890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/IdentifyConsoleWindow.ps1
Size 1KB
Sample260502-werwsac121
SHA256 890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60
MD5 d0568512a8b58a101d43c7c961ad50d0
SHA1 66654847c09efaf9edef7d74fdded9716db5e0f6
SHA512 ebb7f760416ce47629b6ac790ebe9d8e1c2173d21efe24cdf556ec9c031f961263809d9401a049410c6fe510495a4aa8bcb732f5beda12da2e5011e8abb5e184
TLSH
T12741FD617EC1E2B401B191329EE39759F10A046B6570292074FDD219FF345A7C9FEDC8
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
332	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
332	PowerShell.exe
332	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	332	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 708	332	PowerShell.exe	80
PID 708 wrote to memory of 5092	708	csc.exe	81

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-pty\deps\winpty\misc\IdentifyConsoleWindow.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r5k2afcj\r5k2afcj.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE196.tmp" "c:\Users\Admin\AppData\Local\Temp\r5k2afcj\CSCB444E8BD3EA46F2A48DDC20341A8FED.TMP"
    3⤵
    PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESE196.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE196.tmp
Size 1KB
SHA256 7fcee5266588ac19837032bf89647bc1d2f1e48a0985a70504afe723781a65a5
MD5 850178a5c65521f29116724ab8b28b1d
SHA1 4da476204003e3ef8ff89d8b36ecce68e13b33dd
SHA512 615f5393265a8a84eaae8ceee64e12f32f62ed49a7976bc7347ef93a55bdc2a4532f4ab3252b1ab1dd4bdf6d7b3ebc569ee0029f09682b4f5ad7e74ba9d9d86f
TLSH
T1FF21B70553FC471EF0775732B9F6272BA668FD94EFA2936E8140423C2C51648EEA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cn2blmaw.0om.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cn2blmaw.0om.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

r5k2afcj.dll

Path C:\Users\Admin\AppData\Local\Temp\r5k2afcj\r5k2afcj.dll
Size 3KB
SHA256 c88900dca1217b3d36de7bdbc40b36050ace0d2b82ee916c87234b9feafdb270
MD5 c3505e9080bb1e46e40bcc0ae586a4ac
SHA1 b0144371734436e49f6721dbf803cb432fdb2be8
SHA512 b8a1a2441b6165b0ebb8aa64d72f05aa97260128c5d4893d5268ff75c8bb5c5279d59e1c51a624c6149553b35b4e9895eace4fc087c932efcb29aca504922eff
TLSH
T11671104797E84A27E4774731BEF3072273B8F8605BB3A7AE5990421DAC611205D31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB444E8BD3EA46F2A48DDC20341A8FED.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\r5k2afcj\CSCB444E8BD3EA46F2A48DDC20341A8FED.TMP
Size 652B
SHA256 88a3c7fb8895847fe6b0c70979345ae39d976b81e34a6d4ccef6e53c41131ce2
MD5 100f15c53d936b7c07038218c3b099ac
SHA1 e5da74b3034261c7dfd0ec364367628ada3b1608
SHA512 edceab3189513418bd843a139b35b83973098ce569efac94a3899d4f1329a7dcc95f94c92fbfb0a267c6402c5c6c9ded8e8a9fdb8b0155d42bcbf33fc94fd9aa
TLSH
T1A4F05E0963F8520EF4F39B30BDF6437395A8BC65DE3293ED5480431968649249962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

r5k2afcj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\r5k2afcj\r5k2afcj.0.cs
Size 615B
SHA256 affbeb48f65303e13e7c8577dbafbb259131abde5bf8b6335f508a8ce7ce9cd3
MD5 99e8477437263302d0b0c9baf2007880
SHA1 9d4f4f01dc04e518f4d1dbcc910c563fe40fb4fe
SHA512 6d0ffefa51023b22df328cda965ead87d2635958ad1b2f0d41f586df46e2e2f0402c0e48def6c9ac394a60431dd58269c37f991a795524df92d18d3e626b0e73
TLSH
T157F08B24AB92E6B0447250158DC7D8ADF206512725782801F9FC2322EF02105993C75C
MD5 SHA1 SHA512 TLSH

Submit Download

r5k2afcj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\r5k2afcj\r5k2afcj.cmdline
Size 369B
SHA256 13cf8e1d957c893e65b27e1c3a2fa5a38c7269f85d6363cde8f55905aec48b63
MD5 61689cd7d878deb7a8119fba74b15e30
SHA1 f9c4be624c8dbc858dd9731364d0c11e97674e57
SHA512 f825626d5c228988fe91750e7af495e83b1564e0e1d2b3cf4de1daa7bfbd1d4a3e1cff21f9c57f8767d802c95e3f06d267e1fddf1ec9db2dfe0c37d5be059143
TLSH
T138E0C62A4346C37D83ED100B62AED4ECC376878B2A983F849188846DE02F0002FE6787
MD5 SHA1 SHA512 TLSH

Submit Download

memory/332-1-0x0000025B64770000-0x0000025B64780000-memory.dmp

Download

memory/332-7-0x0000025B64710000-0x0000025B64732000-memory.dmp

Download

memory/332-0-0x0000025B64770000-0x0000025B64780000-memory.dmp

Download

memory/332-22-0x0000025B64760000-0x0000025B64768000-memory.dmp

Download

memory/332-25-0x0000025B4C070000-0x0000025B4C0CD000-memory.dmp

Download

memory/332-26-0x0000025B4C370000-0x0000025B4C382000-memory.dmp

Download

memory/708-20-0x0000016562EA0000-0x0000016562EFD000-memory.dmp

Download