Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
11/05/2026, 18:00
General
- Target _fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28.exe
- Size 1.2MB
- Sample260511-wlk2tabv4j
- SHA256 fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28.exe"C:\Users\Admin\AppData\Local\Temp\_fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\_fc0fd66e13fb8cbfe445c6b356bd1ada335907577cb495a0d0fa5e40400d7c28.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\jamyl5bdbuj.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\lHIAgZkXAesiW.exe"C:\Users\Admin\AppData\Roaming\lHIAgZkXAesiW.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lHIAgZkXAesiW.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_qt3kkpzf.zmq.ps1
jamyl5bdbuj.ps1
LoginData
WebData
lHIAgZkXAesiW.exe
memory/960-4-0x00000000057A0000-0x00000000057AA000-memory.dmp
memory/960-8-0x0000000007AA0000-0x0000000007CBA000-memory.dmp
memory/960-9-0x0000000007D60000-0x0000000007DFC000-memory.dmp
memory/960-7-0x0000000005810000-0x0000000005820000-memory.dmp
memory/960-6-0x0000000005570000-0x0000000005589000-memory.dmp
memory/960-5-0x00000000070B0000-0x00000000070C8000-memory.dmp
memory/960-3-0x0000000005810000-0x0000000005820000-memory.dmp
memory/960-22-0x0000000005570000-0x0000000005589000-memory.dmp
memory/960-0-0x0000000000AC0000-0x0000000000BF4000-memory.dmp
memory/960-2-0x00000000055C0000-0x0000000005652000-memory.dmp
memory/960-1-0x0000000005C30000-0x00000000061D4000-memory.dmp
memory/4544-70-0x00000000071B0000-0x0000000007253000-memory.dmp
memory/4544-79-0x0000000007600000-0x0000000007608000-memory.dmp
memory/4544-43-0x0000000005930000-0x0000000005C84000-memory.dmp
memory/4544-44-0x0000000005FB0000-0x0000000005FCE000-memory.dmp
memory/4544-45-0x0000000006000000-0x000000000604C000-memory.dmp
memory/4544-16-0x0000000002640000-0x0000000002650000-memory.dmp
memory/4544-29-0x00000000057C0000-0x0000000005826000-memory.dmp
memory/4544-25-0x0000000004F70000-0x0000000004F92000-memory.dmp
memory/4544-15-0x00000000049B0000-0x00000000049E6000-memory.dmp
memory/4544-69-0x0000000007180000-0x000000000719E000-memory.dmp
memory/4544-61-0x00000000703F0000-0x000000007043C000-memory.dmp
memory/4544-60-0x0000000006590000-0x00000000065C2000-memory.dmp
memory/4544-21-0x0000000005020000-0x0000000005648000-memory.dmp
memory/4544-72-0x00000000072E0000-0x00000000072FA000-memory.dmp
memory/4544-71-0x0000000007930000-0x0000000007FAA000-memory.dmp
memory/4544-73-0x0000000007350000-0x000000000735A000-memory.dmp
memory/4544-74-0x0000000007560000-0x00000000075F6000-memory.dmp
memory/4544-75-0x00000000074E0000-0x00000000074F1000-memory.dmp
memory/4544-76-0x0000000007510000-0x000000000751E000-memory.dmp
memory/4544-77-0x0000000007520000-0x0000000007534000-memory.dmp
memory/4544-78-0x0000000007620000-0x000000000763A000-memory.dmp
memory/4544-26-0x0000000005750000-0x00000000057B6000-memory.dmp
memory/4544-84-0x0000000004FA0000-0x0000000004FB8000-memory.dmp
memory/4544-83-0x00000000023D0000-0x0000000002415000-memory.dmp
memory/4544-86-0x0000000004FC0000-0x0000000004FDD000-memory.dmp
memory/4544-85-0x0000000005C90000-0x0000000005CBB000-memory.dmp
memory/4736-19-0x0000000000400000-0x0000000000581000-memory.dmp
memory/4736-87-0x0000000000400000-0x0000000000581000-memory.dmp
memory/4736-18-0x0000000000400000-0x0000000000581000-memory.dmp
memory/4928-59-0x000002951A0B0000-0x000002951A0BC000-memory.dmp
memory/4928-53-0x0000029534030000-0x0000029534052000-memory.dmp
memory/5516-96-0x0000000009BE0000-0x0000000009C01000-memory.dmp
memory/5516-95-0x00000000096C0000-0x00000000096DD000-memory.dmp
memory/5516-94-0x0000000007240000-0x000000000724B000-memory.dmp
memory/6096-114-0x0000000005790000-0x0000000005AE4000-memory.dmp
memory/6096-116-0x0000000005F00000-0x0000000005F4C000-memory.dmp
memory/6096-117-0x0000000070860000-0x00000000708AC000-memory.dmp
memory/6096-125-0x0000000007070000-0x0000000007113000-memory.dmp
memory/6096-126-0x00000000072F0000-0x0000000007301000-memory.dmp
memory/6096-127-0x0000000007340000-0x0000000007354000-memory.dmp
memory/6096-129-0x0000000002150000-0x0000000002195000-memory.dmp
memory/6096-131-0x0000000005500000-0x0000000005513000-memory.dmp
memory/6096-132-0x0000000005750000-0x000000000578C000-memory.dmp
memory/6096-130-0x0000000004C40000-0x0000000004C64000-memory.dmp