a48aaa833c7829a6d103cd60022421a0593182392d53fe11ef1431fe9380b892

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/mutex_holder.ps1
Size 1KB
Sample260506-e857tsav2y
SHA256 a48aaa833c7829a6d103cd60022421a0593182392d53fe11ef1431fe9380b892
MD5 29263509d122a32fe60e2ac8e0654136
SHA1 fcb88a174e467146492f9226d26ed066869e324f
SHA512 35b1f517d7e493e6b30b340ac8787a81431f5d070943b2bdb5a56a88d530271e26858c98f34fc377b902ee566312a10cbc8cdbb6fe0f3e39d2c28dc50310e4af
TLSH
T17D21EF22FFC65AA01C5360214B6A35427A6A5A33129ED8A03DDFD31CEF0221954548DF
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4224	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4224	PowerShell.exe
4224	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 2384	4224	PowerShell.exe	80
PID 2384 wrote to memory of 5356	2384	csc.exe	81

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\resources\mutex_holder.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3ymvipqs\3ymvipqs.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES199E.tmp" "c:\Users\Admin\AppData\Local\Temp\3ymvipqs\CSCFCD325C4921146859C5A4A3E614AB65.TMP"
    3⤵
    PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ymvipqs.dll

Path C:\Users\Admin\AppData\Local\Temp\3ymvipqs\3ymvipqs.dll
Size 3KB
SHA256 9c722d7173c3820fe2711bcd1965d9ebab1858fb6577e0396b00066c281ad75b
MD5 12808299e6e6088dea3878deca39cd75
SHA1 63cc7fffb3e032d8d41a3a45c63f048a3cd52ecd
SHA512 25fa9eaf51a54bdb3d656694d97a9fbd0e65dc84bc2d31abf1c90d8eaece6a54eafbdef4a088f276fee7ced6da31546050a7f02dd6f58060091493c8f76ecaed
TLSH
T140712416B3E8462AF0BA0B34AAF7431362B5FD919E77D76F9844521C6C602A45D31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES199E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES199E.tmp
Size 1KB
SHA256 f6337062ed5d71875d08df7c58992bbdc141bf666af7b02861daf399cc830602
MD5 97d5ee007ac72e7d053d353eb11df839
SHA1 d39c1448e0c1f0458acc70ad7fc54970dfd8963c
SHA512 19d3d750a2a67f2d3c8423d0056b7ef974828900d310b4ff63e5a7dc25590808424ab67b22a8febb21fc57774c1cff7d45ee0d5b4482ddf8cbbe6da4b855fbef
TLSH
T18521EF0593ED471FF4B31B32A9F5172BA274FE94EFB2575A854052282D51204EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tvrcpnoz.ybc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tvrcpnoz.ybc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3ymvipqs.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3ymvipqs\3ymvipqs.0.cs
Size 930B
SHA256 67c934fdf4be67b02037eb506ddaa2634df2bcd8d9974eeade0eb9a0bb85e79d
MD5 7ab96b97f587787e721ed29811785b91
SHA1 01d178c0256606d2e08432b7595c43185e618980
SHA512 26836c434dc221680316fc6f34d8ec8a31c99e25633cfdb3b0562376e1c1eba6e47931996ebd9ca575568205ebce949d3c0a7e9ad0a5c99d1dddf4da89518fd9
TLSH
T1B111BD21BEC14AB11C5320214B2A7542B566AA33269ED8A03DDFD3189F0150858588EB
MD5 SHA1 SHA512 TLSH

Submit Download

3ymvipqs.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3ymvipqs\3ymvipqs.cmdline
Size 369B
SHA256 47b8dc70c16ea854292946918b60ac1680f10c29ca595a344dcf29986f5269cf
MD5 3efe2e8dbbaf86809c8b88f1fcdff144
SHA1 1fc3f1fffe1b57bbe4a398e94d99c30c545c52e9
SHA512 d72767c7a6163f2fb176ad71f0665bb0ecf19a3cbb0f062e6325e46630c52af1bbe22977aea6343be3d707add9cf6e4e96f208f563715fbc5c853921b886af79
TLSH
T1ACE0203E5257C67D35DF310F6169C6ACC3B2074B2D41BF845151845DE01701467D1F59
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFCD325C4921146859C5A4A3E614AB65.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3ymvipqs\CSCFCD325C4921146859C5A4A3E614AB65.TMP
Size 652B
SHA256 103f014f1052590350e280a24b5f6718a6c257649318ed8f18a6261791e3a945
MD5 bf9cedc4a150711a9f82f1a159823987
SHA1 8fd0aea9f9776fedaadbc049e1c1fa103663ee44
SHA512 bfe9192a7928f8b815f6485ca4376a4a53532c19063b2485255a7f40b885b3679a3cab91e1255f885be1bc2563b8aee84acadf79f83c8cc45542d2dc03bd9b8f
TLSH
T198F03A0963F8420AF4F35B31F9F6436391A8BD65DE7293ED548043196864510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2384-22-0x000002435DCD0000-0x000002435DCDC000-memory.dmp

Download

memory/2384-21-0x000002435DC50000-0x000002435DC81000-memory.dmp

Download

memory/4224-1-0x000002A4D61D0000-0x000002A4D61F2000-memory.dmp

Download

memory/4224-8-0x000002A4EE860000-0x000002A4EE870000-memory.dmp

Download

memory/4224-0-0x000002A4EE860000-0x000002A4EE870000-memory.dmp

Download

memory/4224-24-0x000002A4EE830000-0x000002A4EE838000-memory.dmp

Download

memory/4224-25-0x000002A4EE860000-0x000002A4EE870000-memory.dmp

Download

memory/4224-26-0x000002A4EE860000-0x000002A4EE870000-memory.dmp

Download

memory/4224-28-0x000002A4D6110000-0x000002A4D611C000-memory.dmp

Download

memory/4224-27-0x000002A4D47F0000-0x000002A4D4821000-memory.dmp

Download

memory/4224-29-0x000002A4D61A0000-0x000002A4D61B2000-memory.dmp

Download

memory/4224-30-0x000002A4EE860000-0x000002A4EE870000-memory.dmp

Download

memory/5356-18-0x00000145CC360000-0x00000145CC36C000-memory.dmp

Download