Analysis
- max time kernel
148s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
03/10/2026, 08:55
General
- Target InvoiceV.bat
- Size 838KB
- Sample261003-kvmffswxct
- SHA256 ef5d2824c5dac3c5ece40fd49feea1e483abd1279a178f4bcba70474f13e0870
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Payload decoded via CertUtil.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\InvoiceV.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\where.exewhere certutil2⤵
-
-
C:\Windows\system32\findstr.exefindstr /B /C:"::E2B64:" "C:\Users\Admin\AppData\Local\Temp\InvoiceV.bat"2⤵
-
-
C:\Windows\system32\certutil.execertutil -f -decode "C:\Users\Admin\AppData\Local\Temp\e2b_1552920013.b64" "C:\Users\Admin\AppData\Local\Temp\e2b_324053700.exe"2⤵
- Deobfuscate/Decode Files or Information
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\e2b_324053700.exe" SHA2562⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\e2b_324053700.exe" SHA2563⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\e2b_324053700.exe"C:\Users\Admin\AppData\Local\Temp\e2b_324053700.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBJAG4AdgBvAGkAYwBlAFYALgBlAHgAZQAnACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEkAbgB2AG8AaQBjAGUAVgAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_2ed0121g.wqx.ps1
e2b_1552920013.b64
e2b_324053700.exe
memory/2388-26-0x0000000002520000-0x0000000002556000-memory.dmp
memory/2388-27-0x0000000004BF0000-0x0000000005218000-memory.dmp
memory/2388-28-0x0000000005350000-0x0000000005372000-memory.dmp
memory/2388-30-0x00000000054D0000-0x0000000005536000-memory.dmp
memory/2388-29-0x00000000053F0000-0x0000000005456000-memory.dmp
memory/2388-37-0x0000000005540000-0x0000000005894000-memory.dmp
memory/2388-39-0x0000000005B60000-0x0000000005B7E000-memory.dmp
memory/2388-40-0x0000000005BF0000-0x0000000005C3C000-memory.dmp
memory/2388-41-0x0000000006120000-0x0000000006152000-memory.dmp
memory/2388-42-0x00000000701C0000-0x000000007020C000-memory.dmp
memory/2388-50-0x0000000006160000-0x000000000617E000-memory.dmp
memory/2388-51-0x0000000006DC0000-0x0000000006E63000-memory.dmp
memory/2388-52-0x00000000074F0000-0x0000000007B6A000-memory.dmp
memory/2388-53-0x0000000006EA0000-0x0000000006EBA000-memory.dmp
memory/2388-54-0x0000000006F00000-0x0000000006F0A000-memory.dmp
memory/2388-55-0x0000000007110000-0x00000000071A6000-memory.dmp
memory/2388-56-0x00000000070B0000-0x00000000070C1000-memory.dmp
memory/4900-23-0x0000000000FA0000-0x0000000001030000-memory.dmp
memory/4900-24-0x0000000005A10000-0x0000000005A48000-memory.dmp
memory/4900-25-0x0000000005B50000-0x0000000005BBC000-memory.dmp
memory/4900-62-0x0000000007530000-0x00000000075C2000-memory.dmp
memory/4900-63-0x0000000007B80000-0x0000000008124000-memory.dmp
memory/4900-64-0x0000000008130000-0x00000000081BE000-memory.dmp
memory/4900-94-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-82-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-182-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-174-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-170-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-160-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-150-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-146-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-138-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-134-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-130-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-122-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-118-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-114-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-100-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-99-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-96-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-92-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-90-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-88-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-86-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-84-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-80-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-76-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-74-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-72-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-70-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-68-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-66-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-65-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-78-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-190-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-188-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-187-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-184-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-180-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-178-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-176-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-172-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-168-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-166-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-165-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-162-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-158-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-156-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-154-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-152-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-148-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-144-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-142-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-140-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-136-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-132-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-128-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-126-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-124-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-120-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-116-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-112-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-110-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-108-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-106-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-105-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-102-0x0000000008130000-0x00000000081B7000-memory.dmp
memory/4900-2341-0x00000000072A0000-0x00000000072AA000-memory.dmp
memory/4900-2342-0x0000000007310000-0x00000000073EA000-memory.dmp
memory/4900-5495-0x0000000008970000-0x0000000008A42000-memory.dmp
memory/4900-6092-0x0000000008A40000-0x0000000008B12000-memory.dmp