Analysis
- max time kernel
148s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
01/04/2026, 12:30
General
- Target d2e8bdf1cc427f6311d2ae6561ef78e5f52ea7f79ab8d14ed352fce401e3d353.ps1
- Size 51KB
- Sample260401-ppldesfw5t
- SHA256 d2e8bdf1cc427f6311d2ae6561ef78e5f52ea7f79ab8d14ed352fce401e3d353
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 17 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d2e8bdf1cc427f6311d2ae6561ef78e5f52ea7f79ab8d14ed352fce401e3d353.ps11⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\puijm_hewlw7o_upd_hujz\filezilla.exe"C:\Users\Admin\AppData\Local\puijm_hewlw7o_upd_hujz\filezilla.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\GoFlyDrv.sysC:\Users\Admin\AppData\Local\Temp\GoFlyDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GoFlyDrv.sys
__PSScriptPolicyTest_dp4py004.ezq.ps1
ggfjoot_lawaka_pttnuh.zip
filezilla.exe
libfilezilla-50.dll
libfzclient-commonui-private-3-69-5.dll
libfzclient-private-3-69-5.dll
libgcc_s_seh-1.dll
libgmp-10.dll
libgnutls-30.dll
libhogweed-6.dll
libnettle-8.dll
libpng16-16.dll
libsqlite3-0.dll
libstdc++-6.dll
wxbase32u_gcc_custom.dll
wxbase32u_xml_gcc_custom.dll
wxmsw32u_aui_gcc_custom.dll
wxmsw32u_core_gcc_custom.dll
wxmsw32u_xrc_gcc_custom.dll
zlib1.dll
memory/1424-22-0x00000150C3050000-0x00000150C3060000-memory.dmp
memory/1424-24-0x00000150DD250000-0x00000150DD25A000-memory.dmp
memory/1424-33-0x00000150C3050000-0x00000150C3060000-memory.dmp
memory/1424-32-0x00000150C3050000-0x00000150C3060000-memory.dmp
memory/1424-30-0x00007FF40CA10000-0x00007FF40CA20000-memory.dmp
memory/1424-29-0x00000150C49B0000-0x00000150C49C2000-memory.dmp
memory/1424-28-0x00000150C3070000-0x00000150C307C000-memory.dmp
memory/1424-27-0x00000150C3050000-0x00000150C3060000-memory.dmp
memory/1424-26-0x00000150C3050000-0x00000150C3060000-memory.dmp
memory/1424-145-0x00000150C3070000-0x00000150C307C000-memory.dmp
memory/1424-25-0x00000150C3050000-0x00000150C3060000-memory.dmp
memory/1424-37-0x00000150DD280000-0x00000150DD292000-memory.dmp
memory/1424-23-0x00000150C3050000-0x00000150C3060000-memory.dmp
memory/1424-21-0x00000150DD5D0000-0x00000150DD5F4000-memory.dmp
memory/1424-20-0x00000150DD5D0000-0x00000150DD5FA000-memory.dmp
memory/1424-19-0x00000150DD270000-0x00000150DD27A000-memory.dmp
memory/1424-18-0x00000150DD510000-0x00000150DD5C3000-memory.dmp
memory/1424-1-0x00000150C3050000-0x00000150C3060000-memory.dmp
memory/1424-17-0x00000150DD250000-0x00000150DD26C000-memory.dmp
memory/1424-10-0x00007FF40CA10000-0x00007FF40CA20000-memory.dmp
memory/1424-9-0x00000150C3050000-0x00000150C3060000-memory.dmp
memory/1424-4-0x00000150DCF50000-0x00000150DCF72000-memory.dmp
memory/1424-0-0x00000150C3050000-0x00000150C3060000-memory.dmp
memory/2708-140-0x0000000180000000-0x0000000180358000-memory.dmp
memory/2708-196-0x0000000068970000-0x00000000689AF000-memory.dmp
memory/2708-147-0x00007FFBAA580000-0x00007FFBAA789000-memory.dmp
memory/2708-148-0x00007FFBA8670000-0x00007FFBA872D000-memory.dmp
memory/2708-149-0x00007FFBAA2C0000-0x00007FFBAA36E000-memory.dmp
memory/2708-152-0x000001366B0B0000-0x000001366B428000-memory.dmp
memory/2708-153-0x00007FFBA9110000-0x00007FFBA91E6000-memory.dmp
memory/2708-151-0x00007FFBA8870000-0x00007FFBA901E000-memory.dmp
memory/2708-150-0x00007FFBAA3A0000-0x00007FFBAA53A000-memory.dmp
memory/2708-141-0x0000000180000000-0x0000000180358000-memory.dmp
memory/2708-330-0x0000000180000000-0x0000000180358000-memory.dmp
memory/2708-199-0x000001366B0B0000-0x000001366B428000-memory.dmp
memory/2708-185-0x00007FFB7F750000-0x00007FFB7F7D5000-memory.dmp
memory/2708-182-0x00007FF7B2390000-0x00007FF7B27B4000-memory.dmp
memory/2708-192-0x00007FFB81EE0000-0x00007FFB81F29000-memory.dmp
memory/2708-198-0x00007FFB7EA50000-0x00007FFB7EBB7000-memory.dmp
memory/2708-197-0x00007FFB7EBC0000-0x00007FFB7EDD8000-memory.dmp
memory/2708-139-0x00007FF7B2390000-0x00007FF7B27B4000-memory.dmp
memory/2708-195-0x00000000689B0000-0x00000000689D9000-memory.dmp
memory/2708-194-0x00007FFB83EF0000-0x00007FFB83F30000-memory.dmp
memory/2708-193-0x00007FFB7EE20000-0x00007FFB7EE76000-memory.dmp
memory/2708-191-0x00007FFB7F170000-0x00007FFB7F680000-memory.dmp
memory/2708-190-0x00007FFB7EE80000-0x00007FFB7EF24000-memory.dmp
memory/2708-189-0x00007FFB7EF30000-0x00007FFB7F161000-memory.dmp
memory/2708-188-0x00007FFB99750000-0x00007FFB9977B000-memory.dmp
memory/2708-186-0x00007FFB7F680000-0x00007FFB7F74A000-memory.dmp
memory/2708-184-0x00007FFB7F7E0000-0x00007FFB7F9B0000-memory.dmp
memory/2708-183-0x00007FFB7F9B0000-0x00007FFB7FAB3000-memory.dmp
memory/2708-187-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/3296-181-0x00000000056C0000-0x0000000005726000-memory.dmp
memory/3296-160-0x0000000005480000-0x000000000556A000-memory.dmp
memory/3296-202-0x0000000006480000-0x0000000006512000-memory.dmp
memory/3296-203-0x0000000006AD0000-0x0000000007076000-memory.dmp
memory/3296-159-0x0000000000400000-0x00000000004B2000-memory.dmp