babdfeb99600f4c877ff8513ea510264caa20fdac70b2ce677275759e6df30d6

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dildomenü 2.0.bat
Size 1KB
Sample261009-vybs8sdb34
SHA256 babdfeb99600f4c877ff8513ea510264caa20fdac70b2ce677275759e6df30d6
MD5 3f837fde2706209ec0ff88509ad01c00
SHA1 22ff714d9428646bd422a6f50bb61604e47e3a8b
SHA512 027926bf5cf4957f8445420be89ffe4439d9191a15dcaec1ced519885a99297db63e4c804fd9af9743d7903c621bc6d8d375079a7e6896d365961960d7301b0d
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2472	cmd.exe
4576	cmd.exe
2760	cmd.exe
4020	cmd.exe
4768	cmd.exe
5508	cmd.exe
5132	cmd.exe
2312	cmd.exe
2900	cmd.exe
5128	cmd.exe
1652	cmd.exe
476	cmd.exe
4216	cmd.exe
6064	cmd.exe
4672	cmd.exe
1524	cmd.exe
4704	cmd.exe
2360	cmd.exe
3752	cmd.exe
6068	cmd.exe
4908	cmd.exe
6008	cmd.exe
2132	cmd.exe
4056	cmd.exe
5600	cmd.exe
2840	cmd.exe
4004	cmd.exe
5904	cmd.exe
5896	cmd.exe
4660	cmd.exe
4448	cmd.exe
1556	cmd.exe
3900	cmd.exe
2556	cmd.exe
1188	cmd.exe
1132	cmd.exe
3020	cmd.exe
4872	cmd.exe
3336	cmd.exe
4120	cmd.exe
4516	cmd.exe
5700	cmd.exe
3512	cmd.exe
4472	cmd.exe
4160	cmd.exe
3544	cmd.exe
4544	cmd.exe
3256	cmd.exe
1772	cmd.exe
3928	cmd.exe
4352	cmd.exe
5096	cmd.exe
5936	cmd.exe
4088	cmd.exe
3048	cmd.exe
3824	cmd.exe
4656	cmd.exe
2308	cmd.exe
5872	cmd.exe
5732	cmd.exe
4668	cmd.exe
1500	cmd.exe
4100	cmd.exe
680	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5808	4228	cmd.exe	88
PID 4228 wrote to memory of 3336	4228	cmd.exe	89
PID 4228 wrote to memory of 4216	4228	cmd.exe	90
PID 4228 wrote to memory of 5936	4228	cmd.exe	92
PID 4228 wrote to memory of 5096	4228	cmd.exe	94
PID 4228 wrote to memory of 2424	4228	cmd.exe	97
PID 4228 wrote to memory of 4088	4228	cmd.exe	98
PID 4228 wrote to memory of 4448	4228	cmd.exe	99
PID 4228 wrote to memory of 3752	4228	cmd.exe	100
PID 4228 wrote to memory of 6108	4228	cmd.exe	102
PID 4228 wrote to memory of 6064	4228	cmd.exe	103
PID 4228 wrote to memory of 4940	4228	cmd.exe	104
PID 4228 wrote to memory of 4664	4228	cmd.exe	105
PID 4228 wrote to memory of 5872	4228	cmd.exe	106
PID 4228 wrote to memory of 4124	4228	cmd.exe	107
PID 4228 wrote to memory of 4660	4228	cmd.exe	108
PID 4228 wrote to memory of 5128	4228	cmd.exe	109
PID 4228 wrote to memory of 4872	4228	cmd.exe	110
PID 4228 wrote to memory of 4888	4228	cmd.exe	111
PID 4228 wrote to memory of 1752	4228	cmd.exe	112
PID 4228 wrote to memory of 2312	4228	cmd.exe	113
PID 4228 wrote to memory of 5008	4228	cmd.exe	115
PID 4228 wrote to memory of 4020	4228	cmd.exe	116
PID 4228 wrote to memory of 2384	4228	cmd.exe	117
PID 4228 wrote to memory of 4392	4228	cmd.exe	118
PID 4228 wrote to memory of 4856	4228	cmd.exe	119
PID 4228 wrote to memory of 1140	4228	cmd.exe	120
PID 4228 wrote to memory of 3020	4228	cmd.exe	121
PID 4228 wrote to memory of 3544	4228	cmd.exe	122
PID 4228 wrote to memory of 2776	4228	cmd.exe	123
PID 4228 wrote to memory of 2760	4228	cmd.exe	124
PID 4228 wrote to memory of 4256	4228	cmd.exe	125
PID 4228 wrote to memory of 2360	4228	cmd.exe	126
PID 4228 wrote to memory of 4192	4228	cmd.exe	128
PID 4228 wrote to memory of 5132	4228	cmd.exe	129
PID 4228 wrote to memory of 1264	4228	cmd.exe	130
PID 4228 wrote to memory of 4352	4228	cmd.exe	131
PID 4228 wrote to memory of 4820	4228	cmd.exe	132
PID 4228 wrote to memory of 2900	4228	cmd.exe	133
PID 4228 wrote to memory of 940	4228	cmd.exe	134
PID 4228 wrote to memory of 1132	4228	cmd.exe	135
PID 4228 wrote to memory of 1988	4228	cmd.exe	136
PID 4228 wrote to memory of 680	4228	cmd.exe	137
PID 4228 wrote to memory of 2620	4228	cmd.exe	138
PID 4228 wrote to memory of 6068	4228	cmd.exe	139
PID 4228 wrote to memory of 1332	4228	cmd.exe	140
PID 4228 wrote to memory of 1188	4228	cmd.exe	142
PID 4228 wrote to memory of 4920	4228	cmd.exe	144
PID 4228 wrote to memory of 5896	4228	cmd.exe	146
PID 4228 wrote to memory of 4328	4228	cmd.exe	147
PID 4228 wrote to memory of 3700	4228	cmd.exe	148
PID 4228 wrote to memory of 2308	4228	cmd.exe	149
PID 4228 wrote to memory of 4160	4228	cmd.exe	151
PID 4228 wrote to memory of 5476	4228	cmd.exe	152
PID 4228 wrote to memory of 4956	4228	cmd.exe	153
PID 4228 wrote to memory of 1448	4228	cmd.exe	154
PID 4228 wrote to memory of 4544	4228	cmd.exe	155
PID 4228 wrote to memory of 476	4228	cmd.exe	156
PID 4228 wrote to memory of 3908	4228	cmd.exe	157
PID 4228 wrote to memory of 4300	4228	cmd.exe	159
PID 4228 wrote to memory of 4472	4228	cmd.exe	160
PID 4228 wrote to memory of 4656	4228	cmd.exe	161
PID 4228 wrote to memory of 5508	4228	cmd.exe	163
PID 4228 wrote to memory of 4164	4228	cmd.exe	165

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dildomenü 2.0.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:5872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:2360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:5132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:3700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:5476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:3908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:5904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:2556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:3256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:3048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:2472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:4516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:1556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads