Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
01/04/2026, 12:30
General
- Target 784e7ec599e5932974bacbbdba5a85cd71ff9cf17342a4cb13289ae830f092fc.ps1
- Size 52KB
- Sample260401-ppln7afw5x
- SHA256 784e7ec599e5932974bacbbdba5a85cd71ff9cf17342a4cb13289ae830f092fc
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 19 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\784e7ec599e5932974bacbbdba5a85cd71ff9cf17342a4cb13289ae830f092fc.ps11⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\mpmngwmcn_akxi_upd_ikelr\filezilla.exe"C:\Users\Admin\AppData\Local\mpmngwmcn_akxi_upd_ikelr\filezilla.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\GoFlyDrv.sysC:\Users\Admin\AppData\Local\Temp\GoFlyDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GoFlyDrv.sys
__PSScriptPolicyTest_4j0lw2jy.4kr.ps1
tzz_axevug_ptykt_.zip
filezilla.exe
libfilezilla-50.dll
libfzclient-commonui-private-3-69-5.dll
libfzclient-private-3-69-5.dll
libgcc_s_seh-1.dll
libgmp-10.dll
libgnutls-30.dll
libhogweed-6.dll
libnettle-8.dll
libpng16-16.dll
libsqlite3-0.dll
libstdc++-6.dll
wxbase32u_gcc_custom.dll
wxbase32u_xml_gcc_custom.dll
wxmsw32u_aui_gcc_custom.dll
wxmsw32u_core_gcc_custom.dll
wxmsw32u_xrc_gcc_custom.dll
zlib1.dll
memory/1352-202-0x00000000054E0000-0x000000000555E000-memory.dmp
memory/1352-200-0x0000000006730000-0x0000000006CD4000-memory.dmp
memory/1352-199-0x00000000060E0000-0x0000000006172000-memory.dmp
memory/1352-157-0x0000000000500000-0x00000000005B2000-memory.dmp
memory/1352-201-0x0000000004AE0000-0x0000000004D61000-memory.dmp
memory/1352-196-0x0000000005170000-0x00000000051D6000-memory.dmp
memory/1352-239-0x0000000004AE0000-0x0000000004D61000-memory.dmp
memory/1352-296-0x0000000004AE0000-0x0000000004D61000-memory.dmp
memory/1352-315-0x0000000004AE0000-0x0000000004D61000-memory.dmp
memory/1352-335-0x0000000004AE0000-0x0000000004D61000-memory.dmp
memory/1352-392-0x0000000004AE0000-0x0000000004D61000-memory.dmp
memory/1352-158-0x0000000004F30000-0x000000000501A000-memory.dmp
memory/1660-135-0x00007FF6B7350000-0x00007FF6B7774000-memory.dmp
memory/1660-193-0x00007FF9869D0000-0x00007FF986BE8000-memory.dmp
memory/1660-139-0x0000000180000000-0x0000000180358000-memory.dmp
memory/1660-334-0x0000000180000000-0x0000000180358000-memory.dmp
memory/1660-179-0x00007FF6B7350000-0x00007FF6B7774000-memory.dmp
memory/1660-180-0x00007FF987880000-0x00007FF9879E7000-memory.dmp
memory/1660-181-0x00007FF9876B0000-0x00007FF987880000-memory.dmp
memory/1660-182-0x00007FF9875A0000-0x00007FF9876A3000-memory.dmp
memory/1660-143-0x0000000180000000-0x0000000180358000-memory.dmp
memory/1660-146-0x00007FF9ADAB0000-0x00007FF9ADB6E000-memory.dmp
memory/1660-145-0x00007FF9ADD90000-0x00007FF9ADF85000-memory.dmp
memory/1660-147-0x00007FF9AD180000-0x00007FF9AD22C000-memory.dmp
memory/1660-148-0x00007FF9AC070000-0x00007FF9AC19A000-memory.dmp
memory/1660-149-0x00007FF9AC630000-0x00007FF9ACD6F000-memory.dmp
memory/1660-150-0x00007FF9ACE10000-0x00007FF9AD165000-memory.dmp
memory/1660-151-0x00007FF9AD310000-0x00007FF9AD3DD000-memory.dmp
memory/1660-183-0x00007FF987A70000-0x00007FF987AF5000-memory.dmp
memory/1660-189-0x000000005ECE0000-0x000000005ED09000-memory.dmp
memory/1660-185-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/1660-184-0x00007FF9874D0000-0x00007FF98759A000-memory.dmp
memory/1660-188-0x00007FF986D80000-0x00007FF987290000-memory.dmp
memory/1660-195-0x00007FF986990000-0x00007FF9869D0000-memory.dmp
memory/1660-194-0x000000005ECA0000-0x000000005ECDF000-memory.dmp
memory/1660-186-0x00007FF987A40000-0x00007FF987A6B000-memory.dmp
memory/1660-192-0x00007FF986C20000-0x00007FF986C76000-memory.dmp
memory/1660-191-0x00007FF986C80000-0x00007FF986CC9000-memory.dmp
memory/1660-190-0x00007FF986CD0000-0x00007FF986D74000-memory.dmp
memory/1660-187-0x00007FF987290000-0x00007FF9874C1000-memory.dmp
memory/4412-24-0x00000164CF4E0000-0x00000164CF4EA000-memory.dmp
memory/4412-22-0x00000164CF600000-0x00000164CF62A000-memory.dmp
memory/4412-26-0x00000164CEF80000-0x00000164CEF90000-memory.dmp
memory/4412-23-0x00000164CF600000-0x00000164CF624000-memory.dmp
memory/4412-0-0x00000164CEF80000-0x00000164CEF90000-memory.dmp
memory/4412-28-0x00000164CEF80000-0x00000164CEF90000-memory.dmp
memory/4412-30-0x00007FF4118B0000-0x00007FF4118C0000-memory.dmp
memory/4412-33-0x00000164CF5D0000-0x00000164CF5E2000-memory.dmp
memory/4412-25-0x00000164CEF80000-0x00000164CEF90000-memory.dmp
memory/4412-142-0x00000164B6870000-0x00000164B687C000-memory.dmp
memory/4412-27-0x00000164B6870000-0x00000164B687C000-memory.dmp
memory/4412-21-0x00000164CF4E0000-0x00000164CF4EA000-memory.dmp
memory/4412-20-0x00000164CF510000-0x00000164CF5C5000-memory.dmp
memory/4412-19-0x00000164CF4F0000-0x00000164CF50C000-memory.dmp
memory/4412-11-0x00007FF4118B0000-0x00007FF4118C0000-memory.dmp
memory/4412-10-0x00000164CEF80000-0x00000164CEF90000-memory.dmp
memory/4412-92-0x00000164CEF80000-0x00000164CEF90000-memory.dmp
memory/4412-9-0x00000164CF100000-0x00000164CF122000-memory.dmp
memory/4412-1-0x00000164CEF80000-0x00000164CEF90000-memory.dmp