fee576a6c6fbb39b46e3f7e69c3fdd4114027de07cbbad45db9c9433f01072df

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
viewbot (2)/viewbot/0x21 viewbot.exe
Size 9.5MB
Sample261030-nclyraysc1
SHA256 fee576a6c6fbb39b46e3f7e69c3fdd4114027de07cbbad45db9c9433f01072df
MD5 669b64952ee4ce24023fde6f4c827726
SHA1 109b45ddf0806a4678a6da3bf7e9e5c250472a19
SHA512 12068052b76707e63b88e90b913cf0b83ab5c12036129242ebd1992dcd2e1c4151cda4f7078ded4ee7a659f00a5663c2679dc2b9cbfce5fa64ee4b345a0c167e
SSDEEP 98304:aSJc1ea706SkHwZEYLs5yIzb456S2P8S41GBPQFwM7:avk6SkZYLTI345WPx
TLSH
T1D4A67B03EC6564E9C1ADE2308AA39262BB757C480B3227D32B90F6747E77BD06D79354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
600	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 600	4264	0x21 viewbot.exe	89

C:\Users\Admin\AppData\Local\Temp\viewbot (2)\viewbot\0x21 viewbot.exe
"C:\Users\Admin\AppData\Local\Temp\viewbot (2)\viewbot\0x21 viewbot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  - Executes a command shell one-liner
  PID:600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads