d539676c48b596afda64c963ec8f7ee56c7b3fe7e3b81d1dbe2d1a1e3dd9e9f8

Resubmissions

24/10/2026, 12:58

261024-p7jybay12r3

24/10/2026, 12:54

261024-p5d92svsbw7

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gradlew.bat
Size 2KB
Sample261024-p5d92svsbw
SHA256 d539676c48b596afda64c963ec8f7ee56c7b3fe7e3b81d1dbe2d1a1e3dd9e9f8
MD5 6772a61a0c6bf6d7621560074829a789
SHA1 1d54ad9d8c57ac92b09870e9e80010f51369ee02
SHA512 5ad3a5cba05bbe75705aee8b92f26df0c8bf9a4b2694dbf5a350d71aa2ebe600e962e54242c55097c215be80b02ed894970dd2aa38be1c229d21a9d7121815db
TLSH
T1C75145AB374743B56F6C37967E1C4982B322A2B52F4FB20C705F851D217034C56D2A9B
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1140	cmd.exe
5324	cmd.exe
4248	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 6024	1140	cmd.exe	89
PID 1140 wrote to memory of 4400	1140	cmd.exe	90
PID 1140 wrote to memory of 5324	1140	cmd.exe	91
PID 1140 wrote to memory of 4248	1140	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\gradlew.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java.exe -version
  2⤵
  PID:6024
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "java.exe" "-Xmx64m" "-Xms64m" "-Dorg.gradle.appname=gradlew" -jar "C:\Users\Admin\AppData\Local\Temp\\gradle\wrapper\gradle-wrapper.jar"
  2⤵
  PID:4400
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c exit 1
  2⤵
  - Executes a command shell one-liner
  PID:5324
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c exit 1
  2⤵
  - Executes a command shell one-liner
  PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6024-2-0x000001A4832D0000-0x000001A483540000-memory.dmp

Download

memory/6024-12-0x000001A481850000-0x000001A481851000-memory.dmp

Download

memory/6024-13-0x000001A4832D0000-0x000001A483540000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads