a4cec4bcce51917416c8fff6d49ef3d0252970409933cab859278b9b5d39c68c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
monocloud-exporter-0.1.0-win64/run-headless.cmd
Size 97B
Sample261107-qfx7ascs2x
SHA256 a4cec4bcce51917416c8fff6d49ef3d0252970409933cab859278b9b5d39c68c
MD5 69262511bd38569011b8d9a4e6d475d3
SHA1 f72841d6f4abc4cd7c3d43c351241b2ec50d3e40
SHA512 89f6c935cfeb8bdc411febd9893a59f4855f02b757fef8808d612d671f074a1780478119bb66f3ec8dc2270661d397bc8339bb2b274edf05652158ab95f0c163
TLSH
T115B012034068148637B76C497112B2909C0DD1D340085E91148133141A9D16F4B38480
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2220	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1796	2220	cmd.exe	89
PID 2220 wrote to memory of 4368	2220	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\monocloud-exporter-0.1.0-win64\run-headless.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1796
- C:\Users\Admin\AppData\Local\Temp\monocloud-exporter-0.1.0-win64\mcexport.exe
  mcexport.exe --headless --config-dir "C:\Users\Admin\AppData\Local\Temp\monocloud-exporter-0.1.0-win64\config"
  2⤵
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads