0635d1f00e6f1a58be5e80ed58d0694498556ff849d06090ccaac55078a1d125

Analysis

user interaction
yes
max time kernel
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Diagnose.cmd
Size 58B
Sample261026-q7ffkas16p
SHA256 0635d1f00e6f1a58be5e80ed58d0694498556ff849d06090ccaac55078a1d125
MD5 488ce8a59053717b9a3128741f63218d
SHA1 d75cb3237ee87f20c593438d5a21c3b50e29271c
SHA512 706ccb629a32efd7b6cf65283b1984c4df784045525ae2a8df864f9c44764a206a35cca1a5e26f0419f4c1af35243e605034779c3a8eac1be75bbf418f6b64c2
TLSH
T1DBA022000203002308820C00E283080FB8AE00830000B8C0A08202000008002ACC8BC2
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3356	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	Reiz.exe
4164	Reiz.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 4164	3356	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Diagnose.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\Reiz.exe
  "C:\Users\Admin\AppData\Local\Temp\Reiz.exe" --diagnose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher.log

Path C:\Users\Admin\AppData\Local\RustXESP\launcher.log
Size 466B
SHA256 93a138b5f13a3c394a019afd49994318a656026fc6937b789c95712ffbfeca63
MD5 ee51ae33fb298478c0438b59ef5ea834
SHA1 745c559137133503a413898a2c49c6d267d715a4
SHA512 4a505a88f1a3ae5d1b09398580e6d25e211818cfdbe15d44f09b70fdcbe74c30c428165d70725d0b71a12146f1574c99a3bfd7f9b851100107bbbb11e64eb841
TLSH
T143F0271428FED9780948835B0A695D5D80A076F92E992EEC0790CB5C201D96CBE8638A
MD5 SHA1 SHA512 TLSH

Submit Download