9c8123d21cc9f089eede2c81be5d44ab05ce60f83b48966344f6f697330d1034

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/ConinMode.ps1
Size 3KB
Sample260502-werwsac121
SHA256 9c8123d21cc9f089eede2c81be5d44ab05ce60f83b48966344f6f697330d1034
MD5 dec84b4f7859e44892e0750c83fd693d
SHA1 6f88920515398ca40a09ec06dd2e2a61d2c60583
SHA512 759c6f7c79a6754190848d311ed263e708c1ac791684586228aee63560c8134c310d4433c365d6543b261ffbde7777da63cc69269e22d58d2464ccc6e51ec067
TLSH
T1DB617072B75ED26542761EB8B5C68484F915E82B30A46420B2BC84EE6F3C330D1FAC69
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4840	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4840	PowerShell.exe
4840	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 5092	4840	PowerShell.exe	80
PID 5092 wrote to memory of 3932	5092	csc.exe	81

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-pty\deps\winpty\misc\ConinMode.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3fq5aws1\3fq5aws1.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3FA4.tmp" "c:\Users\Admin\AppData\Local\Temp\3fq5aws1\CSC7EFF1D3E3E67447C87DB93BB53D883B.TMP"
    3⤵
    PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3fq5aws1.dll

Path C:\Users\Admin\AppData\Local\Temp\3fq5aws1\3fq5aws1.dll
Size 3KB
SHA256 0466f60573e16bbd28ebecc77fdc3ab09182c5a076ed23e3776a106d6c8d09d4
MD5 2a2238ce25eebdc3ba213ccdaaf7f47c
SHA1 e7f2097a88574101a389cf8e4af080f93fe42428
SHA512 a4c5e0b2d94c0fd057c8a804da2b055209668f6f444ea85cd89df1121b8e49d5bf1c174f73c695e43fc8ef8dd69b9a40436a8a5cf9ba5d1377e51f323785dad8
TLSH
T10871EE2BC7E84667E4BB0B349EB3435236B0FC518B639B6E59910219AC643308F71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES3FA4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3FA4.tmp
Size 1KB
SHA256 db93fcdcd87d73762b2614d6e70765928daf8bcab173ed732d4afb087416e4ee
MD5 5573553fcf39440fdae98808cd17f8a7
SHA1 9eca1c86351b17fb4f53b6f33ff546873b637e6f
SHA512 c688422aa2886fb130d623f8fd479c71290b4daa961aa88e4c3063c81bfbdd4364f55bae1b9dc41dd1425b9fe6a0985eec38f2fd5f7f68b936b74682b42a8fba
TLSH
T1C421BB0543EC471EF0771B3269F6232FA268FE94EF62A75E8100422D2C41144EEA1B73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fzm4vwd1.q3u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fzm4vwd1.q3u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3fq5aws1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3fq5aws1\3fq5aws1.0.cs
Size 716B
SHA256 dc34a2660b2aba1533fbcf396fce968c608dec4ca379046c15dd640eae9af060
MD5 2d82556c1fc924d18e71bf050af8e0c6
SHA1 0db7b682254bc5c54620614f8b3930f73797a811
SHA512 6619dd820fa01e95b4f80b2e1f91388b3171383d96704a4b084746cba2f87494e301c97b5772be8a66d7104d792bb5167949a0af6793c894c8a7b08d2c97118b
TLSH
T1DF017B459792C7B2C83515284D4BD4AEF663F12324F97D52B6FC07B1AF2B100953625D
MD5 SHA1 SHA512 TLSH

Submit Download

3fq5aws1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3fq5aws1\3fq5aws1.cmdline
Size 369B
SHA256 91c2b9506d2d5d08653c5f4e63ff45fdfc6808c3d2f0d412ab011c7e41e9fbd9
MD5 b92bda56699ffae7d8dc12e5fd496df5
SHA1 f62f1fe71f4aef08e5698958cd8b5898f1bf180f
SHA512 1f389ef4349fc55b721307fc00145854df597023120d79b6d4b997fbe8f8bafb07846842dc536de20cd1050bb75f8369f901e3809f22d5dd490c923b9cc9f569
TLSH
T1ABE0C02AC247CA7D0DDD30172A69C4FCC6B2174739403FD45540442ED217040A7F174A
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7EFF1D3E3E67447C87DB93BB53D883B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3fq5aws1\CSC7EFF1D3E3E67447C87DB93BB53D883B.TMP
Size 652B
SHA256 f56df1d61565b4522b4fc8a064ac958e6dc1a9569eff517f8ee28cddfdc0ba3a
MD5 25413986cd04b3f738ee69aa3b3f7a8e
SHA1 f0668bd09d3c0076cc62ce1ad51baf1aadfb06aa
SHA512 cdb3b9977b1abe355519c9f12fc62e777f3e939f9fa5f3a2754503f3e8677a4de0a64962213585ef3f152fd4ab74557285604d117932cf364d4e23edc9e2ffaa
TLSH
T1F3F03A0963F8420EF4F34B30B9F6536791A8BD65DE3297ED644043592C64510C962FB7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3932-19-0x00000214008C0000-0x00000214008CC000-memory.dmp

Download

memory/4840-1-0x000002763B670000-0x000002763B680000-memory.dmp

Download

memory/4840-9-0x000002763B670000-0x000002763B680000-memory.dmp

Download

memory/4840-7-0x0000027653D10000-0x0000027653D32000-memory.dmp

Download

memory/4840-0-0x000002763B670000-0x000002763B680000-memory.dmp

Download

memory/4840-24-0x0000027653FB0000-0x0000027653FB8000-memory.dmp

Download

memory/4840-27-0x000002763B640000-0x000002763B64C000-memory.dmp

Download

memory/4840-28-0x000002763B820000-0x000002763B832000-memory.dmp

Download

memory/5092-22-0x00000180DBF40000-0x00000180DBF4C000-memory.dmp

Download