7189070190bb4cc348d4e9f2ba728ec9d77b32499c4835ecc864cd6300f2172c

Resubmissions

02/11/2026, 12:34

261102-pr5vvacs6q7

02/11/2026, 12:30

261102-ppg11afb396

02/11/2026, 12:02

261102-n7lw8sszgt8

Analysis

max time kernel
898s
max time network
490s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
02/11/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hotel-dusk-decomp-main/verify.bat
Size 182B
Sample261102-ppg11afb39
SHA256 7189070190bb4cc348d4e9f2ba728ec9d77b32499c4835ecc864cd6300f2172c
MD5 6281fb73ac4a194fae54d72c21ffd72d
SHA1 513bedc8e1018476d084d3ea606833e2cb8b531e
SHA512 806eb56dd0edcb5c06a80b335059678b123f6d4aa7ceccc292bb14a6ce77c80b45f47843275fa00c31646f42eaf10d77d798526690a6d2e075ac8a792c7563ff
TLSH
T11DC0C0037424003334FA4C40CF556080848C89EF504D7CD130C210513F0C1E48EFB7C0
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1900	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1804	1900	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hotel-dusk-decomp-main\verify.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads