83b14ffb50834a169a2c086b856e55fde1ed3ca0c21a946f4ff5dff3125dcf00

Analysis

max time kernel
11s
max time network
3s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
06/10/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kaz_spoofer.exe
Size 130KB
Sample261006-th8ycsds7m
SHA256 83b14ffb50834a169a2c086b856e55fde1ed3ca0c21a946f4ff5dff3125dcf00
MD5 3f8edf07d805000b21eef2276d187eb5
SHA1 64bb0af787a26341a24bd8f8507554b50d104138
SHA512 1a9435d6e217ea725e194eb8711881af7d9f73ce761d91733ad8212665f7ee4c03a5a8adc40aef15b70aabc8f2bee9b8db7e8a8ef3ab760cbf5511674f50eaf1
SSDEEP 3072:Y/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFS8B3Ii4:Ttzsb5Uh28+V1WW69B9VjMdxPedN9ugh
TLSH
T1CCD3379BB2E01089EBB681F6D5520746EB7074721715A3DB1B7863B71B2B8C58F3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3064	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
408	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3064	2012	kaz_spoofer.exe	85
PID 3064 wrote to memory of 408	3064	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\kaz_spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\kaz_spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\778C.tmp\778D.tmp\778E.bat C:\Users\Admin\AppData\Local\Temp\kaz_spoofer.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

778E.bat

Path C:\Users\Admin\AppData\Local\Temp\778C.tmp\778D.tmp\778E.bat
Size 8KB
SHA256 ceaac7bb3d1a4b3aa3d8055af41e41e1f8c888b227038078f0b4fdeef761140b
MD5 6ec97929a4db2661eca203591a6b4513
SHA1 a34ecf8a5bce02fce9adfad4a3ed90b36f1831c7
SHA512 98893210caec1b3cc75666fffb5a9b87524799d62237671d3dff2f8412411349bacea5afd44aea900f8d736ef322e2ea4fd809081dfd0779356a2f315e89161c
SSDEEP 192:Cmff0VTLHa+2tK/Eaqz0vP7BvDj/lMbwNzwQkdmfXSTKbIb/sDVX0htY1b4CFCp5:fff0VTLHa+gK/Eaqz0vP7BvDj/lMbqza
TLSH
T162021B233D559C8494E0DAD7D9FA2402E79603D70D122FD5B9CB5064AB08BAA33BDBDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download