Analysis
- max time kernel
140s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
skbidi 3.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
skbidi 3.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target skbidi 3.bat
- Size 711B
- Sample261104-xllh1styev
- SHA256 fab612ae702a162dc20dad083c48d20806f3a0b20395efb2e6c1327d67f7832f
- MD5 ce08fc440c5df16ff94c47c8544c26ef
- SHA1 1a06cb6d15975648f5fb40e30982abe9c0b1e0ff
- SHA512 1a9ab0f985163a4fe6b8d27852f6f29d2548b3d3779f6047f062bccf32d33db706d41470ce1e352919984d1f4f8c09883aa0ad59ade3bf166dbe3d0df0cf58c6
- TLSH T1C4016800155B871223A385B0CB2B3145A85EF2062E2D8C60F762A1E1DDBE244AFFE9E5
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\cdrom.sys cmd.exe File opened for modification C:\Windows\System32\drivers\HidSpiCx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usb8023.sys cmd.exe File opened for modification C:\Windows\System32\drivers\netvsc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\TsUsbGD.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ntfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tape.sys cmd.exe File opened for modification C:\Windows\System32\drivers\udfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\WindowsTrustedRTProxy.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mssmbios.sys cmd.exe File opened for modification C:\Windows\System32\drivers\spaceparser.sys cmd.exe File opened for modification C:\Windows\System32\drivers\uaspstor.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vms3cap.sys cmd.exe File opened for modification C:\Windows\System32\drivers\acpials.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\bthport.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\evbda.sys cmd.exe File opened for modification C:\Windows\System32\drivers\spaceport.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mshwnclx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\pacer.sys cmd.exe File opened for modification C:\Windows\System32\drivers\winnat.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\sdbus.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\usbhub.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\serial.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\usbdr.dll cmd.exe File opened for modification C:\Windows\System32\drivers\ztdns.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\NdisImPlatform.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\pciidex.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\MTConfig.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\refsv1.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\WindowsTrustedRT.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\sermouse.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fdc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UsbPmApi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vmstorfl.sys cmd.exe File opened for modification C:\Windows\System32\drivers\netio.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\UsbXhciCompanion.dll cmd.exe File opened for modification C:\Windows\System32\drivers\USBAUDIO.sys cmd.exe File opened for modification C:\Windows\System32\drivers\volsnap.sys cmd.exe File opened for modification C:\Windows\System32\drivers\cimfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\pdc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rassstp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\scfilter.sys cmd.exe File opened for modification C:\Windows\System32\drivers\bindflt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\storqosflt.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\mmcss.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\IddCx.dll cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\PosCx.dll cmd.exe File opened for modification C:\Windows\System32\drivers\usbehci.sys cmd.exe File opened for modification C:\Windows\System32\drivers\WdNisDrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\HvService.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\isapnp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\watchdog.sys cmd.exe File opened for modification C:\Windows\System32\drivers\dumpfve.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\hidbatt.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\intelppm.sys cmd.exe File opened for modification C:\Windows\System32\drivers\nwifi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rasl2tp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\EhStorPwdDrv.dll cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\luafv.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\netbios.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tsusbhub.sys cmd.exe File opened for modification C:\Windows\System32\drivers\asyncmac.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\fvevol.sys.mui cmd.