Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 10:47
General
- Target a2595f31c0eb387595223d187d0e3cc18e86fd4e130b7bdc6961ddf4b654cc91.ps1
- Size 53KB
- Sample260415-mvndvsb18k
- SHA256 a2595f31c0eb387595223d187d0e3cc18e86fd4e130b7bdc6961ddf4b654cc91
Malware Config
Signatures
- Badlisted process makes network request 15 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a2595f31c0eb387595223d187d0e3cc18e86fd4e130b7bdc6961ddf4b654cc91.ps11⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\qgivkmiii4_cyk2_upd_aku\psl.exe"C:\Users\Admin\AppData\Local\qgivkmiii4_cyk2_upd_aku\psl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\qgivkmiii4_cyk2_upd_aku\psl.exe"C:\Users\Admin\AppData\Local\qgivkmiii4_cyk2_upd_aku\psl.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\xkpsm.sysC:\Windows\Temp\xkpsm.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\Users\Admin\AppData\Roaming\SystemsContrcheck" & "C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe"C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AddInProcess32.exe.log
__PSScriptPolicyTest_v0d4zdtn.eji.ps1
zersjpq__ptgihf.zip
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msys-2.0.dll
msys-iconv-2.dll
msys-idn2-0.dll
msys-intl-8.dll
msys-psl-5.dll
msys-unistring-5.dll
psl.exe
log_20260415_114902.txt
log_20260415_114902.txt
log_20260415_114912.txt
log_20260415_114912.txt
log_20260415_114926.txt
log_20260415_114926.txt
xkpsm.sys
memory/1628-129-0x0000000000010000-0x0000000000018000-memory.dmp
memory/2380-83-0x00007FFDA67B0000-0x00007FFDA69A5000-memory.dmp
memory/2380-87-0x00007FFDA6410000-0x00007FFDA6765000-memory.dmp
memory/2380-86-0x00007FFDA60F0000-0x00007FFDA621A000-memory.dmp
memory/2380-84-0x00007FFDA4AC0000-0x00007FFDA4B7E000-memory.dmp
memory/2380-85-0x00007FFDA6040000-0x00007FFDA60EC000-memory.dmp
memory/2380-155-0x00007FF70E4C0000-0x00007FF70E4D5000-memory.dmp
memory/2380-80-0x0000000180000000-0x0000000180289000-memory.dmp
memory/3384-15-0x000001EF30680000-0x000001EF306D5000-memory.dmp
memory/3384-14-0x000001EF4A660000-0x000001EF4A670000-memory.dmp
memory/3384-17-0x000001EF4A660000-0x000001EF4A670000-memory.dmp
memory/3384-16-0x000001EF31EF0000-0x000001EF31EFC000-memory.dmp
memory/3384-26-0x000001EF4AB60000-0x000001EF4AB72000-memory.dmp
memory/3384-13-0x000001EF4A660000-0x000001EF4A670000-memory.dmp
memory/3384-0-0x000001EF4A660000-0x000001EF4A670000-memory.dmp
memory/3384-20-0x000001EF4AA00000-0x000001EF4AA0A000-memory.dmp
memory/3384-290-0x000001EF30680000-0x000001EF306D5000-memory.dmp
memory/3384-291-0x000001EF31EF0000-0x000001EF31EFC000-memory.dmp
memory/3384-1-0x000001EF4A660000-0x000001EF4A670000-memory.dmp
memory/3384-8-0x000001EF4A770000-0x000001EF4A792000-memory.dmp
memory/3384-10-0x000001EF4A660000-0x000001EF4A670000-memory.dmp
memory/3384-208-0x000001EF30680000-0x000001EF306D5000-memory.dmp
memory/3384-11-0x000001EF4AB90000-0x000001EF4ABBA000-memory.dmp
memory/3384-12-0x000001EF4AB90000-0x000001EF4ABB4000-memory.dmp
memory/3516-162-0x00007FFDA4AC0000-0x00007FFDA4B7E000-memory.dmp
memory/3516-163-0x00007FFDA6040000-0x00007FFDA60EC000-memory.dmp
memory/3516-164-0x00007FFDA60F0000-0x00007FFDA621A000-memory.dmp
memory/3516-165-0x00007FFDA6410000-0x00007FFDA6765000-memory.dmp
memory/3516-161-0x00007FFDA67B0000-0x00007FFDA69A5000-memory.dmp
memory/3516-134-0x0000000180000000-0x0000000180289000-memory.dmp
memory/3516-201-0x00007FF6C9950000-0x00007FF6C9965000-memory.dmp
memory/3788-275-0x00007FF70E4C0000-0x00007FF70E4D5000-memory.dmp
memory/3788-219-0x00007FFDA6410000-0x00007FFDA6765000-memory.dmp
memory/3788-207-0x0000000180000000-0x0000000180289000-memory.dmp
memory/3788-217-0x00007FFDA6040000-0x00007FFDA60EC000-memory.dmp
memory/3788-216-0x00007FFDA4AC0000-0x00007FFDA4B7E000-memory.dmp
memory/3788-215-0x00007FFDA67B0000-0x00007FFDA69A5000-memory.dmp
memory/3788-218-0x00007FFDA60F0000-0x00007FFDA621A000-memory.dmp
memory/4148-277-0x0000000004D20000-0x0000000004D7F000-memory.dmp
memory/4148-211-0x0000000004D20000-0x0000000004D7F000-memory.dmp
memory/4332-156-0x0000000005CA0000-0x0000000005D06000-memory.dmp
memory/4332-159-0x00000000068E0000-0x0000000006972000-memory.dmp
memory/4332-154-0x0000000005AC0000-0x0000000005B9C000-memory.dmp
memory/4332-203-0x0000000005820000-0x000000000587F000-memory.dmp
memory/4332-204-0x0000000006B10000-0x0000000006BE3000-memory.dmp
memory/4332-153-0x00000000058F0000-0x0000000005950000-memory.dmp
memory/4332-152-0x0000000001220000-0x0000000001296000-memory.dmp
memory/4332-160-0x0000000006F30000-0x00000000074D4000-memory.dmp
memory/5024-285-0x0000000005480000-0x00000000054DF000-memory.dmp
memory/5024-293-0x0000000005480000-0x00000000054DF000-memory.dmp