Analysis
- user interaction
yes - max time kernel
149s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/10/2026, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
noobie.bat
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
noobie.bat
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target noobie.bat
- Size 113B
- Sample261022-vbterssvcw
- SHA256 0e0aa0d2989d6379df2fb26e67a46b947f1c69aea54e119205bee15ada6c25cc
- MD5 a1954da0ff1036ece8abc9b7797b5107
- SHA1 8178f48131cd47b39ef8d0d57fb89c924a40c53b
- SHA512 17b3699f7d49f85d4e43291eeeed3e6162cf790bd13dd524300ef77d9a0b8130b4540aee61217eeffcb83369e556c3434afd359b729e36691a0cb14262a84413
- TLSH T13AB0120F900B65C23072EE5A24B518D13133B13BEC459DC5724721534EC21C5B10E089
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4480 cmd.exe - Delays execution with timeout.exe 64 IoCs
pid Process 3412 timeout.exe 4392 timeout.exe 3712 timeout.exe 732 timeout.exe 1820 timeout.exe 3816 timeout.exe 1768 timeout.exe 3844 timeout.exe 4564 timeout.exe 3524 timeout.exe 3460 timeout.exe 2384 timeout.exe 4544 timeout.exe 3176 timeout.exe 4396 timeout.exe 1112 timeout.exe 3504 timeout.exe 3240 timeout.exe 1200 timeout.exe 1848 timeout.exe 1136 timeout.exe 372 timeout.exe 400 timeout.exe 5052 timeout.exe 3128 timeout.exe 1928 timeout.exe 520 timeout.exe 4088 timeout.exe 4224 timeout.exe 3308 timeout.exe 4516 timeout.exe 976 timeout.exe 2668 timeout.exe 3032 timeout.exe 4312 timeout.exe 4952 timeout.exe 3892 timeout.exe 1520 timeout.exe 1900 timeout.exe 4320 timeout.exe 4316 timeout.exe 4120 timeout.exe 892 timeout.exe 2892 timeout.exe 3048 timeout.exe 3904 timeout.exe 2760 timeout.exe 4984 timeout.exe 2624 timeout.exe 2016 timeout.exe 1908 timeout.exe 4472 timeout.exe 1164 timeout.exe 4720 timeout.exe 4756 timeout.exe 4452 timeout.exe 3056 timeout.exe 4876 timeout.exe 4664 timeout.exe 32 timeout.exe 1412 timeout.exe 4164 timeout.exe 4080 timeout.exe 3044 timeout.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 3904 4480 cmd.exe 85 PID 4480 wrote to memory of 3732 4480 cmd.exe 86 PID 4480 wrote to memory of 3328 4480 cmd.exe 87 PID 4480 wrote to memory of 4904 4480 cmd.exe 90 PID 4480 wrote to memory of 4664 4480 cmd.exe 93 PID 4480 wrote to memory of 4520 4480 cmd.exe 94 PID 4480 wrote to memory of 3504 4480 cmd.exe 95 PID 4480 wrote to memory of 2668 4480 cmd.exe 97 PID 4480 wrote to memory of 3240 4480 cmd.exe 98 PID 4480 wrote to memory of 2384 4480 cmd.exe 99 PID 4480 wrote to memory of 892 4480 cmd.exe 102 PID 4480 wrote to memory of 1748 4480 cmd.exe 103 PID 4480 wrote to memory of 1112 4480 cmd.exe 104 PID 4480 wrote to memory of 4692 4480 cmd.exe 105 PID 4480 wrote to memory of 32 4480 cmd.exe 106 PID 4480 wrote to memory of 4676 4480 cmd.exe 107 PID 4480 wrote to memory of 3752 4480 cmd.exe 108 PID 4480 wrote to memory of 2760 4480 cmd.exe 109 PID 4480 wrote to memory of 3412 4480 cmd.exe 110 PID 4480 wrote to memory of 1820 4480 cmd.exe 111 PID 4480 wrote to memory of 1116 4480 cmd.exe 112 PID 4480 wrote to memory of 4812 4480 cmd.exe 113 PID 4480 wrote to memory of 1412 4480 cmd.exe 114 PID 4480 wrote to memory of 4984 4480 cmd.exe 115 PID 4480 wrote to memory of 4164 4480 cmd.exe 116 PID 4480 wrote to memory of 4396 4480 cmd.exe 117 PID 4480 wrote to memory of 4764 4480 cmd.exe 118 PID 4480 wrote to memory of 4952 4480 cmd.exe 119 PID 4480 wrote to memory of 3128 4480 cmd.exe 120 PID 4480 wrote to memory of 812 4480 cmd.exe 121 PID 4480 wrote to memory of 1928 4480 cmd.exe 123 PID 4480 wrote to memory of 3816 4480 cmd.exe 124 PID 4480 wrote to memory of 3704 4480 cmd.exe 125 PID 4480 wrote to memory of 4804 4480 cmd.exe 127 PID 4480 wrote to memory of 520 4480 cmd.exe 128 PID 4480 wrote to memory of 2212 4480 cmd.exe 129 PID 4480 wrote to memory of 3032 4480 cmd.exe 130 PID 4480 wrote to memory of 4940 4480 cmd.exe 131 PID 4480 wrote to memory of 1200 4480 cmd.exe 132 PID 4480 wrote to memory of 1848 4480 cmd.exe 133 PID 4480 wrote to memory of 1136 4480 cmd.exe 134 PID 4480 wrote to memory of 1768 4480 cmd.exe 135 PID 4480 wrote to memory of 3560 4480 cmd.exe 136 PID 4480 wrote to memory of 4632 4480 cmd.exe 137 PID 4480 wrote to memory of 4908 4480 cmd.exe 138 PID 4480 wrote to memory of 3844 4480 cmd.exe 139 PID 4480 wrote to memory of 4392 4480 cmd.exe 140 PID 4480 wrote to memory of 2452 4480 cmd.exe 141 PID 4480 wrote to memory of 4120 4480 cmd.exe 142 PID 4480 wrote to memory of 692 4480 cmd.exe 143 PID 4480 wrote to memory of 3040 4480 cmd.exe 144 PID 4480 wrote to memory of 4720 4480 cmd.exe 145 PID 4480 wrote to memory of 4088 4480 cmd.exe 146 PID 4480 wrote to memory of 4888 4480 cmd.exe 147 PID 4480 wrote to memory of 2824 4480 cmd.exe 148 PID 4480 wrote to memory of 640 4480 cmd.exe 149 PID 4480 wrote to memory of 4536 4480 cmd.exe 150 PID 4480 wrote to memory of 2624 4480 cmd.exe 151 PID 4480 wrote to memory of 3204 4480 cmd.exe 152 PID 4480 wrote to memory of 4756 4480 cmd.exe 153 PID 4480 wrote to memory of 1900 4480 cmd.exe 154 PID 4480 wrote to memory of 4564 4480 cmd.exe 155 PID 4480 wrote to memory of 5084 4480 cmd.exe 156 PID 4480 wrote to memory of 4224 4480 cmd.exe 157
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\noobie.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3904
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3732
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3328
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4904
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4664
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4520
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3504
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2668
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3240
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2384
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:892
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1748
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1112
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4692
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:32
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4676
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3752
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2760
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3412
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1820
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1116
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4812
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1412
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4984
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4164
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4396
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4764
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4952
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3128
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:812
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1928
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3816
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3704
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4804
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:520
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2212
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3032
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4940
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1200
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1848
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1136
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1768
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3560
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4632
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4908
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3844
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4392
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2452
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4120
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:692
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3040
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4720
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4088
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4888
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2824
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:640
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4536
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2624
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3204
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4756
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1900
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4564
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5084
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4224
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4292
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4080
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4524
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3308
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3468
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4600
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2396
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2600
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2896
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4904
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4664
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4520
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5032
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4452
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3044
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:872
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2384
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:892
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2016
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:696
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3436
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4312
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4976
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2728
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1908
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4508
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:32
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1232
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4472
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3712
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4544
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3176
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3920
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3892
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4072
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1164
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1568
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2412
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3056
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3524
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5024
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4320
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4876
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:732
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2892
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4960
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3472
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:616
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2936
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3380
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3352
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:360
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4516
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1520
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2020
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1200
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5088
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1136
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1768
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4100
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2324
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:960
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1648
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4324
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3048
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2360
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3872
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:372
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1612
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2576
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3696
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4316
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:428
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2320
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3672
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2824
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:640
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1424
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:976
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2516
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4572
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1064
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4280
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:400
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1176
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3460
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5052
-