote to memory of 4192	1428	cmd.exe	98
PID 1428 wrote to memory of 5788	1428	cmd.exe	99
PID 1428 wrote to memory of 5708	1428	cmd.exe	100
PID 916 wrote to memory of 1288	916	adv4iqbsd1fsq59w.exe	102
PID 916 wrote to memory of 4552	916	adv4iqbsd1fsq59w.exe	103
PID 4552 wrote to memory of 5336	4552	cmd.exe	106
PID 916 wrote to memory of 516	916	adv4iqbsd1fsq59w.exe	108
PID 516 wrote to memory of 4980	516	cmd.exe	110
PID 916 wrote to memory of 2636	916	adv4iqbsd1fsq59w.exe	111
PID 2636 wrote to memory of 2756	2636	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\limclean.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\xdzl.b64" "C:\Users\Admin\AppData\Local\Temp\dbvx.ps1"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\dbvx.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\tmp2EAE.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp2EAE.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bnd_123ca7d3\limfucker.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1428
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4192
    - - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5788
    - - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\bnd_123ca7d3\adv4iqbsd1fsq59w.exe
      "C:\Users\Admin\AppData\Local\Temp\bnd_123ca7d3\adv4iqbsd1fsq59w.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" netsh advfirewall firewall add rule name="XuSb8Gp@8Sk>8Z" dir=in action=allow program="C:\Windows\_Microsoft67" enable=yes & exit
        5⤵
        
        PID:1288
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4552
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5336
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:516
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4980
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2636
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2756
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_pxjcribr.1mz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pxjcribr.1mz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

adv4iqbsd1fsq59w.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_123ca7d3\adv4iqbsd1fsq59w.exe
Size 658KB
SHA256 02d9edc6990f982dd15e24e18da4d948cf4aca843fbef57a66b681d887fa9f60
MD5 315714d5b53a7f77abaceb7de879ace8
SHA1 679a5680bd09a0013d698470b6bfc4bbd2d8efd8
SHA512 289e69e3a125f54dce300c88efd2b20241f0a84659c0f0c548f86604d23b4323a0d0ac9dc23722886babfc6b2af906aa5dbcbd2e13f88d87e3992f562772517d
SSDEEP 6144:MWwPRgWXrc4JNiUl8gcFSqsFwJtZTLYtwWwA+xBr1F4PckJlZZQsEeRr5mppbWf5:URPrc4XtilNr1FERZBrUpdEeks2pI6
TLSH
T1A3E4B5253B959E11E841163EC6BE2618D73260F22712AB47370BF7614D44AFEED2C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

limfucker.bat

Path C:\Users\Admin\AppData\Local\Temp\bnd_123ca7d3\limfucker.bat
Size 4KB
SHA256 d65bae84f5db96692e61f0c11fa14d33a738a2eeaddf945459ea5714e2c3809d
MD5 3bfc384f368049fbeb9fa8593590ccf4
SHA1 f49749b2fd06f363eac19d0d29705876eba6c26e
SHA512 051059d02868adf5ff9b1f3074bc0a885cca92ef2c2e7724f870515120daa957946919bc3bd3998936dbc3072a1df62af04b50f6b01b6d6ff0ddc26ad4bc989e
SSDEEP 96:8xbaF8FGfdYjlOBoCM9ogq3Lsq9x2E3RdI5uFHuzp/kCEMX1WjsTe3exvR:wzltCM9m3Lsq9dXIhzdkCEMX1Wjs6OD
TLSH
T11991F2567C1DADEA6272E18288B0548AFE55C69F2F1B2EC834DF417E73423C1925C1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvx.ps1

Path C:\Users\Admin\AppData\Local\Temp\dbvx.ps1
Size 3.7MB
SHA256 fee9a8f12119cad8743552d79a48ed670a0823bdcc66970f01db5251641e225b
MD5 8c1b875dd08490ea99edc0b6f29e3321
SHA1 351423011ec3b25c1822596f75af985f9f057f9f
SHA512 180ad24c467f043b01164cb8a74038a7b957e047c04dcba27860c2cc41f31c1cad21cb6e0b79af6e07c74e89410ee0e4897878b2a0f9b1f0c125ee86fa626f3a
SSDEEP 49152:dOA7w2AxBCpk7ybRtoi/YEklJBVITQ1gC5megtNbujqRzhqdPYmaqYfx1nKXBNa/:/
TLSH
T1F106128B4B2E9F9B1820387F7D21389659DCCCCCD5A8D2D0EB835D26F158D2D22B9B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp2EAE.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp2EAE.tmp.exe
Size 2.7MB
SHA256 b6a657a8c0ecc15a4fefdcdc35ca990e90c854c7b911d7a5c5ebea311164c1f0
MD5 c0bfbaea49f9529f1f7305b2b27a1cee
SHA1 84f4bfda1a1bb59540e29b773b7a42e8f9754ecf
SHA512 0a5a91dac1e6e0fdb5adaf84533ce762cd44d81920e9d08211852f34e11fab065eb13ec70670606c710cd5c88f83cf0ec0cf693e8fc7f8e8c3267ba9cced108d
SSDEEP 49152:DbBxckwJ6LYB3lmQ6l943I/LevEh1sGM8YsY5W:4brB3G9D/LTh1sGM8AW
TLSH
T16ED5D0253B959E01E541163EC6BE2618D73260F22312AB47370BFB614D45AFEDD2C3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdzl.b64

