Analysis
- user interaction
yes - max time kernel
54s - max time network
34s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
skbidi 3.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
skbidi 3.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target skbidi 3.bat
- Size 711B
- Sample261104-xllh1styev
- SHA256 fab612ae702a162dc20dad083c48d20806f3a0b20395efb2e6c1327d67f7832f
- MD5 ce08fc440c5df16ff94c47c8544c26ef
- SHA1 1a06cb6d15975648f5fb40e30982abe9c0b1e0ff
- SHA512 1a9ab0f985163a4fe6b8d27852f6f29d2548b3d3779f6047f062bccf32d33db706d41470ce1e352919984d1f4f8c09883aa0ad59ade3bf166dbe3d0df0cf58c6
- TLSH T1C4016800155B871223A385B0CB2B3145A85EF2062E2D8C60F762A1E1DDBE244AFFE9E5
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\mountmgr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ramdisk.sys cmd.exe File opened for modification C:\Windows\System32\drivers\udfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\UsbXhciCompanion.dll cmd.exe File opened for modification C:\Windows\System32\drivers\Dumpstorport.sys cmd.exe File opened for modification C:\Windows\System32\drivers\pcw.sys cmd.exe File opened for modification C:\Windows\System32\drivers\SerCx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\appid.sys cmd.exe File opened for modification C:\Windows\System32\drivers\circlass.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rasacd.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Ucx01000.sys cmd.exe File opened for modification C:\Windows\System32\drivers\cmimcext.sys cmd.exe File opened for modification C:\Windows\System32\drivers\errdev.sys cmd.exe File opened for modification C:\Windows\System32\drivers\SleepStudyHelper.sys cmd.exe File opened for modification C:\Windows\System32\drivers\USBSTOR.SYS cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\HidTelephony.dll cmd.exe File opened for modification C:\Windows\System32\drivers\Vid.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ClipSp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\PktMon.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\hdaudbus.sys cmd.exe File opened for modification C:\Windows\System32\drivers\msgpioclx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rasl2tp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbohci.sys cmd.exe File opened for modification C:\Windows\System32\drivers\CmBatt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\http.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\raspptp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tdi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mskssrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rdpbus.sys cmd.exe File opened for modification C:\Windows\System32\drivers\refsv1.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbaudio2.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbcir.sys cmd.exe File opened for modification C:\Windows\System32\drivers\amdppm.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\isapnp.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\NdisImPlatform.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\vhdmp.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\intelide.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\IPMIDRV.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\mshwnclx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Ndu.sys cmd.exe File opened for modification C:\Windows\System32\drivers\processr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\fastfat.sys cmd.exe File opened for modification C:\Windows\System32\drivers\hidspi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\hyperkbd.sys cmd.exe File opened for modification C:\Windows\System32\drivers\portcfg.sys cmd.exe File opened for modification C:\Windows\System32\drivers\wcnfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\wfplwfs.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\bthport.sys cmd.exe File opened for modification C:\Windows\System32\drivers\portcls.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\SMCCx.dll cmd.exe File opened for modification C:\Windows\System32\drivers\hidbatt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mrxsmb.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mup.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ndiscap.sys cmd.exe File opened for modification C:\Windows\System32\drivers\NdisVirtualBus.sys cmd.exe File opened for modification C:\Windows\System32\drivers\RNDISMP.sys cmd.exe File opened for modification C:\Windows\System32\drivers\WindowsTrustedRT.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Dmpusbstor.sys cmd.exe File opened for modification C:\Windows\System32\drivers\dumpsd.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ipfltdrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys cmd.exe File opened for modification C:\Windows\System32\drivers\msiscsi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\pcmcia.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\hidir.sys cmd.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BITLOC~1\autorun.inf cmd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\easinvoker.proxystub.dll cmd.exe File opened for modification C:\Windows\System32\Configuration\BaseRegistration\es-ES\MSFT_MetaConfigurationExtensionClasses.Schema.mfl cmd.exe File opened for modification C:\Windows\System32\de-DE\azsqlext.