Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 10:47
General
- Target a2595f31c0eb387595223d187d0e3cc18e86fd4e130b7bdc6961ddf4b654cc91.ps1
- Size 53KB
- Sample260415-mvndvsb18k
- SHA256 a2595f31c0eb387595223d187d0e3cc18e86fd4e130b7bdc6961ddf4b654cc91
Malware Config
Signatures
- Badlisted process makes network request 15 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a2595f31c0eb387595223d187d0e3cc18e86fd4e130b7bdc6961ddf4b654cc91.ps11⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\qgivkmiii4_cyk2_upd_aku\psl.exe"C:\Users\Admin\AppData\Local\qgivkmiii4_cyk2_upd_aku\psl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\qgivkmiii4_cyk2_upd_aku\psl.exe"C:\Users\Admin\AppData\Local\qgivkmiii4_cyk2_upd_aku\psl.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\xkpsm.sysC:\Windows\Temp\xkpsm.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\Users\Admin\AppData\Roaming\SystemsContrcheck" & "C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe"C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AddInProcess32.exe.log
__PSScriptPolicyTest_anos5mqv.vkx.ps1
zersjpq__ptgihf.zip
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msys-2.0.dll
msys-iconv-2.dll
msys-idn2-0.dll
msys-intl-8.dll
msys-psl-5.dll
msys-unistring-5.dll
psl.exe
log_20260415_114903.txt
log_20260415_114903.txt
log_20260415_114927.txt
log_20260415_114927.txt
log_20260415_114927.txt
xkpsm.sys
memory/572-158-0x0000000180000000-0x0000000180289000-memory.dmp
memory/572-190-0x00007FF891D00000-0x00007FF891DAE000-memory.dmp
memory/572-191-0x00007FF893240000-0x00007FF8933DA000-memory.dmp
memory/572-189-0x00007FF891FE0000-0x00007FF89209D000-memory.dmp
memory/572-192-0x00007FF891590000-0x00007FF891908000-memory.dmp
memory/572-188-0x00007FF893620000-0x00007FF893829000-memory.dmp
memory/572-228-0x00007FF6782D0000-0x00007FF6782E5000-memory.dmp
memory/1076-107-0x00007FF893620000-0x00007FF893829000-memory.dmp
memory/1076-108-0x00007FF891FE0000-0x00007FF89209D000-memory.dmp
memory/1076-110-0x00007FF893240000-0x00007FF8933DA000-memory.dmp
memory/1076-111-0x00007FF891590000-0x00007FF891908000-memory.dmp
memory/1076-109-0x00007FF891D00000-0x00007FF891DAE000-memory.dmp
memory/1076-103-0x0000000180000000-0x0000000180289000-memory.dmp
memory/1076-178-0x00007FF7D80F0000-0x00007FF7D8105000-memory.dmp
memory/1248-239-0x0000000000BD0000-0x0000000000BF5000-memory.dmp
memory/1248-240-0x0000000004D70000-0x0000000005372000-memory.dmp
memory/1248-294-0x0000000000BD0000-0x0000000000BF5000-memory.dmp
memory/1248-295-0x0000000004D70000-0x0000000005372000-memory.dmp
memory/1772-235-0x0000000180000000-0x0000000180289000-memory.dmp
memory/1772-246-0x00007FF893620000-0x00007FF893829000-memory.dmp
memory/1772-310-0x00007FF7D80F0000-0x00007FF7D8105000-memory.dmp
memory/1772-248-0x00007FF891D00000-0x00007FF891DAE000-memory.dmp
memory/1772-247-0x00007FF891FE0000-0x00007FF89209D000-memory.dmp
memory/1772-250-0x00007FF891590000-0x00007FF891908000-memory.dmp
memory/1772-249-0x00007FF893240000-0x00007FF8933DA000-memory.dmp
memory/1964-153-0x0000000000010000-0x0000000000018000-memory.dmp
memory/2288-231-0x0000000005560000-0x0000000005B62000-memory.dmp
memory/2288-177-0x00000000053E0000-0x0000000005440000-memory.dmp
memory/2288-176-0x0000000000E00000-0x0000000000E76000-memory.dmp
memory/2288-179-0x0000000005CB0000-0x0000000005D8C000-memory.dmp
memory/2288-183-0x0000000005F10000-0x0000000005F76000-memory.dmp
memory/2288-186-0x0000000006EE0000-0x0000000006F72000-memory.dmp
memory/2288-187-0x0000000007530000-0x0000000007AD6000-memory.dmp
memory/2288-232-0x0000000005EE0000-0x0000000005EE7000-memory.dmp
memory/2288-230-0x00000000010E0000-0x0000000001105000-memory.dmp
memory/2656-23-0x000001CDC4C60000-0x000001CDC4C70000-memory.dmp
memory/2656-31-0x00007FF4ECA60000-0x00007FF4ECA70000-memory.dmp
memory/2656-22-0x000001CDC4C60000-0x000001CDC4C70000-memory.dmp
memory/2656-21-0x000001CDDD4B0000-0x000001CDDD4D4000-memory.dmp
memory/2656-25-0x000001CDC4C60000-0x000001CDC4C70000-memory.dmp
memory/2656-26-0x000001CDC4C60000-0x000001CDC4C70000-memory.dmp
memory/2656-44-0x000001CDDD470000-0x000001CDDD482000-memory.dmp
memory/2656-1-0x000001CDC4C60000-0x000001CDC4C70000-memory.dmp
memory/2656-20-0x000001CDDD4B0000-0x000001CDDD4DA000-memory.dmp
memory/2656-19-0x000001CDDD470000-0x000001CDDD47A000-memory.dmp
memory/2656-27-0x000001CDC32A0000-0x000001CDC334E000-memory.dmp
memory/2656-29-0x000001CDC4D30000-0x000001CDC4D42000-memory.dmp
memory/2656-28-0x000001CDC4C80000-0x000001CDC4C8C000-memory.dmp
memory/2656-24-0x000001CDC4C60000-0x000001CDC4C70000-memory.dmp
memory/2656-18-0x000001CDDD770000-0x000001CDDD823000-memory.dmp
memory/2656-32-0x000001CDC4C60000-0x000001CDC4C70000-memory.dmp
memory/2656-17-0x000001CDDD450000-0x000001CDDD46C000-memory.dmp
memory/2656-10-0x00007FF4ECA60000-0x00007FF4ECA70000-memory.dmp
memory/2656-9-0x000001CDC4C60000-0x000001CDC4C70000-memory.dmp
memory/2656-7-0x000001CDC4F30000-0x000001CDC4F52000-memory.dmp
memory/2656-0-0x000001CDC4C60000-0x000001CDC4C70000-memory.dmp
memory/2656-36-0x000001CDDD440000-0x000001CDDD44A000-memory.dmp
memory/2656-328-0x000001CDC4C80000-0x000001CDC4C8C000-memory.dmp
memory/2656-327-0x000001CDC32A0000-0x000001CDC334E000-memory.dmp
memory/3932-321-0x0000000005970000-0x0000000005F72000-memory.dmp
memory/3932-320-0x00000000016C0000-0x00000000016E5000-memory.dmp
memory/3932-334-0x00000000016C0000-0x00000000016E5000-memory.dmp
memory/3932-335-0x0000000005970000-0x0000000005F72000-memory.dmp