Overview

overview

7

Static

static

3

INV0987654...at.exe

windows10-2004-x64

7

INV0987654...at.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...gs.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/08/2026, 03:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    INV09876545678HLK.bat.exe
  • Size 604KB
  • Sample260828-dwe97sbf92
  • SHA256 6fd06127cd5573a4f884e3c7a4425f56c1e277109bc86ceabcf57b524afd0075
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INV09876545678HLK.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\INV09876545678HLK.bat.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1068
    • C:\Users\Admin\AppData\Local\Temp\INV09876545678HLK.bat.exe
      "C:\Users\Admin\AppData\Local\Temp\INV09876545678HLK.bat.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3940

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Ball.ini
        • Path C:\Users\Admin\AppData\Local\Temp\Ball.ini
        • Size 78B
        • SHA256 0f3f0d3e271167c35cdc6cc4aeac09fe98b2ad19e8f58c19e0054c7efe8256cc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsy4D03.tmp\System.dll
        • Size 25KB
        • SHA256 a0b9b62ce33d198090426c733e0e36f987555c22a4bc04d677b7496f4e1ed072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1068-11-0x00007FFC1F859000-0x00007FFC1F85A000-memory.dmp
        Download

        memory/1068-15-0x00007FFC1F850000-0x00007FFC1F85F000-memory.dmp
        Download

        memory/1068-39-0x0000000002D00000-0x00000000039C3000-memory.dmp
        Download

        memory/1068-41-0x0000000140000000-0x0000000140134000-memory.dmp
        Download

        memory/3940-40-0x0000000000080000-0x000000000014B000-memory.dmp
        Download

        memory/3940-43-0x0000000140000000-0x0000000141677000-memory.dmp
        Download

        memory/3940-45-0x00007FFC29FE9000-0x00007FFC29FEB000-memory.dmp
        Download