996ab998661e3ecd7ba88a59b57eb721aa6fcba22e66f8ae620508aa14846917

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ImSellerPrintAgent/2-CHECK-AGENT.cmd
Size 396B
Sample261020-vn5zbsty5j
SHA256 996ab998661e3ecd7ba88a59b57eb721aa6fcba22e66f8ae620508aa14846917
MD5 313d8467f826fa1fb6b20541d2663436
SHA1 9b3e30e78a28d0415a81ff4eae0132039f539a91
SHA512 184eccef0236315bbc2b04327450ad4e645c488e761cb511a30185acd50b93e89a0fad9a84f79db7b9eafa411638943d45c41e81b77edce6d345cd9da8383656
TLSH
T114E068B120E991990338746E4801F54D358B10FE6F6F6BC23012786E3AFA0704E3F7A5
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3968	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2260	3968	cmd.exe	86
PID 3968 wrote to memory of 736	3968	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ImSellerPrintAgent\2-CHECK-AGENT.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2260
- C:\Users\Admin\AppData\Local\Temp\ImSellerPrintAgent\ImSellerPrintAgent.exe
  ImSellerPrintAgent.exe check
  2⤵
  PID:736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads