Analysis
- max time kernel
148s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
09/10/2025, 14:13
General
- Target 3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925.exe
- Size 1.1MB
- Sample251009-rjnmpseq4v
- SHA256 3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925
Malware Config
Signatures
- Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925.exe"C:\Users\Admin\AppData\Local\Temp\3cc80c52c15d1a5da944d8bd2eedc33e602f94ff3e8a59679b0f2d19a2cb6925.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Ariose=GC -raw 'C:\Users\Admin\AppData\Roaming\guldsmedenes\Konterer.Uds';$Augmentets=$Ariose.SubString(52659,3);$Gastnderes++; .$Augmentets($Ariose)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tthxgbfb.xgc.ps1
Datofunktion.Hng
Konterer.Uds
memory/3052-83-0x00000000008E0000-0x0000000001BF7000-memory.dmp
memory/3948-52-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/3948-24-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/3948-30-0x0000000006120000-0x0000000006186000-memory.dmp
memory/3948-28-0x00000000058D0000-0x00000000058F2000-memory.dmp
memory/3948-39-0x0000000006300000-0x0000000006657000-memory.dmp
memory/3948-40-0x0000000006670000-0x000000000668E000-memory.dmp
memory/3948-41-0x00000000066C0000-0x000000000670C000-memory.dmp
memory/3948-42-0x00000000077C0000-0x0000000007856000-memory.dmp
memory/3948-43-0x0000000007740000-0x000000000775A000-memory.dmp
memory/3948-44-0x0000000007790000-0x00000000077B2000-memory.dmp
memory/3948-45-0x0000000007ED0000-0x0000000008476000-memory.dmp
memory/3948-27-0x0000000005AF0000-0x000000000611A000-memory.dmp
memory/3948-47-0x0000000008B00000-0x000000000917A000-memory.dmp
memory/3948-48-0x000000007F650000-0x000000007F660000-memory.dmp
memory/3948-49-0x0000000007A80000-0x0000000007AB4000-memory.dmp
memory/3948-56-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/3948-62-0x0000000007AF0000-0x0000000007B94000-memory.dmp
memory/3948-61-0x0000000007AC0000-0x0000000007ADE000-memory.dmp
memory/3948-29-0x0000000005A70000-0x0000000005AD6000-memory.dmp
memory/3948-50-0x000000006F9A0000-0x000000006F9EC000-memory.dmp
memory/3948-66-0x0000000007DC0000-0x0000000007DD5000-memory.dmp
memory/3948-64-0x0000000007D70000-0x0000000007D81000-memory.dmp
memory/3948-65-0x0000000007DA0000-0x0000000007DAE000-memory.dmp
memory/3948-63-0x0000000007BF0000-0x0000000007BFA000-memory.dmp
memory/3948-67-0x0000000007E00000-0x0000000007E1A000-memory.dmp
memory/3948-68-0x0000000007DF0000-0x0000000007DF8000-memory.dmp
memory/3948-69-0x0000000007E10000-0x0000000007E3A000-memory.dmp
memory/3948-70-0x0000000007E70000-0x0000000007E94000-memory.dmp
memory/3948-72-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/3948-71-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/3948-74-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/3948-26-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/3948-76-0x00000000084F0000-0x00000000084F2000-memory.dmp
memory/3948-77-0x0000000009180000-0x000000000F058000-memory.dmp
memory/3948-78-0x000000007F650000-0x000000007F660000-memory.dmp
memory/3948-80-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/3948-79-0x00000000054B0000-0x00000000054C0000-memory.dmp
memory/3948-81-0x00000000084F0000-0x00000000084F2000-memory.dmp
memory/3948-25-0x00000000033D0000-0x0000000003406000-memory.dmp