721475feb92571ee62756d8013bd61a06a2219f5ac622ebd161c3b2c18df6adb

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
r6chams/launch.bat
Size 540B
Sample261017-cwpyzagy6z
SHA256 721475feb92571ee62756d8013bd61a06a2219f5ac622ebd161c3b2c18df6adb
MD5 4b4c38c3c318ebcfd2e704dedfb217e9
SHA1 309fc2ea1df6a6882a3ff34fbf0c43501f1b7869
SHA512 cad32ee8df2d1de0adfbbd53f5da65d352417b4553f5a3c0d41cd4a09df489f8a26ed77318b5a7cceb1acf7f1b7526eb264c39e7a445ec94383df28104bfae03
TLSH
T13BF05013B4D7533265D10485DC963355701986DFE0005C06F1AFA1B94B49AD7FEBC5D1
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2256	5b5995b1c54005e1.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4280	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6132	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
6132	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
808	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6132	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
Token: SeDebugPrivilege	2256	5b5995b1c54005e1.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 6132	4280	cmd.exe	88
PID 6132 wrote to memory of 2256	6132	RuntimeCacheHost-CrossPC-R2-Diagnostic.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\r6chams\launch.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\r6chams\RuntimeCacheHost-CrossPC-R2-Diagnostic.exe
  "C:\Users\Admin\AppData\Local\Temp\r6chams\RuntimeCacheHost-CrossPC-R2-Diagnostic.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\ProgramData\8b74df54094b580b\5b5995b1c54005e1.exe
    "C:\ProgramData\8b74df54094b580b\5b5995b1c54005e1.exe" --launch --wait 600 --owner 6132 --stop-event "Local\16078602311866d68830ffbb4e521ac3-stop" --lease-mutex "Local\16078602311866d68830ffbb4e521ac3" --self-delete
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5b5995b1c54005e1.exe

Path C:\ProgramData\8b74df54094b580b\5b5995b1c54005e1.exe
Size 1.5MB
SHA256 e917dee14f33ac10c078d0e2233eff92a91c14524a2d5a1add010c2bd61e4998
MD5 33ef767694c98f92a4fb4fe8c7df1b65
SHA1 f3f5b283df395cd6a1d1a72a4e0b2544661785ab
SHA512 120fe29090ab4eb58750c0f8b20672b735cf06d6cc6f53aa6b48e7f06147fba4ea2c4944861f1254862c7d76c3d4b07c137dd67c5e3edd9f58f230d2f2523669
SSDEEP 12288:EfS9nCYYUP/3rEHdVrFZZQkCSlSjSNvsMuIiQU7zCU4VuBEsQBG/1LYHCQnO6:REHdVr2hSsUB2zCU4VuBEskZX
TLSH
T17B75DB4084B2E45F8DC61C3F52086C6888ECA4AF93622EC7D9E69554CD47BCF6D3BE64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\1c80a1fcd9616d7f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 5471aa0cd6a264f4b2a79a641fb03ae0d37e07e1d792dea3943d942eeec09023
MD5 c5cd84e026f98eda77e7b23dff77c995
SHA1 51ae17cf3105ee7c4c8f447605c270c9ab05d870
SHA512 eb7d92a798444675d82cac94a2060f2c70886fda4e2ad619aeba90efcd3a8d5ce9fcd7a4f6cedc3b8af9c5f56d5ebd6d75ada089744e81d7f1e610d210b9ff49
SSDEEP 3:lOlln/lGlll/l/lXp9ZjrPBY0Hl2lHeSqP:lOl9/0dPBY0oLk
TLSH
T13E53118022820A2BC8A2233008CA0A803BB822080383082282A0A2B0C8AAB0208A0280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\1c80a1fcd9616d7f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\1c80a1fcd9616d7f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1008B
SHA256 2a1377d45136d2e1ee71f847c862f6d16cbe36c1466bbebcbe6963211fc537a3
MD5 9c8040fba19fff3113e3695d5d9afd56
SHA1 1d181ac40a56acb411bf938aee4f24fcadd51ab4
SHA512 ac0fb1395d81b21b41da790223976ffa23cb8dc9b1115ac7f8715919c3b28f751389488de82857052e083b7210d6e035d7c96dbeaee27a181daaeaf2723a02af
TLSH
T1A31112557FD61E72E337207046F65BA5E117B10161D19209C483476549325474D12F9D
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeCacheHost-6132.log

Path C:\Users\Admin\AppData\Local\RuntimeCacheHost\RuntimeCacheHost-6132.log
Size 640B
SHA256 95c7049224c63b63444e09bd008681e44d311715b139f3de8446cc6d2eff7f14
MD5 1a68e4665fa605180ea06875e9a5ec61
SHA1 a3fbb7e8779260155870138321d10e84e8b7b955
SHA512 ff945d44e060051b9e3af7f867f050957bc856f0abac5677291d793b131969919cd655fd0c6266c2692d515a1d5b25dc0080b479e486d3e641645aed4469715e
TLSH
T160F062AD4DB6B8E8009142177F5C6E4C6EB7B6326B0D15DC757DCF50D885E07F8484A0
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeCacheHost-6132.log

Path C:\Users\Admin\AppData\Local\RuntimeCacheHost\RuntimeCacheHost-6132.log
Size 1KB
SHA256 d67c851e9873fdfce999a0af5a2fd8b807de913dce0c64735094603370b457fa
MD5 26c3350236f4232d8c79ee417bdfd892
SHA1 8a2bf431c65e72a3891f4133a692ab8f2463617a
SHA512 335a450561b218df6100c1a6fc655d30c8964cadce2c78745814ef309086ec9f7ff512e89a2974d38610c0d663c899b13be4ad27cf1e05305e3e3dcf3dfb9c54
TLSH
T16721BFBD0CB1B8A810924212BE5CAE4C5EB7B5721B5D24D87A7DCF50DCC5E03F985490
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2256-28-0x000001D1DD600000-0x000001D1DD601000-memory.dmp

Download

memory/2256-27-0x000001D1DD600000-0x000001D1DD601000-memory.dmp

Download

memory/2256-26-0x000001D1DD600000-0x000001D1DD601000-memory.dmp

Download

memory/2256-25-0x000001D1DD600000-0x000001D1DD601000-memory.dmp

Download

memory/2256-29-0x000001D1DD600000-0x000001D1DD601000-memory.dmp

Download

memory/2256-30-0x000001D1DD600000-0x000001D1DD601000-memory.dmp

Download

memory/2256-21-0x000001D1DD600000-0x000001D1DD601000-memory.dmp

Download

memory/2256-19-0x000001D1DD600000-0x000001D1DD601000-memory.dmp

Download