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\wfplwfs.sys.mui cmd.exe - Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\System32\wintrust.dll cmd.exe File opened for modification C:\Windows\SysWOW64\wintrust.dll cmd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\Configuration\Schema\MSFT_FileDirectoryConfiguration\fr-FR\MSFT_FileDirectoryConfiguration.Schema.mfl cmd.exe File opened for modification C:\Windows\System32\C_1047.NLS cmd.exe File opened for modification C:\Windows\System32\es-ES\dxgkrnl.sys.mui cmd.exe File opened for modification C:\Windows\System32\GameInputSvc.exe cmd.exe File opened for modification C:\Windows\System32\HandwritingSystemToastIcon.contrast-white.png cmd.exe File opened for modification C:\Windows\System32\kd_02_14e4.dll cmd.exe File opened for modification C:\Windows\System32\MTFSpellcheckDS.dll cmd.exe File opened for modification C:\Windows\System32\winevt\Logs\MI472A~1.EVT cmd.exe File opened for modification C:\Windows\System32\McpManagementService.dll cmd.exe File opened for modification C:\Windows\System32\wbem\portabledeviceapi.mof cmd.exe File opened for modification C:\Windows\SysWOW64\cscdll.dll cmd.exe File opened for modification C:\Windows\SysWOW64\es-ES\shutdown.exe.mui cmd.exe File opened for modification C:\Windows\SysWOW64\fr-FR\ir41_32original.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\PhotoScreensaver.scr cmd.exe File opened for modification C:\Windows\SysWOW64\setup\RasMigPlugin.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterSriov.cdxml cmd.exe File opened for modification C:\Windows\System32\ci.dll cmd.exe File opened for modification C:\Windows\SysWOW64\batmeter.dll cmd.exe File opened for modification C:\Windows\System32\es-ES\acppage.dll.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\openfiles.exe.mui cmd.exe File opened for modification C:\Windows\System32\it-IT\SimAuth.dll.mui cmd.exe File opened for modification C:\Windows\System32\slmgr.vbs cmd.exe File opened for modification C:\Windows\System32\uk-UA\mmsys.cpl.mui cmd.exe File opened for modification C:\Windows\SysWOW64\PRINTI~1\it-IT\prnport.vbs cmd.exe File opened for modification C:\Windows\System32\de-DE\profext.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\usbhub3.inf_loc cmd.exe File opened for modification C:\Windows\System32\it-IT\userinit.exe.mui cmd.exe File opened for modification C:\Windows\System32\Windows.Web.Diagnostics.dll cmd.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ScheduledTasks\MSFT_ScheduledTask.types.ps1xml cmd.exe File opened for modification C:\Windows\SysWOW64\capauthz.dll cmd.exe File opened for modification C:\Windows\SysWOW64\fr-FR\searchfolder.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\wbem\en\Microsoft.AppV.AppVClientWmi.resources.dll cmd.exe File opened for modification C:\Windows\System32\fr-FR\nettrace.dll.mui cmd.exe File opened for modification C:\Windows\System32\gu-IN\mlang.dll.mui cmd.exe File opened for modification C:\Windows\System32\NgcProCsp.dll cmd.exe File opened for modification C:\Windows\System32\wbem\pcsvDevice_Uninstall.mof cmd.exe File opened for modification C:\Windows\SysWOW64\pt-BR\cdosys.dll.mui cmd.exe File opened for modification C:\Windows\System32\CoreMessaging.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\wvmic_vss.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\AMDI2C.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\rdpbus.inf_loc cmd.exe File opened for modification C:\Windows\System32\fr-FR\g711codc.ax.mui cmd.exe File opened for modification C:\Windows\System32\srvsvc.dll cmd.exe File opened for modification C:\Windows\System32\XboxNetApiSvc.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\c_fsquotamgmt.inf_loc cmd.exe File opened for modification C:\Windows\System32\es-ES\dot3ui.dll.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\bdechangepin.exe.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\UsbTask.dll.mui cmd.exe File opened for modification C:\Windows\System32\ga-IE\comctl32.dll.mui cmd.exe File opened for modification C:\Windows\System32\Microsoft.Uev.SmbSyncProvider.dll cmd.exe File opened for modification C:\Windows\System32\uk-UA\gpscript.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\de-DE\InkObjCore.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_3de64f94f420c01f\Amd64\MSxpsPS.ppd cmd.exe File opened for modification C:\Windows\System32\fr-FR\fdeploy.dll.mui cmd.exe File opened for modification C:\Windows\System32\gb2312.uce cmd.exe File opened for modification C:\Windows\System32\it-IT\wecutil.exe.mui cmd.exe File opened for modification C:\Windows\SysWOW64\rastlsext.dll cmd.exe File opened for modification C:\Windows\System32\de-DE\EventCreate.exe.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\wshtcpip.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\AppleSSD.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\SMBHelperClass.dll.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\EsclWiaDriver.dll.mui cmd.exe File opened for modification C:\Windows\System32\wmpps.dll cmd.exe File opened for modification C:\Windows\SysWOW64\es-ES\modemui.dll.mui cmd.exe - Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll cmd.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\AM741D~1.1_J\HYPER-~1.PSD cmd.exe File opened for modification C:\Windows\servicing\Packages\MIB343~1.MUM cmd.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\Assets\logo.scale-140.png cmd.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Microsoft.Winjs-reduced\css\ui-light.css cmd.exe File opened for modification C:\Windows\servicing\Packages\MID5B1~1.MUM cmd.exe File opened for modification C:\Windows\WinSxS\AMDDA1~1.1_D\PSREXE~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AMF859~1.1_E\diskmgmt.msc cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\fr\Microsoft.JScript.Resources.