Analysis
- max time kernel
149s - max time network
144s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
01/04/2026, 12:30
General
- Target 784e7ec599e5932974bacbbdba5a85cd71ff9cf17342a4cb13289ae830f092fc.ps1
- Size 52KB
- Sample260401-ppln7afw5x
- SHA256 784e7ec599e5932974bacbbdba5a85cd71ff9cf17342a4cb13289ae830f092fc
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 17 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\784e7ec599e5932974bacbbdba5a85cd71ff9cf17342a4cb13289ae830f092fc.ps11⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\mpmngwmcn_akxi_upd_ikelr\filezilla.exe"C:\Users\Admin\AppData\Local\mpmngwmcn_akxi_upd_ikelr\filezilla.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\GoFlyDrv.sysC:\Users\Admin\AppData\Local\Temp\GoFlyDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GoFlyDrv.sys
__PSScriptPolicyTest_s4m1w5sv.ove.ps1
tzz_axevug_ptykt_.zip
filezilla.exe
libfilezilla-50.dll
libfzclient-commonui-private-3-69-5.dll
libfzclient-private-3-69-5.dll
libgcc_s_seh-1.dll
libgmp-10.dll
libgnutls-30.dll
libhogweed-6.dll
libnettle-8.dll
libpng16-16.dll
libsqlite3-0.dll
libstdc++-6.dll
wxbase32u_gcc_custom.dll
wxbase32u_xml_gcc_custom.dll
wxmsw32u_aui_gcc_custom.dll
wxmsw32u_core_gcc_custom.dll
wxmsw32u_xrc_gcc_custom.dll
zlib1.dll
memory/232-162-0x0000000000600000-0x00000000006B2000-memory.dmp
memory/232-163-0x0000000005040000-0x000000000512A000-memory.dmp
memory/232-184-0x0000000005260000-0x00000000052C6000-memory.dmp
memory/232-204-0x0000000006050000-0x00000000060E2000-memory.dmp
memory/232-205-0x00000000066A0000-0x0000000006C46000-memory.dmp
memory/232-206-0x0000000000AB0000-0x0000000000AD5000-memory.dmp
memory/232-207-0x0000000004D00000-0x0000000004E4D000-memory.dmp
memory/3048-31-0x00007FF474630000-0x00007FF474640000-memory.dmp
memory/3048-19-0x0000020621320000-0x000002062132A000-memory.dmp
memory/3048-1-0x0000020620C90000-0x0000020620CA0000-memory.dmp
memory/3048-147-0x0000020608640000-0x00000206086EF000-memory.dmp
memory/3048-146-0x0000020606D30000-0x0000020606D3C000-memory.dmp
memory/3048-39-0x0000020621340000-0x0000020621352000-memory.dmp
memory/3048-34-0x0000020620C90000-0x0000020620CA0000-memory.dmp
memory/3048-33-0x0000020620C90000-0x0000020620CA0000-memory.dmp
memory/3048-0-0x0000020620C90000-0x0000020620CA0000-memory.dmp
memory/3048-30-0x0000020608590000-0x00000206085A2000-memory.dmp
memory/3048-29-0x0000020608640000-0x00000206086EF000-memory.dmp
memory/3048-8-0x0000020620C60000-0x0000020620C82000-memory.dmp
memory/3048-28-0x0000020606D30000-0x0000020606D3C000-memory.dmp
memory/3048-27-0x0000020620C90000-0x0000020620CA0000-memory.dmp
memory/3048-26-0x0000020620C90000-0x0000020620CA0000-memory.dmp
memory/3048-25-0x0000020620C90000-0x0000020620CA0000-memory.dmp
memory/3048-24-0x0000020621240000-0x000002062124A000-memory.dmp
memory/3048-23-0x0000020620C90000-0x0000020620CA0000-memory.dmp
memory/3048-22-0x0000020620C90000-0x0000020620CA0000-memory.dmp
memory/3048-21-0x0000020621360000-0x0000020621384000-memory.dmp
memory/3048-9-0x0000020620C90000-0x0000020620CA0000-memory.dmp
memory/3048-10-0x00007FF474630000-0x00007FF474640000-memory.dmp
memory/3048-17-0x0000020621240000-0x000002062125C000-memory.dmp
memory/3048-18-0x0000020621260000-0x0000020621313000-memory.dmp
memory/3048-20-0x0000020621360000-0x000002062138A000-memory.dmp
memory/4716-192-0x00007FFD52CA0000-0x00007FFD531B0000-memory.dmp
memory/4716-152-0x00007FFD7D390000-0x00007FFD7D43E000-memory.dmp
memory/4716-155-0x00007FFD7BFA0000-0x00007FFD7C318000-memory.dmp
memory/4716-140-0x00007FF6C3AE0000-0x00007FF6C3F04000-memory.dmp
memory/4716-150-0x00007FFD7DFE0000-0x00007FFD7E1E9000-memory.dmp
memory/4716-154-0x00007FFD7C330000-0x00007FFD7CADE000-memory.dmp
memory/4716-186-0x00007FFD53650000-0x00007FFD53753000-memory.dmp
memory/4716-194-0x00007FFD52BF0000-0x00007FFD52C94000-memory.dmp
memory/4716-201-0x0000000077BD0000-0x0000000077C0F000-memory.dmp
memory/4716-200-0x00007FFD57FF0000-0x00007FFD58030000-memory.dmp
memory/4716-199-0x0000000077C10000-0x0000000077C39000-memory.dmp
memory/4716-197-0x00007FFD63590000-0x00007FFD635E6000-memory.dmp
memory/4716-151-0x00007FFD7D620000-0x00007FFD7D6DD000-memory.dmp
memory/4716-195-0x00007FFD529B0000-0x00007FFD52BE1000-memory.dmp
memory/4716-156-0x00007FFD7CAE0000-0x00007FFD7CBB6000-memory.dmp
memory/4716-191-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/4716-190-0x00007FFD531B0000-0x00007FFD5327A000-memory.dmp
memory/4716-189-0x00007FFD53280000-0x00007FFD53305000-memory.dmp
memory/4716-188-0x00007FFD53310000-0x00007FFD534E0000-memory.dmp
memory/4716-187-0x00007FFD534E0000-0x00007FFD53647000-memory.dmp
memory/4716-196-0x00007FFD65500000-0x00007FFD65549000-memory.dmp
memory/4716-185-0x00007FF6C3AE0000-0x00007FF6C3F04000-memory.dmp
memory/4716-198-0x00007FFD52790000-0x00007FFD529A8000-memory.dmp
memory/4716-193-0x00007FFD65550000-0x00007FFD6557B000-memory.dmp
memory/4716-153-0x00007FFD7DD30000-0x00007FFD7DECA000-memory.dmp
memory/4716-129-0x0000000180000000-0x0000000180358000-memory.dmp
memory/4716-145-0x0000000180000000-0x0000000180358000-memory.dmp
memory/4716-339-0x0000000180000000-0x0000000180358000-memory.dmp