f56dba8a048918a756acdeac2ec7547e2557bea91ce1e7dd831d81b706e2100e

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 06:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hotwing-cli/parse_config.bat
Size 110B
Sample261027-hnsb1sch74
SHA256 f56dba8a048918a756acdeac2ec7547e2557bea91ce1e7dd831d81b706e2100e
MD5 618590f7a8a45ef7d264b3cb6d212841
SHA1 8e75632758032c2a9483ff4f07420e98e331b058
SHA512 a8238a91c8c9c6067793915e0d20f834628d927ca1d81946ea17daf8bad7d75b5b91f55fcee85c83ef03ce4b0fa872199f92d8b95c700d25701a2f73ee2f0b66
TLSH
T178B09202845F8832A8210EC2E83234370C2DCA7BEB024017156499E66C1850D410BA50
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 11 IoCs

pid	Process
3224	hotwing-cli.exe
3224	hotwing-cli.exe
3224	hotwing-cli.exe
3224	hotwing-cli.exe
3224	hotwing-cli.exe
3224	hotwing-cli.exe
3224	hotwing-cli.exe
3224	hotwing-cli.exe
3224	hotwing-cli.exe
3224	hotwing-cli.exe
3224	hotwing-cli.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotwing-cli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotwing-cli.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 2240	4016	cmd.exe	86
PID 2240 wrote to memory of 3224	2240	hotwing-cli.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hotwing-cli\parse_config.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\hotwing-cli\hotwing-cli.exe
  hotwing-cli.exe parse config.txt -o gcode_left.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\hotwing-cli\hotwing-cli.exe
    hotwing-cli.exe parse config.txt -o gcode_left.txt
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22402\_ctypes.pyd
Size 86KB
SHA256 96846a901d0d793fb77ff0b6488a904dc675a8d5273a442888d41d9a32bb845b
MD5 c5422db93c5fd74e09db36ddf975da9e
SHA1 023c33abd230ff3a546283da64a782eb9a7d257d
SHA512 169456c06a7e7c3bd63bfa0c88a90a0bbbf9866f142d103b8c2ca31507fa86e0782d76406b5769defd02323d2df6eaaab42559b9437668d466e370414d96a962
SSDEEP 1536:0XTymqLfTBzpzD9sCbZmgWTEGw7sc/3lHlT8CbKM/k9R/Ecdsnhqcfb:4OLr5F9xbZmgWG7scICeMc/PdsnkYb
TLSH
T1E6836C3E7647B466DE8902F460629FE22D26514B133366DF539D1AD088506F2CAFE3CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22402\_socket.pyd
Size 45KB
SHA256 c4d4577cb797a7206dafd862bd09264b248fd9324e008dee1783067da85e793e
MD5 637aabdff24be92e33f3e71367e6e6a5
SHA1 86eb7a6f4806777c463a12f5efb6f789731bd66c
SHA512 135c5faf5cadc099256b12586b1b300b43bae1d9fb9f40cb713756b143582a146c48009c58d3d367644386fe6101f3035bd3dae2bcec4699cd6f20bdafe60c14
SSDEEP 768:Item5BHOzzLflv36gop4qr6l1EGYsOkqdjTGTW+FPBXsNoC+M6Lnuo+0MgFWFW:I8m5BHYd6go9r6TEfMqYW+FPNC7gLnl
TLSH
T14A234B11BB42F2B7E9A904B9E06B77737AE49D851365B8D3617C9EB810510F0B4BB282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22402\_ssl.pyd
Size 1.3MB
SHA256 6d9abe468b51b13e220d042f160e617e896eddecf7031a14cac2407ed65c7eaf
MD5 6ba1564cd78ddb62900ff3327c18587c
SHA1 4d9e695e1f2099ca2cde796380d90c4e20cae343
SHA512 64f3f37170fdb3efb21403396309f69c6939d426fee638cdcb68d56660aa2588fa02084531fce5d775e76ad13113c1435d003333c92dd91ca9c42fc126d61d4a
SSDEEP 24576:UPtervmeB99xRlRXGA9+KpPIGOokqRxT10UiJ1gPp/yFmUqNWw:UFeaeB9DPRdNQITLO1Ip/SmUqNWw
TLSH
T13155AE03EB9149B1E84E92BD12B763BF6F36A711832DC5C38AA12C91DD612D1673E3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hotwing-cli.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI22402\hotwing-cli.exe.manifest
Size 1015B
SHA256 4c8050e47f80d9480ab54aaa0ef130130088fa3bf18f7eb1823f3e764cb4d259
MD5 e61989159a48c860ee14c629a4d508c5
SHA1 8aada7ae79ac1037363de31297484a3aae1f2976
SHA512 0a8fedfd61e6aacd9345ffffd87e2bace21e991e3e991de2f95b033ecb4346692f782df5b57118e28d58f0ab39f61862a2231d3d0652e30b3f01ffece66a3453
TLSH
T17A11E100C4C9D862B73241D73761AD49DE59A7B7088C46ADB49D7B2F5F13ED48253168
MD5 SHA1 SHA512 TLSH

Submit Download

python27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22402\python27.dll
Size 2.3MB
SHA256 70355fb3c537504ec5a9097e85388776774f7f9431e6b6cff7f9dcca3aa87900
MD5 452c5356550f2b5930b33b324b47440f
SHA1 1fbfd1383463b1dd6fa07728b2ac072b2022c8c1
SHA512 8753cadf5e2a3eaa77709c9f9923dd96823ef7521b0f80d582fee3f7aba72756820c27ebf7245bc3bee1f6fa9d7d3ec45b437b13a418901822462f9ef793d179
SSDEEP 49152:h6yVQRrXEDRpb56787e9n+ys+bTc5IK6HiOnAGM0MPmzark3Skn:h6yK77+9mpHnAGM0/glk
TLSH
T17DB5BF90AA42D0B1DD5A0CF861AA52B72F708D04BB27B9D3D4A87D8CE6731F0567D38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22402\pythoncom27.dll
Size 387KB
SHA256 5df515976d0f2955ae4be1e19990de644e5461db98b0ce91ca6b0e22851fea52
MD5 52b865ec9937c6b1f6ba686b7e21258d
SHA1 b9e108968574577364048c18d4d6b21912bd4454
SHA512 6c172889a48aa3fef43250fe52b97911e79aa153e14471fce95aff5340c4646b1cf9b89942849c50e2903ee21ec345295989d49899fc6bf5782421e087d9c219
SSDEEP 6144:rJu1f/PgkI9mJr1nPf4LknFyd+OKFsDpd675ERCt51q:1u1f/Pgk0mJrdPf4qMBpds2
TLSH
T1BB844BA2B70F84F1D95921FDC47327120A6ACCD12F25EEC312F5658ADC626D96D383CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22402\pywintypes27.dll
Size 107KB
SHA256 88d8eb5894c47990b4ff88e94a75f59c498cfd16b0f29894f0947f5ed2a862f3
MD5 a28653caf591fc7b4c7971821deb9a56
SHA1 5ff590e23cbb45ae4a441eeecf2d0609103eec08
SHA512 c1bbb29e2aaa6181aeccd19d2843646e1e2dd7d33e7ace04f9df215ec5bdc604ce170e5ee6cefbe646663c278e0e9e1332c4fd63f241d2db0e66bcd7950bdd92
SSDEEP 3072:VZsz18WtYUmuPcgxxKEYLRMMMHBBY2Y7bi0tf70fsNOK8dZ5TaY:VCzptYUmuEgxxKEYLRMbjY7bi0170EN4
TLSH
T134B35C013B0388A6CA45D3BB2DA93A26667552108369F3D3A7B3C5D399B43F14DBD2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22402\win32api.pyd
Size 97KB
SHA256 63112adebc44d8183faa148e53cc48ddda0a9fb11c7d15a1ef5c8b36023f1205
MD5 4808fc8e377c68afc58e512eaeb92984
SHA1 5d30fb56abd2a4e66108a8e8cd21450a7e29dcc4
SHA512 7c8994a78022499561d69893c67c4f16dcc826ba42bed01bb079324c980946a50463737e7f96f13915aa0a2728ff4555d61c33d7c7375de69e0d71f9347f66f4
SSDEEP 3072:d26TODbjcOlNJvsIxzaAl2OfGXChCVhV3LHhBNIxJ2cUDqtyAtykub:46TOPjlNJ0ozaAl2O+ChCVhVxcUDqLyj
TLSH
T139A3E5433A539073D19876BE40A5B9720A7AA4B81333F2D3C5B4EEC6096C9D13A7C7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI22~1\_hashlib.pyd
Size 889KB
SHA256 afab75a25ca8f87916d2a639d384b8cff9bf3050354594e9564c27fe62ef3e4e
MD5 324761ca06eb9e4350307780959d8ebd
SHA1 e1024324ef747e29bd64ac2074712650eb7ca971
SHA512 1036c66ebabdd2d85566894322a7e16b9212332bba7514836a124b98c9ca6691247bf2302d5af7d67732e65242acd9ddc70da830d483e5b10c154703a6cff914
SSDEEP 12288:0DVUlUkZIB8eHwYMx5h4cFehX3DsLv2OlaUbDlctA+kA2xqRNBvpq5ezR88A:YQ8PNMx5hFeASkfCNxpqIzR88A
TLSH
T1D0159D0BFF9589B1E98E857D21F7573F5B37A202432AC6C38A6129219D612D06B3F3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3224-43-0x0000000002A50000-0x0000000002B96000-memory.dmp

Download

memory/3224-39-0x00000000008A0000-0x00000000008AE000-memory.dmp

Download

memory/3224-52-0x0000000000E90000-0x0000000000EFB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads