7528acfbffd12f72017dfc1f8ef8e0fc816b970f7efaa493ae473cddb38c69fe

Analysis

max time kernel
149s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
02/12/2025, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kryo_crypted_c9wmaqzo.bat
Size 36KB
Sample251202-1ffx5abp3z
SHA256 7528acfbffd12f72017dfc1f8ef8e0fc816b970f7efaa493ae473cddb38c69fe
MD5 657cf25107f34bc6352a94554871dd27
SHA1 4397c8d19ed3ce031572e758fe26a50a8d96debe
SHA512 dab42d7c9b4919a5f4b71051f26f4f588124393c4b45997891665f15bc8b18069046a8ef168d1ded65e9837c0d7dedae8bf0eb6f43ec3737da55d6e33de46eff
SSDEEP 768:lIXsdbeYuFZhOsEBoXoWtxMvfOzNpTG1LvhcAsebEPkV4ZI1XNLd:lI8dbaizGzvhzzTELFbEPCw0XNJ
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3340	certutil.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2780	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
3632	timeout.exe
4460	timeout.exe
5376	timeout.exe
4240	timeout.exe
4860	timeout.exe
3376	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	powershell.exe
2780	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 5376	4432	cmd.exe	79
PID 4432 wrote to memory of 2780	4432	cmd.exe	80
PID 4432 wrote to memory of 4240	4432	cmd.exe	81
PID 4432 wrote to memory of 4860	4432	cmd.exe	82
PID 4432 wrote to memory of 3340	4432	cmd.exe	83
PID 4432 wrote to memory of 3376	4432	cmd.exe	84
PID 4432 wrote to memory of 6060	4432	cmd.exe	85
PID 6060 wrote to memory of 5216	6060	MSBuild.exe	86
PID 5216 wrote to memory of 3324	5216	csc.exe	87
PID 4432 wrote to memory of 3632	4432	cmd.exe	88
PID 4432 wrote to memory of 4460	4432	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\kryo_crypted_c9wmaqzo.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\kryo_crypted_c9wmaqzo.bat'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4240
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4860
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\payload_14755.b64" "C:\Users\Admin\AppData\Local\Temp\payload_27576.xml"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3340
- C:\Windows\system32\timeout.exe
  timeout /t 0 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Users\Admin\AppData\Local\Temp\payload_27576.xml"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lpjxgcin\lpjxgcin.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES784D.tmp" "c:\Users\Admin\AppData\Local\Temp\lpjxgcin\CSC1A416D73A40F4D058CD8E42A77F8DF1B.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3324
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3632
- C:\Windows\system32\timeout.exe
  timeout /t 3600 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES784D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES784D.tmp
Size 1KB
SHA256 2f11e4dee2861511c9b55e1c1082d488ade1e2b868beaecf47afd3613faa27f8
MD5 dd3764498e49907d226f71f41326b5f0
SHA1 5e2791a68bb43059ad6bdabe7515b7d84cffc800
SHA512 2fef7b764c2bdfd14799d4de3d093b52f3a76c4ce443d945964bc693ca305977f4a243d368a9cbf3b60924927176cd890acb52eca76079374d17345980909374
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_yxvy0us1.w3o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yxvy0us1.w3o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

lpjxgcin.dll

Path C:\Users\Admin\AppData\Local\Temp\lpjxgcin\lpjxgcin.dll
Size 48KB
SHA256 5b780cbb2cc3a3525b9ffd0015dee44a768c5466c47d859a90773bc6e2b20f6b
MD5 718c78ac0bbc9481a929155091792bc1
SHA1 64e6adf27098dc38220dc319bfd77594cee869a2
SHA512 b2e4bc116633cb3585d69155ae6358e21ff9b564bee87994297741a378cec129a2fe9596824350596be295d6f33c931b974ebb18db63ba91e83acd97fc37c22b
SSDEEP 768:vTAdJ+ea9CK1CjBHcclW5QwI2q2LZQI6SsqUmZ3oot8uPQjlv6s3woV+bV:bAdJ+eaDQdcc05QtGPNZ4u5iFAoV+bV
MD5 SHA1 SHA512 SSDEEP

Submit Download

lpjxgcin.pdb

Path C:\Users\Admin\AppData\Local\Temp\lpjxgcin\lpjxgcin.pdb
Size 13KB
SHA256 a42ae49b7286b7b09ee77ccdc483f46f7ba25a77a4957ca6cbc2a1e47fb1a6a0
MD5 a081e99ebed0130f5cb45f97e75423c4
SHA1 8f9d20db34b8d821230b43147e8e9d3db0e3c48c
SHA512 3f07c3efc086ad622577dc9a72ad5ed57bb6005ca1cbdbef2e8e03df7fcb4c15eb4908d811f67d02101faa27a74c82521b81cf4f97e1e5f8a915b23e4bc9f0e3
SSDEEP 96:zGAFjR8bHLRjpqxwHOSWKxv0yeNjZuHdz:qAFwdjpqxwHiO0ycZc
MD5 SHA1 SHA512 SSDEEP