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-GB\comctl32.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\netjoin.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\offFilt.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\pnidui.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\csrsrv.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\EnterpriseAppMgmtSvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\faultrep.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\eFE5b32e.sys cmd.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\c_smrdisk.inf_loc cmd.exe File opened for modification C:\Windows\System32\dsc\ja-JP\DscCoreR.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\wercplsupport.dll.mui cmd.exe File opened for modification C:\Windows\System32\energytask.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\netrtwlans.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\ws3cap.inf_loc cmd.exe File opened for modification C:\Windows\System32\efswrt.dll cmd.exe File opened for modification C:\Windows\System32\es-ES\advapi32res.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\wcncsvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\XboxNetApiSvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\fhcfg.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\netrass.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\qd3x64.inf_loc cmd.exe File opened for modification C:\Windows\System32\es-ES\powercfg.exe.mui cmd.exe File opened for modification C:\Windows\System32\config\SYSTEM cmd.exe File opened for modification C:\Windows\System32\de-DE\CompMgmtLauncher.exe.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\netr28ux.sys cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wstorvsc.inf_amd64_50cb8ebb1c9584af\storvsc.sys cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\wvmic.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\advapi32.dll.mui cmd.exe File opened for modification C:\Windows\System32\autofmt.exe cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\c_fssystem.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\nvdimm.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\Amd64\MSMPS.xml cmd.exe File opened for modification C:\Windows\System32\F12\es-ES\F12Script.dll.mui cmd.exe File opened for modification C:\Windows\System32\cryptnet.dll cmd.exe File opened for modification C:\Windows\System32\de-DE\iassvcs.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\netvg63a.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_ar6320_3p0_NFA344A_power1213_DE_0410.bin cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.inf cmd.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\netvg63a.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\ndisuio.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA425_olpc_SS_S.bin cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\USBXHC~1.INF\UsbXhciCompanion.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\xusb22.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\hcproviders.dll.mui cmd.exe File opened for modification C:\Windows\System32\bdaplgin.ax cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_ed209c9a3da66777\mdmsupra.inf cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\wdma_usb.inf_loc cmd.exe File opened for modification C:\Windows\System32\dxtrans.dll cmd.exe File opened for modification C:\Windows\System32\EdgeContent.dll cmd.exe File opened for modification C:\Windows\System32\elsTrans.dll cmd.exe File opened for modification C:\Windows\System32\en-US\workfolderssvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\TSWorkspace.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\sxs.dll.mui cmd.exe File opened for modification C:\Windows\System32\deskadp.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\netl160a.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\netbvbda.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\rdvgwddmdx11.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\errdev.inf_amd64_616c5168a5b1807a\errdev.sys cmd.exe File opened for modification C:\Windows\System32\en-US\Autofmt.exe.mui cmd.exe File opened for modification C:\Windows\System32\en-US\netman.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\WLanConn.dll.mui cmd.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PATCH~1\Managed\1D5E3C~1\100~1.402\F_D2B9~1 cmd.exe File opened for modification C:\Windows\Speech_OneCore\Engines\TTS\fr-FR\M1036Nathalie.heq cmd.exe File opened for modification C:\Windows\Boot\EFI\cs-CZ\bootmgfw.efi.mui cmd.exe File opened for modification C:\Windows\Fonts\monbaiti.ttf cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Web.DynamicData.Design.resources.dll cmd.exe File opened for modification C:\Windows\servicing\Packages\HyperV-Host-Compute-Interop-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat cmd.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Lxss-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1151.cat cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\Microsoft.Transactions.Bridge.resources.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Workflow.Runtime.resources.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\JSC.resources.dll cmd.exe File opened for modification C:\Windows\servicing\Packages\COB639~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\HyperV-Storage-VirtualDevice-PMEM-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.928.cat cmd.exe File opened for modification C:\Windows\servicing\Packages\MIE1B7~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\MI8AF1~1.CAT cmd.exe File opened for modification C:\Windows\Cursors\aero_ew_l.cur cmd.exe File opened for modification C:\Windows\Fonts\s8514sys.fon cmd.exe File opened for modification C:\Windows\INF\genericusbfn.inf cmd.exe File opened for modification C:\Windows\servicing\Packages\HY1932~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-msmq-powershell-Opt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1237.cat cmd.exe File opened for modification C:\Windows\Fonts\smallet.fon cmd.exe File opened for modification C:\Windows\INF\SERVIC~2.0\0C0A\_ServiceModelOperationPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Web.Extensions.resources.dll cmd.exe File opened for modification C:\Windows\servicing\Packages\MIB72A~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\Package_13_for_KB5005699~31bf3856ad364e35~amd64~~19041.1220.1.0.cat cmd.exe File opened for modification C:\Windows\diagnostics\system\Apps\RS_TemporaryProfile.ps1 cmd.exe File opened for modification C:\Windows\Fonts\verdana.ttf cmd.exe File opened for modification C:\Windows\Installer\$PATCH~1\Managed\68AB67~1\157~1.200\Checkers.api cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\Microsoft.CSharp.resources.dll cmd.exe File opened for modification C:\Windows\servicing\Packages\MI193A~1.CAT cmd.exe File opened for modification C:\Windows\Fonts\ega40850.fon cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.OracleClient.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Xaml.resources.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Web.DynamicData.resources.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Web.Extensions.resources.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Transactions.Bridge.Dtc.dll cmd.exe File opened for modification C:\Windows\PolicyDefinitions\AppxPackageManager.admx cmd.exe File opened for modification C:\Windows\diagnostics\system\Power\ja-JP\RS_DisableUSBSelective.psd1 cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\V20~1.507\vbc.exe cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WINDOW~1\es-ES\ServiceModelEvents.dll.mui cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.ServiceModel.Web.resources.dll cmd.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Printing-LPRPortMonitor-Opt-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat cmd.exe File opened for modification C:\Windows\diagnostics\system\WINDOW~3\fr-FR\DiagPackage.dll.mui cmd.exe File opened for modification C:\Windows\Installer\$PATCH~1\Managed\68AB67~1\157~1.200\EScript.api cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.AddIn.resources.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Data.Services.Client.resources.dll cmd.exe File opened for modification C:\Windows\servicing\Packages\MU12D8~1.CAT cmd.exe File opened for modification C:\Windows\Speech_OneCore\Engines\SR\de-DE-N\l1031.wwd cmd.exe File opened for modification C:\Windows\Installer\$PATCH~1\Managed\68AB67~1\157~1.200\_d.x3d cmd.exe File opened for modification C:\Windows\L2Schemas\WWAN_profile_v2.xsd cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WINDOW~1\SMConfigInstaller.exe cmd.exe File opened for modification C:\Windows\PolicyDefinitions\WindowsUpdate.admx cmd.exe File opened for modification C:\Windows\servicing\Packages\Containers-Server-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1202.cat cmd.exe File opened for modification C:\Windows\servicing\Packages\HYF103~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-ShellLauncher-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.844.cat cmd.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-OneDrive-Setup-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat cmd.exe File opened for modification C:\Windows\Boot\PCAT\sr-Latn-RS\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\INF\mdmcodex.inf cmd.exe File opened for modification C:\Windows\Media\Ring06.wav cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\it-IT\PresentationHost_v0400.dll.mui cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\V20~1.507\CONFIG\web.config.default cmd.exe File opened for modification C:\Windows\servicing\Packages\HyperV-IntegrationComponents-VirtualDevice-Server-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat cmd.exe File opened for modification C:\Windows\servicing\Packages\MI8D8D~1.CAT cmd.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3900 cmd.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3900 wrote to memory of 3348 3900 cmd.exe 88
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\skbidi 3.bat"1⤵
- Drops file in Drivers directory
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:3348
-