f87eb049b9bb6b6a6daa70a7eaede6cc18af7daf87e102298c2e7da36df8885d

Analysis

user interaction
yes
max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Client.exe
Size 390KB
Sample261006-2ys6vaythy
SHA256 f87eb049b9bb6b6a6daa70a7eaede6cc18af7daf87e102298c2e7da36df8885d
MD5 2188e204c632d39c669d8d5d41b9d713
SHA1 e2628b4e2cfd9e7ba0d5f28940cb91425c66a7b5
SHA512 dfc86182c0ee62da5a69c7815808a2c2b8fee426a15bb420082c675582e919329eafc21b98137d58b49de06bf90fcd5f9270b02c204bbcaeb36a3136acb0c969
SSDEEP 6144:6zv8mB9dpqC0AsORVyM3UEwNl80Wv4Kz1nuumc:a0yi5OsRbWvlUc
TLSH
T1B7847D26E79404FDE1B7D278CE928902DB727C4E07A1A6CF17D449921F236E05E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	discord.com
4	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
13	api.ipify.org
15	api.ipify.org

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4500	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3764	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4056	Client.exe
4056	Client.exe
4056	Client.exe
4056	Client.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3764	taskkill.exe
Token: SeShutdownPrivilege	4056	Client.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4500	4056	Client.exe	103
PID 4500 wrote to memory of 3764	4500	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /PID 664
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\system32\taskkill.exe
    taskkill /F /PID 664
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads