c2152bd63205dd3d7a8a7b0da189e7ca389efeb6aefdf522bc5dd474aa394175

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 12:26

Target
vendor/bin/cmder_diag.cmd
Size 1KB
Sample261110-pl98dattey
SHA256 c2152bd63205dd3d7a8a7b0da189e7ca389efeb6aefdf522bc5dd474aa394175
MD5 96d13c65026fb08e70a835500158844e
SHA1 96d3a41f0c7e7e69abd4c27d995118a9968ec84a
SHA512 33d30161f96c4e2136000b5da6810b56b5c0c187c53c8e0b49f0de91cb637732f4b818fe4f8aa9519b0d508515243c84051052a810fe6800e8b68bb305dbf055
TLSH
T1EB3161517C4EE16899A2E652FD3D4D1BFA43308B5DE57E24B40322340A405E6B3BCACC
MD5 SHA1 SHA512 TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
3004	cmd.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
2688	systeminfo.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 5176	3004	cmd.exe	90
PID 3004 wrote to memory of 1996	3004	cmd.exe	91
PID 3004 wrote to memory of 2688	3004	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vendor\bin\cmder_diag.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\where.exe
  where git
  2⤵
  PID:5176
- C:\Windows\system32\where.exe
  where clink
  2⤵
  PID:1996
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:2688