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Data.Linq.resources.dll cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\V20~1.507\JA\aspnetmmcext.resources.dll cmd.exe File opened for modification C:\Windows\WinSxS\AMBC0C~1.1_N\mdmtdkj4.inf cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.dll cmd.exe File opened for modification C:\Windows\servicing\Packages\HYED26~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\MI7B59~1.CAT cmd.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-black\windows.showhiddenfiles.svg cmd.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-light\windows.searchoptionshallow.svg cmd.exe File opened for modification C:\Windows\diagnostics\system\BITS\es-ES\DiagPackage.dll.mui cmd.exe File opened for modification C:\Windows\PolicyDefinitions\en-US\TextInput.adml cmd.exe File opened for modification C:\Windows\servicing\FODMET~1\metadata\DesktopTargetCompDB_FOD_Neutral.xml cmd.exe File opened for modification C:\Windows\servicing\Packages\MIFE0E~1.MUM cmd.exe File opened for modification C:\Windows\servicing\Packages\MI4A2C~1.MUM cmd.exe File opened for modification C:\Windows\servicing\Packages\RU1037~1.MUM cmd.exe File opened for modification C:\Windows\servicing\Packages\WIN3-D~4.CAT cmd.exe File opened for modification C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\AppxBlockMap.xml cmd.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_contrast-white.png cmd.exe File opened for modification C:\Windows\Resources\Themes\aero\uk-UA\aero.msstyles.mui cmd.exe File opened for modification C:\Windows\servicing\Packages\MIA399~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\MI3257~2.MUM cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AppxSignature.p7x cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars38.scale-200.png cmd.exe File opened for modification C:\Windows\WinSxS\AMF40A~1.1_E\C_INFR~1.INF cmd.exe File opened for modification C:\Windows\WinSxS\AM0400~1.1_D\BASICD~1.INF cmd.exe File opened for modification C:\Windows\WinSxS\AM3400~1.1_E\ACLEDI~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM1C46~1.159\PROVIS~1.SVG cmd.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\StartMenu\assets\strings\et-EE.json cmd.exe File opened for modification C:\Windows\WinSxS\AM629B~1.1_U\AEROLI~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AMD2E6~1.159\r\APPXAL~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AM48CA~1.1_J\DSDBUT~1.MUI cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.ComponentModel.Composition.Registration.resources.dll cmd.exe File opened for modification C:\Windows\servicing\Packages\MI6CDF~1.MUM cmd.exe File opened for modification C:\Windows\WinSxS\AM9EED~1.159\r\MIEFDF~1.DLL cmd.exe File opened for modification C:\Windows\servicing\Packages\MI8594~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\MI8DF4~1.MUM cmd.exe File opened for modification C:\Windows\INF\printupg.inf cmd.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Platformrecords-PlutonFirmware-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\pris\resources.uk-UA.pri cmd.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\Assets\splashscreen.contrast-white_scale-180.png cmd.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\id-ID.json cmd.exe File opened for modification C:\Windows\WinSxS\AMC4C6~1.1_F\ASSIGN~2.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM4D16~1.115\DNSCLI~2.PS1 cmd.exe File opened for modification C:\Windows\servicing\Packages\MIC356~1.CAT cmd.exe File opened for modification C:\Windows\SystemApps\LKG\MICROS~1.SEA\Assets\LockScreenLogo.scale-200.png cmd.exe File opened for modification C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\RibbonToast.scale-150_contrast-white.png cmd.exe File opened for modification C:\Windows\WinSxS\AME6E5~1.1_E\AUDIOS~1.MUI cmd.exe File opened for modification C:\Windows\rescache\_merged\299945~1\360098~1.PRI cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\debugger\images\continue.png cmd.exe File opened for modification C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\SystemSettingsThresholdAdminFlowUI\Assets\Fonts cmd.exe File opened for modification C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\DefaultSystemNotification.scale-100.png cmd.exe File opened for modification C:\Windows\WinSxS\AMBE48~1.1_J\ISCSI~1.INF cmd.exe File opened for modification C:\Windows\WinSxS\AM17D5~1.1_F\BTHPAN~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AMBA79~1.1_F\DEVICE~1.MUI cmd.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ca-ES.json cmd.exe File opened for modification C:\Windows\WinSxS\AMA346~1.130\r\appwiz.cpl cmd.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.26100.1742.cat cmd.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1236 cmd.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1236 wrote to memory of 5776 1236 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\skbidi 3.bat"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Windows directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:5776
-