721475feb92571ee62756d8013bd61a06a2219f5ac622ebd161c3b2c18df6adb

Analysis

user interaction
yes
max time kernel
20s
max time network
13s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
r6chams/launch.bat
Size 540B
Sample261017-cwpyzagy6z
SHA256 721475feb92571ee62756d8013bd61a06a2219f5ac622ebd161c3b2c18df6adb
MD5 4b4c38c3c318ebcfd2e704dedfb217e9
SHA1 309fc2ea1df6a6882a3ff34fbf0c43501f1b7869
SHA512 cad32ee8df2d1de0adfbbd53f5da65d352417b4553f5a3c0d41cd4a09df489f8a26ed77318b5a7cceb1acf7f1b7526eb264c39e7a445ec94383df28104bfae03
TLSH
T13BF05013B4D7533265D10485DC963355701986DFE0005C06F1AFA1B94B49AD7FEBC5D1
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3372	690a5bf7f8185c43.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5808	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2680	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
2680	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
Token: SeDebugPrivilege	3372	690a5bf7f8185c43.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 2680	5808	cmd.exe	85
PID 2680 wrote to memory of 3372	2680	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\r6chams\launch.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Users\Admin\AppData\Local\Temp\r6chams\RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
  "C:\Users\Admin\AppData\Local\Temp\r6chams\RuntimeCacheHost-CrossPC-R2-Diagnostic.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\ProgramData\b029a83f03a2f1cc\690a5bf7f8185c43.exe
    "C:\ProgramData\b029a83f03a2f1cc\690a5bf7f8185c43.exe" --launch --wait 600 --owner 2680 --stop-event "Local\05ec6aa539b2709c9bdb131c46f80c89-stop" --lease-mutex "Local\05ec6aa539b2709c9bdb131c46f80c89" --self-delete
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

690a5bf7f8185c43.exe

Path C:\ProgramData\b029a83f03a2f1cc\690a5bf7f8185c43.exe
Size 1.5MB
SHA256 e917dee14f33ac10c078d0e2233eff92a91c14524a2d5a1add010c2bd61e4998
MD5 33ef767694c98f92a4fb4fe8c7df1b65
SHA1 f3f5b283df395cd6a1d1a72a4e0b2544661785ab
SHA512 120fe29090ab4eb58750c0f8b20672b735cf06d6cc6f53aa6b48e7f06147fba4ea2c4944861f1254862c7d76c3d4b07c137dd67c5e3edd9f58f230d2f2523669
SSDEEP 12288:EfS9nCYYUP/3rEHdVrFZZQkCSlSjSNvsMuIiQU7zCU4VuBEsQBG/1LYHCQnO6:REHdVr2hSsUB2zCU4VuBEskZX
TLSH
T17B75DB4084B2E45F8DC61C3F52086C6888ECA4AF93622EC7D9E69554CD47BCF6D3BE64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\34738c1574695759\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 a08a5a7000c786bf9abadfc57f27dcd4018aa720f1701cfd80fb6ca2d2b72532
MD5 a0a8d8f3cd9ce07c25fb19c772770fcd
SHA1 0dd3f183a87f05db0647b424299f99f4960aa900
SHA512 9f5a5cc8b08dd4ecde16c88e4a9da88421396164a479a6c1c96e6f05ccea332799335d98bdbc3c0b29ccdca376c05ae1b2c92af5fcc2735f0db76652a8fcdeb4
SSDEEP 3:a+/lGlll/l/lXp9ZjrPBY0HlOl/7kllRP:90dPBY0gu/J
TLSH
T1CB5302C067938A77CC530734C8DF0F943E799219979345B683E48A70D8EAB5508E52C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\34738c1574695759\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\34738c1574695759\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 992B
SHA256 a634aa227e0108649be80a652d8e33a1e161d8fbf2a9fbaa8a0be39013ecf45d
MD5 6b268605ef8d5faf21962f327996f96a
SHA1 d465ae71fdbc484dccf00341b3dc50df1a06591e
SHA512 70d65ac5018255b65854b3f5f03a90fb072ff237375de7067c30da99f667cc5aa2414cfca0fd3fa5e1fe4994d3d5fd599f217a96a6394bc75fa50489f9270c1a
TLSH
T19F118C0A3B8A2EB0F33761B082E8856A2902B103A6C18A0240C787204332D0E2C41BAC
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeCacheHost-2680.log

Path C:\Users\Admin\AppData\Local\RuntimeCacheHost\RuntimeCacheHost-2680.log
Size 1KB
SHA256 40c1f707d70f8dfefdf97825872dfcf0b49ba5fec3ae9a52c3556750699d5ec1
MD5 c115a7a713d04c12b57ccb6ebc40b93c
SHA1 708e7b3820e200c93e92a300bbd2d8ff27837bfd
SHA512 c1d2e19efe2189e69c390288dfdfee2e662a1e58da576aa84224b0e820b0e3d0e7a85bea8f1c68f1a89492c7353df01f8d24617eb1f6373cedadaabcf6a8a125
TLSH
T11A21E6BD0CB268E810929252BE5C6A0C4EB3B1721B4C15F8BD7CDF60DC95E53F99A490
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3372-29-0x000001FE4FD10000-0x000001FE4FD11000-memory.dmp

Download

memory/3372-30-0x000001FE4FD10000-0x000001FE4FD11000-memory.dmp

Download

memory/3372-28-0x000001FE4FD10000-0x000001FE4FD11000-memory.dmp

Download

memory/3372-27-0x000001FE4FD10000-0x000001FE4FD11000-memory.dmp

Download

memory/3372-26-0x000001FE4FD10000-0x000001FE4FD11000-memory.dmp

Download

memory/3372-25-0x000001FE4FD10000-0x000001FE4FD11000-memory.dmp

Download

memory/3372-31-0x000001FE4FD10000-0x000001FE4FD11000-memory.dmp

Download

memory/3372-19-0x000001FE4FD10000-0x000001FE4FD11000-memory.dmp

Download

memory/3372-20-0x000001FE4FD10000-0x000001FE4FD11000-memory.dmp

Download

memory/3372-21-0x000001FE4FD10000-0x000001FE4FD11000-memory.dmp

Download