Overview

overview

8

Static

static

1

tokoyo (2).bat

windows10-2004-x64

8

tokoyo (2).bat

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    665s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 19:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tokoyo (2).bat
  • Size 48KB
  • Sample260808-yn95tsteld
  • SHA256 e5edea2b5e1a52645b01fb1cb4f4a04bf6bc06f29152cb829181c12449cb2af5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 8 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Powershell Invoke Web Request.

    execution
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tokoyo (2).bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\Windows\system32\mode.com
      mode con: cols=120 lines=60
      2⤵
        PID:4136
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "& { try{ $r=Invoke-RestMethod -Uri 'http://apilayer.net/api/validate?access_key=demo&number=(239)662-4977' -ErrorAction Stop; Write-Host 'Country:' $r.country_name; Write-Host 'Carrier:' $r.carrier; Write-Host 'Location:' $r.location }catch{ Write-Host '[ERROR] Lookup failed' } }"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2540
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "& { try{ $r=Invoke-RestMethod -Uri 'https://www.instagram.com/kencarson/?__a=1' -ErrorAction Stop; Write-Host 'Full Name:' $r.graphql.user.full_name; Write-Host 'Bio:' $r.graphql.user.biography; Write-Host 'Posts:' $r.graphql.user.edge_owner_to_timeline_media.count }catch{ Write-Host '[ERROR] Profile private or not found' } }"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "& { try{ $r=Invoke-RestMethod -Uri 'https://www.instagram.com/realvaeric/?__a=1' -ErrorAction Stop; Write-Host 'Full Name:' $r.graphql.user.full_name; Write-Host 'Bio:' $r.graphql.user.biography; Write-Host 'Posts:' $r.graphql.user.edge_owner_to_timeline_media.count }catch{ Write-Host '[ERROR] Profile private or not found' } }"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2384
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "& { try{ $r=Invoke-WebRequest -Uri 'https://rivalscheats.shop' -TimeoutSec 5 -ErrorAction Stop; $r.Content | Out-File -FilePath 'cloned_rivalscheats.shop\index.html'; $r.Links | ForEach-Object { if($_.href -match '\.(css|js|png|jpg|jpeg|gif|svg|ico)$'){ $asset=$_.href; if($asset -match '^http'){ $name=Split-Path $asset -Leaf; Invoke-WebRequest -Uri $asset -OutFile \"cloned_rivalscheats.shop\$name\" -ErrorAction SilentlyContinue } } } }catch{ Write-Host '[ERROR] Clone failed' } }"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4244
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "& { try{ $r=Invoke-RestMethod -Uri 'http://apilayer.net/api/validate?access_key=demo&number=+1 (239)408-6537' -ErrorAction Stop; Write-Host 'Country:' $r.country_name; Write-Host 'Carrier:' $r.carrier; Write-Host 'Location:' $r.location }catch{ Write-Host '[ERROR] Lookup failed' } }"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1900

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 202dc32a0e422f00cab2b05aed1e0d8dc453a3e569c54e436c53d3094913c0d5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 ab746941d93883c7765ed92c80ac9c1485f8bc993d43a6a4964bec0162b0a154
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 95826e61c4eee2bb8c97664753d02f064dd6ee11de70d47901c6e18981ff707c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 fc7ed6b556e14afc0995fb1347740dccbacdb9d01d68b2891adea3903501f65f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_rl4uariw.t5i.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rl4uariw.t5i.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2540-3-0x0000021350B90000-0x0000021350BB2000-memory.dmp
          Download

          memory/2540-11-0x000002134EB10000-0x000002134EB20000-memory.dmp
          Download

          memory/2540-12-0x000002134EB10000-0x000002134EB20000-memory.dmp
          Download

          memory/2540-1-0x000002134EB10000-0x000002134EB20000-memory.dmp
          Download

          memory/2540-2-0x000002134EB10000-0x000002134EB20000-memory.dmp
          Download

          memory/4100-17-0x000001BE8B440000-0x000001BE8B450000-memory.dmp
          Download

          memory/4100-16-0x000001BE8B440000-0x000001BE8B450000-memory.dmp
          Download

          memory/4100-26-0x000001BEA6650000-0x000001BEA6812000-memory.dmp
          Download