Analysis
- user interaction
yes - max time kernel
598s - max time network
454s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 22:06
General
- Target Factura de pago_FAC-2026-001A_pdf.exe
- Size 1.1MB
- Sample260511-11a8daa18s
- SHA256 1556ef60b8023750fcfd9ffdae75df500efca8d84bf7b81f0aa54fe91277f568
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\5id0xml55d0.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\kbXZJcfCg.exe"C:\Users\Admin\AppData\Roaming\kbXZJcfCg.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kbXZJcfCg.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
5id0xml55d0.ps1
__PSScriptPolicyTest_4mmxbgfj.zqb.ps1
LoginData
WebData
kbXZJcfCg.exe
memory/2268-4-0x0000000005140000-0x000000000514A000-memory.dmp
memory/2268-7-0x00000000010F0000-0x0000000001202000-memory.dmp
memory/2268-9-0x0000000007060000-0x0000000007278000-memory.dmp
memory/2268-10-0x00000000010F0000-0x0000000001202000-memory.dmp
memory/2268-8-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/2268-6-0x00000000056C0000-0x00000000056D2000-memory.dmp
memory/2268-5-0x0000000005450000-0x00000000054EC000-memory.dmp
memory/2268-24-0x00000000010F0000-0x0000000001202000-memory.dmp
memory/2268-0-0x0000000000570000-0x000000000069A000-memory.dmp
memory/2268-3-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/2268-2-0x00000000051C0000-0x0000000005252000-memory.dmp
memory/2268-1-0x00000000056D0000-0x0000000005C76000-memory.dmp
memory/3904-72-0x00000000072B0000-0x00000000072BA000-memory.dmp
memory/3904-86-0x0000000005F10000-0x0000000005F1A000-memory.dmp
memory/3904-42-0x00000000059B0000-0x0000000005D07000-memory.dmp
memory/3904-43-0x0000000005EC0000-0x0000000005EDE000-memory.dmp
memory/3904-44-0x0000000006450000-0x000000000649C000-memory.dmp
memory/3904-15-0x0000000004A90000-0x0000000004AA0000-memory.dmp
memory/3904-25-0x0000000005830000-0x0000000005852000-memory.dmp
memory/3904-26-0x00000000058D0000-0x0000000005936000-memory.dmp
memory/3904-16-0x0000000002570000-0x00000000025A6000-memory.dmp
memory/3904-17-0x00000000050D0000-0x00000000056FA000-memory.dmp
memory/3904-83-0x0000000004D30000-0x0000000004E1A000-memory.dmp
memory/3904-61-0x00000000722D0000-0x000000007231C000-memory.dmp
memory/3904-60-0x0000000007080000-0x00000000070B4000-memory.dmp
memory/3904-68-0x00000000070C0000-0x00000000070DE000-memory.dmp
memory/3904-69-0x00000000070F0000-0x0000000007194000-memory.dmp
memory/3904-70-0x0000000007870000-0x0000000007EEA000-memory.dmp
memory/3904-71-0x0000000007230000-0x000000000724A000-memory.dmp
memory/3904-85-0x0000000005820000-0x000000000582A000-memory.dmp
memory/3904-73-0x00000000074C0000-0x0000000007556000-memory.dmp
memory/3904-74-0x0000000007460000-0x0000000007471000-memory.dmp
memory/3904-75-0x0000000007450000-0x000000000745E000-memory.dmp
memory/3904-76-0x0000000007480000-0x0000000007495000-memory.dmp
memory/3904-77-0x0000000007580000-0x000000000759A000-memory.dmp
memory/3904-78-0x0000000007570000-0x0000000007578000-memory.dmp
memory/3904-27-0x0000000005940000-0x00000000059A6000-memory.dmp
memory/3904-82-0x0000000002520000-0x0000000002539000-memory.dmp
memory/3904-84-0x0000000005860000-0x0000000005874000-memory.dmp
memory/4012-18-0x0000000000400000-0x0000000000581000-memory.dmp
memory/4012-20-0x0000000000400000-0x0000000000581000-memory.dmp
memory/4012-212-0x0000000001070000-0x00000000010EC000-memory.dmp
memory/4012-87-0x0000000001070000-0x00000000010EC000-memory.dmp
memory/4012-88-0x0000000000400000-0x0000000000581000-memory.dmp
memory/4012-190-0x0000000001070000-0x00000000010EC000-memory.dmp
memory/5156-132-0x00000000054C0000-0x00000000054DF000-memory.dmp
memory/5156-134-0x0000000005C80000-0x0000000005C8A000-memory.dmp
memory/5156-133-0x0000000005C40000-0x0000000005C80000-memory.dmp
memory/5156-135-0x00000000062F0000-0x00000000062FA000-memory.dmp
memory/5156-131-0x00000000028B0000-0x00000000028C9000-memory.dmp
memory/5156-129-0x0000000007860000-0x0000000007875000-memory.dmp
memory/5156-128-0x0000000007820000-0x0000000007831000-memory.dmp
memory/5156-127-0x0000000007540000-0x00000000075E4000-memory.dmp
memory/5156-119-0x0000000006320000-0x000000000636C000-memory.dmp
memory/5156-120-0x0000000070DD0000-0x0000000070E1C000-memory.dmp
memory/5244-110-0x000000000A600000-0x000000000A625000-memory.dmp
memory/5244-108-0x0000000007A50000-0x0000000007A8B000-memory.dmp
memory/5244-109-0x0000000009FA0000-0x0000000009FBD000-memory.dmp
memory/5244-107-0x0000000001070000-0x0000000001182000-memory.dmp
memory/5244-111-0x000000000A630000-0x000000000A64F000-memory.dmp
memory/5244-89-0x0000000001070000-0x0000000001182000-memory.dmp
memory/5424-57-0x0000028695F50000-0x0000028695F5C000-memory.dmp
memory/5424-58-0x00000286AE2F0000-0x00000286AEA9E000-memory.dmp
memory/5424-45-0x00000286AE200000-0x00000286AE222000-memory.dmp
memory/5424-59-0x0000028696010000-0x0000028696022000-memory.dmp
memory/5644-137-0x0000000001480000-0x00000000014FC000-memory.dmp
memory/5644-195-0x0000000001480000-0x00000000014FC000-memory.dmp
memory/5644-217-0x0000000001480000-0x00000000014FC000-memory.dmp