Path C:\Users\Admin\AppData\Local\Temp\xdzl.b64
Size 2KB
SHA256 8863c1ac548ab5d8a2007caaadab18bd16bc3139909df66cb0194b218f8dbd24
MD5 a52297d9391917f140b7050e224652d8
SHA1 e1ad467c638a285d4e1a86509ac4cbaac71c1e66
SHA512 1176caa4be3872bb58e7206169e72e29ac6e65568fc781e3d911cd597cd673bcb70a1dd77f19a171f7903059f4fc778569834a19ae80b138282a930e15e5bd6d
TLSH
T159512B48E786AB83A1B19E0C1157539B341458C43A1358AC19EEFC5C563AB1B5EC4EED
MD5 SHA1 SHA512 TLSH

Submit Download

xdzl.b64

Path C:\Users\Admin\AppData\Local\Temp\xdzl.b64
Size 4KB
SHA256 fc2bcf0c7e13a677ebcb9eaf767d310826b31cc6f4c265b12ff8b98bf5d86847
MD5 00ef9d354741676800ee3826c62748fc
SHA1 1c39c67d2fd53f1c33fa389903a28d17e5436b80
SHA512 7ce1a965ad9eac38a46af33d25ad849d14e2aa25c118ce3dc8c47a4bcabd5acb2a5f67388882ed6f0c480576a22800317180199424781d26df46003c3cf3a3a2
SSDEEP 96:nNoDGfWFtOkfkTt2S0ecNgPe8tTzwq2ZvO7NJ/WTRNXaKAcOb:niDmmfkTt2TeHm8tPwqCvWNJGRNqxF
TLSH
T17D916C8DE717EB83D2B4CD5971136257203464D03A2368AD16ADF868937BA1B0EE8C5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdzl.b64

Path C:\Users\Admin\AppData\Local\Temp\xdzl.b64
Size 5.0MB
SHA256 7ac23b28bb8782091b6927c8b13d4792b8720fab3902d2fa6dbc35c19d33ecf0
MD5 6a11a403e57e49b1c9c54946e837d6f9
SHA1 5faee8238b3684d349a155e0c4b98adf6cdcde71
SHA512 a56adc8e986c2ef21bbe38b0be816388f697b3ff7bf6c4aed6b44a8fbf13194078645cfd905b17e30d424d23b21465854c91b15a9c71be3dd641f65bd782dc18
SSDEEP 49152:W3+IFzTa0i+WnMf/hZOQCyYz7qOB1jsYvv3z954RAPKPDirUfr9h:E
TLSH
T15736F11623992FDF8964663DE13421198BE0041A5DB6235DBBE3EE0FFFEAD0C0916479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-67578-0x000001E4DCC90000-0x000001E4DCD36000-memory.dmp

Download

memory/1660-67539-0x00000211BCD20000-0x00000211BCE10000-memory.dmp

Download

memory/1660-67550-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67530-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67531-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67532-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67533-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67534-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67535-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67536-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67537-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67538-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67527-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67541-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67525-0x00000211BC910000-0x00000211BC932000-memory.dmp

Download

memory/1660-67547-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67548-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67549-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67529-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67551-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67552-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67553-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67554-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67555-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67556-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67557-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67558-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67579-0x00000211BCD20000-0x00000211BCE10000-memory.dmp

Download

memory/1660-67526-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67523-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67570-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/1660-67517-0x00007FFF687BF000-0x00007FFF687C0000-memory.dmp

Download

memory/1660-67580-0x00007FFF68630000-0x00007FFF68FD4000-memory.dmp

Download

memory/3196-67562-0x0000000000660000-0x000000000070E000-memory.dmp

Download