890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/IdentifyConsoleWindow.ps1
Size 1KB
Sample260502-werwsac121
SHA256 890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60
MD5 d0568512a8b58a101d43c7c961ad50d0
SHA1 66654847c09efaf9edef7d74fdded9716db5e0f6
SHA512 ebb7f760416ce47629b6ac790ebe9d8e1c2173d21efe24cdf556ec9c031f961263809d9401a049410c6fe510495a4aa8bcb732f5beda12da2e5011e8abb5e184
TLSH
T12741FD617EC1E2B401B191329EE39759F10A046B6570292074FDD219FF345A7C9FEDC8
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4984	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4984	powershell.exe
4984	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2648	4984	powershell.exe	84
PID 2648 wrote to memory of 4872	2648	csc.exe	85

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-pty\deps\winpty\misc\IdentifyConsoleWindow.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bsn2ngun\bsn2ngun.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES70C6.tmp" "c:\Users\Admin\AppData\Local\Temp\bsn2ngun\CSCF81A816484A5413CB393AAB916EA438.TMP"
    3⤵
    PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES70C6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES70C6.tmp
Size 1KB
SHA256 fb17d4a259ce33e0458fc8e2322104d4e5fb12323c20acf246d4403383268fbc
MD5 9824f75055b2636f1806765daa9b0f20
SHA1 ed2a1605c8194b4dbc76956bfe6f0f27a54ca097
SHA512 e68fb9619ef510ecbf1ff3fb3be5ff92995a757ea43bd39e37a62feb97786055f9031f9b46daff9c22d862ba3296dddd9a35a6a61dfcf492cdace958ccf235dc
TLSH
T1B321DD0653FC470EF077473169F6176BA269FD50EFB2A35E8040412C1C51144EEA1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ecbbtocs.akr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ecbbtocs.akr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bsn2ngun.dll

Path C:\Users\Admin\AppData\Local\Temp\bsn2ngun\bsn2ngun.dll
Size 3KB
SHA256 e9e6dc5b3c35d663ee3cec7a485d122e96316f2e35dc9bed901f5614d7c2e4eb
MD5 558f09cdc7a22fe472501801c9682f37
SHA1 fc10e2a1f815388bda6cef07435f25c6399e1545
SHA512 38a821938ee733dfb0f397de586f6037a4bc99046d406cce4f3d8e5f904f241405d8cde04a6c32e942c2588dd0c0ce6ef59f4611cda018e85cdb7509e54c5d8e
TLSH
T1D071ED5B97E8462BF07B47356EF3071273B8FC509BB7A76E55900229AC612205932BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF81A816484A5413CB393AAB916EA438.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bsn2ngun\CSCF81A816484A5413CB393AAB916EA438.TMP
Size 652B
SHA256 0480b80fcc467be8a75c5b070d5d4f23d9e0342b62c5f2c551778831281ce32e
MD5 6c6012a52378168563677aafa4d9279b
SHA1 b3359f34f44bf0b57cf25af3e18bf1bdb02810b1
SHA512 f6c3b03b683e3b13a0ffcc70c8f83e84240b1b11210573c9c261ba2edc99f46dfc63fc3a88f5076bc359db6e6c79d15917a9bc6cdefb8980aff1a49f7d0e72b2
TLSH
T1D9F0540A63F8020EF0F78B30BDF543A39169BC65DE72A3ED5480031918645149971FB1
MD5 SHA1 SHA512 TLSH

Submit Download

bsn2ngun.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bsn2ngun\bsn2ngun.0.cs
Size 615B
SHA256 affbeb48f65303e13e7c8577dbafbb259131abde5bf8b6335f508a8ce7ce9cd3
MD5 99e8477437263302d0b0c9baf2007880
SHA1 9d4f4f01dc04e518f4d1dbcc910c563fe40fb4fe
SHA512 6d0ffefa51023b22df328cda965ead87d2635958ad1b2f0d41f586df46e2e2f0402c0e48def6c9ac394a60431dd58269c37f991a795524df92d18d3e626b0e73
TLSH
T157F08B24AB92E6B0447250158DC7D8ADF206512725782801F9FC2322EF02105993C75C
MD5 SHA1 SHA512 TLSH

Submit Download

bsn2ngun.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bsn2ngun\bsn2ngun.cmdline
Size 369B
SHA256 05e9c5e8884935700d431264986a622d5c383a72a416950f31b9faecc2a5c529
MD5 ef9660338dcb13d0b641d61f10429b9e
SHA1 e78794938a03d87e6e8677632e2a0a328939d4da
SHA512 e083c8f387c1651731e4a237cb0970e8a52235d5e1989d4631689823a5a0d7cb2d22400828cad4ff97a57ef61681561a66c2464535c5d3ba2bb7d8d614226732
TLSH
T194E0207F5256C6FD15DD110722A9CDACC2B21B472D497F8C5154445ED01704477F3F55
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2648-21-0x000001C487D50000-0x000001C487D5C000-memory.dmp

Download

memory/4872-18-0x0000027A6A5A0000-0x0000027A6A5AC000-memory.dmp

Download

memory/4984-0-0x0000015A1D450000-0x0000015A1D460000-memory.dmp

Download

memory/4984-8-0x0000015A1D3C0000-0x0000015A1D3E2000-memory.dmp

Download

memory/4984-23-0x0000015A1D3B0000-0x0000015A1D3B8000-memory.dmp

Download

memory/4984-26-0x0000015A04E00000-0x0000015A04E0C000-memory.dmp

Download