Analysis
- max time kernel
149s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
13/10/2025, 14:18
General
- Target specificationof rubber sheet for thermal power plant.bat.exe
- Size 767KB
- Sample251013-rmse3aet2e
- SHA256 689b86b0fad706fb4f8423bc737b154c66f86cc00dcefdb2e9cf0f5783814c7c
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\specificationof rubber sheet for thermal power plant.bat.exe"C:\Users\Admin\AppData\Local\Temp\specificationof rubber sheet for thermal power plant.bat.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OekbIrQTNq.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OekbIrQTNq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB4F8.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\specificationof rubber sheet for thermal power plant.bat.exe"C:\Users\Admin\AppData\Local\Temp\specificationof rubber sheet for thermal power plant.bat.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\OekbIrQTNq.exeC:\Users\Admin\AppData\Roaming\OekbIrQTNq.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OekbIrQTNq.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OekbIrQTNq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFADB.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\OekbIrQTNq.exe"C:\Users\Admin\AppData\Roaming\OekbIrQTNq.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_csgbumz1.mab.ps1
tmpB4F8.tmp
LoginData
WebData
OekbIrQTNq.exe
memory/3216-47-0x0000000070650000-0x000000007069C000-memory.dmp
memory/3216-56-0x0000000008160000-0x00000000087DA000-memory.dmp
memory/3216-13-0x0000000005310000-0x0000000005346000-memory.dmp
memory/3216-15-0x00000000053A0000-0x00000000053B0000-memory.dmp
memory/3216-14-0x00000000053A0000-0x00000000053B0000-memory.dmp
memory/3216-64-0x0000000007E50000-0x0000000007E58000-memory.dmp
memory/3216-17-0x00000000059E0000-0x000000000600A000-memory.dmp
memory/3216-63-0x0000000007E60000-0x0000000007E7A000-memory.dmp
memory/3216-62-0x0000000007D60000-0x0000000007D75000-memory.dmp
memory/3216-61-0x0000000007D50000-0x0000000007D5E000-memory.dmp
memory/3216-32-0x00000000061F0000-0x0000000006256000-memory.dmp
memory/3216-24-0x0000000006150000-0x0000000006172000-memory.dmp
memory/3216-33-0x00000000062D0000-0x0000000006336000-memory.dmp
memory/3216-41-0x0000000006340000-0x0000000006697000-memory.dmp
memory/3216-42-0x00000000067C0000-0x00000000067DE000-memory.dmp
memory/3216-43-0x0000000006800000-0x000000000684C000-memory.dmp
memory/3216-60-0x0000000007D20000-0x0000000007D31000-memory.dmp
memory/3216-59-0x0000000007DA0000-0x0000000007E36000-memory.dmp
memory/3216-46-0x0000000007980000-0x00000000079B4000-memory.dmp
memory/3216-54-0x0000000006DA0000-0x0000000006DBE000-memory.dmp
memory/3216-55-0x00000000079C0000-0x0000000007A64000-memory.dmp
memory/3216-58-0x0000000007B90000-0x0000000007B9A000-memory.dmp
memory/3216-57-0x0000000007B10000-0x0000000007B2A000-memory.dmp
memory/4416-93-0x0000000006290000-0x00000000065E7000-memory.dmp
memory/4416-105-0x0000000007DA0000-0x0000000007DB5000-memory.dmp
memory/4416-104-0x0000000007D60000-0x0000000007D71000-memory.dmp
memory/4416-103-0x0000000007A80000-0x0000000007B24000-memory.dmp
memory/4416-96-0x0000000074E20000-0x0000000074E6C000-memory.dmp
memory/4416-95-0x0000000006D60000-0x0000000006DAC000-memory.dmp
memory/5296-1-0x0000000005990000-0x0000000005F36000-memory.dmp
memory/5296-4-0x00000000053C0000-0x00000000053CA000-memory.dmp
memory/5296-3-0x0000000005380000-0x0000000005390000-memory.dmp
memory/5296-2-0x00000000053E0000-0x0000000005472000-memory.dmp
memory/5296-7-0x0000000005380000-0x0000000005390000-memory.dmp
memory/5296-8-0x0000000006770000-0x0000000006808000-memory.dmp
memory/5296-6-0x0000000006AB0000-0x0000000006AC4000-memory.dmp
memory/5296-5-0x0000000005650000-0x00000000056EC000-memory.dmp
memory/5296-0-0x0000000000840000-0x0000000000906000-memory.dmp
memory/5972-67-0x0000000000400000-0x000000000044E000-memory.dmp
memory/5972-18-0x0000000000400000-0x000000000044E000-memory.dmp
memory/5972-21-0x0000000000400000-0x000000000044E000-memory.dmp