eebe8360d6ea28a4963a6d98fac9ddd7ada2a2b238bcafaf0c62e3f5080b46ab

Analysis

max time kernel
8s
max time network
10s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
plugins/ChrisTitusApp.ps1
Size 31B
Sample260509-c8y3eahz8v
SHA256 eebe8360d6ea28a4963a6d98fac9ddd7ada2a2b238bcafaf0c62e3f5080b46ab
MD5 71d1a6255e95d0c37ec42d15ccba86c3
SHA1 5efd8040e4273254fbd2f70d6e0b599c27a1ad32
SHA512 b185cde1264a3db65116054b7a1e8662686e39f2793e35cb6baf50125527d4beb45b9dcfd1196fafb7857e0dddffb2c647ccb20978a15da72d9dcdd08ec75502
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4540	powershell.exe
6	4540	powershell.exe
8	4540	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4540	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4540	powershell.exe
4540	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 3584	4540	powershell.exe	86
PID 3584 wrote to memory of 5764	3584	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\plugins\ChrisTitusApp.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a4x3awek\a4x3awek.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF712.tmp" "c:\Users\Admin\AppData\Local\Temp\a4x3awek\CSC6110B906243D45BF983E7941C1CE8895.TMP"
    3⤵
    PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESF712.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF712.tmp
Size 1KB
SHA256 cc0e687ef6be7129e46b3d90fb9bec24564c994c413680ba8bf7669663fcdbe7
MD5 bf6bce981f0a20c01cf439116d0edeb9
SHA1 6b50ea41335ab08e2d5b370685d8b7a7106ad92f
SHA512 7e0e698409809062d7f1bef093184581dab29adf00596603a7d20e817770b4b47f74d5fd8a6ca14ad7be4cb87c682f061ee546a0a69ed912d7bee90a1578185c
TLSH
T12721C94683E9470FF0735331B9FA172BA278FD94EF62936B8940122C1C82550EEE1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uca52gig.dkm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uca52gig.dkm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a4x3awek.dll

Path C:\Users\Admin\AppData\Local\Temp\a4x3awek\a4x3awek.dll
Size 3KB
SHA256 33179f85dbc0f9de77e738c1b9ff9c5cd27095b4996443d734e4c94ab029e21d
MD5 3995e247d806db14afb96588c6254f7a
SHA1 5c2c79075f3e409bd5f6f2709083c6c75fe4fd3a
SHA512 64afd1b01163c132bb60fa387d86c128c1df18fe3694ce8c1b0b4d98371cf8f170796770ea01cd49be683f4c591be646ae5f59f893bd9abbbf66e3028964a768
TLSH
T1D3518B12A7E84627E07707306AF3431336A0B8609F72936D0944122D6C617A45E72FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6110B906243D45BF983E7941C1CE8895.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\a4x3awek\CSC6110B906243D45BF983E7941C1CE8895.TMP
Size 652B
SHA256 0a7a5b8fb0fb1551acca902bec36c8884a759cfbba0ca52b993022dec724163d
MD5 bd83d78a1f0303f06aa5b4e7927bcf5e
SHA1 646ebad4115eeeed1f9e660a3ba4098b46436c9c
SHA512 c5a5938efd2b1a39d7fabb0a264c75baecd5ab5a0169da73782c99bdfba76fb614a844f8b57846a8f7468e87e520419a2f14a8a5fefbb911574105da6c4b2da6
TLSH
T1CEF05E4963F8120EF0F34B30BDF6436395A8BC65DE3293ED1450131928645208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

a4x3awek.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\a4x3awek\a4x3awek.0.cs
Size 60B
SHA256 eeddefabcd3d49166c7f07950603312373da269365db66464238d5b56d212afa
MD5 aca3828b733052d33bc977ddebe26e5b
SHA1 5cedce2bc1057d0ad128fddd5b36edf8a33debf9
SHA512 5b0fee117761e3f357d44e128bf04542232cca0d755e27bcd50af8266d71121adab283f0cdcafb1ffea220710f8ccc45dc1c909e98a06923f54c04556adba59b
TLSH
T1A7A002128749533203654A5A2E2444C39845975B65C89962393553148E2B14C1F55996
MD5 SHA1 SHA512 TLSH

Submit Download

a4x3awek.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\a4x3awek\a4x3awek.cmdline
Size 369B
SHA256 cee5263e46701576d8e056227f9016c6e05a75deb3520d497c303af39215143e
MD5 44ad03f8cd715957f802cf855f4046d9
SHA1 d95c51adc13e212d8da7609b74ee9b831449e999
SHA512 c41acd055dd774cfa4cd3793ea2ebefb88629d7d0b489e08c15e80ffc63030e143bea4dc62d0ea5a48238844e9c15e912af09346d3266ff47261b576b9310a28
TLSH
T142E0682A6266C27D91E9101F2379C4AC83F20A633942BF8C6940440ED42B00127E3741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4540-25-0x000002644F4D0000-0x000002644F4D8000-memory.dmp

Download

memory/4540-12-0x00000264687B0000-0x0000026468CD8000-memory.dmp

Download

memory/4540-1-0x0000026467A50000-0x0000026467A60000-memory.dmp

Download

memory/4540-10-0x00000264680B0000-0x0000026468272000-memory.dmp

Download

memory/4540-9-0x000002644F4E0000-0x000002644F502000-memory.dmp

Download

memory/4540-11-0x0000026467A50000-0x0000026467A60000-memory.dmp

Download

memory/4540-0-0x0000026467A50000-0x0000026467A60000-memory.dmp

Download

memory/4540-26-0x0000026467A50000-0x0000026467A60000-memory.dmp

Download

memory/4540-28-0x0000026467A50000-0x0000026467A60000-memory.dmp

Download

memory/4540-29-0x0000026467A50000-0x0000026467A60000-memory.dmp

Download

memory/4540-30-0x00000264682B0000-0x00000264682B8000-memory.dmp

Download

memory/4540-31-0x0000026468300000-0x0000026468338000-memory.dmp

Download

memory/4540-32-0x00000264682E0000-0x00000264682EE000-memory.dmp

Download