Submit Download

payload_14755.b64

Path C:\Users\Admin\AppData\Local\Temp\payload_14755.b64
Size 33KB
SHA256 a09becfcee02c134ca1525e7ce58fbea8b114a7fe30d657ac1bbd4033126eb0c
MD5 1bd9a1761f092ce16d17ce484a35f81f
SHA1 dce400ca32bf8668db8f0f6e21e4c4ac330a464d
SHA512 6d4e934116b6c5d18a6ba67c518a3e5abefa4a3406cfe7bb4d7c5c808aa034a623ad3100a185dd11702e10e4e515649f8c25b39c5d6050046c31983328c64332
SSDEEP 768:nXsdbeYuFZhHsEBoXoWtxMvvOzNpTG1LIhcAsebEPke4ZI1XNn:n8dbaTzGzvHzzTEL+bEPHw0XNn
MD5 SHA1 SHA512 SSDEEP

Submit Download

payload_27576.xml

Path C:\Users\Admin\AppData\Local\Temp\payload_27576.xml
Size 25KB
SHA256 b80d992b4f57267c198a582ff996bf638bb3eb97397dcbbd278376e190e96470
MD5 ac2736439d6d530ae83a4c1c3f4e929e
SHA1 970a9752c9b28557a007141b204cd04031b61839
SHA512 061d9fd3bcf7b41ea1de53d3a0c6750680ba8cc5731c97200de91024a2ede76312a6185beff50530ed2935296d2251ef783ff6b0f9114bc35a710733ac52b339
SSDEEP 384:OT5AbbTIocTqF3jjcBEZGzD0AKBJU3pL0lsfEBdq+Svq92G8K7RO9WWQWaOm6f+C:OVoMFTqFzpGzgtBYVVYvkFrnHZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC1A416D73A40F4D058CD8E42A77F8DF1B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lpjxgcin\CSC1A416D73A40F4D058CD8E42A77F8DF1B.TMP
Size 652B
SHA256 0febc1dd8c8e8b0453b44ba2742cb52ccb2a6c7c351edb9049fe245369584760
MD5 ffb973fd131ac13b8624123ee1190641
SHA1 9f5f046604acb549a4300a463369b1387dd317f4
SHA512 3db760935d568851130569e77c977a771b6434a7579e3fffc5009e495018306fb1590c3dde4279210676878b01b5f7c03d38aec48ff67219bee6cebd529ad5bb
MD5 SHA1 SHA512

Submit Download

lpjxgcin.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lpjxgcin\lpjxgcin.0.cs
Size 25KB
SHA256 814a0b51b098206de8592275a73ccce7f7d27633f95e25d6e316834d291fe000
MD5 7b760311c8eb7af0b36b4f302269279e
SHA1 bb6f8c8a0e7ed52de69aca439721aa5bd785c64a
SHA512 9c58ccd1aa6c21b8afa0027f00d26c2b84db4798b46ddb042dadf6450524154cc9dca926c749ac651ab871045532f637a27334f2e13aee0846eb91913354b93c
SSDEEP 384:hT5AbbTIocTqF3jjcBEZGzD0AKBJU3pL0lsfEBdq+Svq92G8K7RO9WWQWaOm6f+n:hVoMFTqFzpGzgtBYVVYvkFrnHa
MD5 SHA1 SHA512 SSDEEP

Submit Download

lpjxgcin.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lpjxgcin\lpjxgcin.cmdline
Size 660B
SHA256 39afb141f9cac9c2bebf95bb43658a09f90c4f38255daad3d99e0721df788adc
MD5 fdc27b048fa863fdd16eb9349ff8bb5f
SHA1 8ff436aa84ba5510f3b7d8edc921dc2cf7677053
SHA512 630474577b9bf0740dc8ef7fa6b1d0d08f414ad9cc214a3f29131fdd2fbd28a0b4abb7f045e9b6d8de6df47156b761b0adeeeecc4b475e68fe69d79bcf57f7a2
MD5 SHA1 SHA512

Submit Download

memory/2780-9-0x000001CAC9500000-0x000001CAC9510000-memory.dmp

Download

memory/2780-1-0x000001CAC9500000-0x000001CAC9510000-memory.dmp

Download

memory/2780-8-0x000001CAE3260000-0x000001CAE3282000-memory.dmp

Download

memory/2780-0-0x000001CAC9500000-0x000001CAC9510000-memory.dmp

Download

memory/6060-20-0x00000000061B0000-0x00000000062D2000-memory.dmp

Download

memory/6060-21-0x00000000060D0000-0x0000000006114000-memory.dmp

Download

memory/6060-22-0x0000000006410000-0x000000000658C000-memory.dmp

Download

memory/6060-23-0x0000000006780000-0x0000000006AE6000-memory.dmp

Download

memory/6060-18-0x0000000005540000-0x0000000005570000-memory.dmp

Download

memory/6060-17-0x0000000005650000-0x00000000057AA000-memory.dmp

Download

memory/6060-16-0x0000000005430000-0x000000000544A000-memory.dmp

Download

memory/6060-15-0x0000000000A20000-0x0000000000A60000-memory.dmp

Download

memory/6060-38-0x00000000060A0000-0x00000000060B2000-memory.dmp

Download