Analysis
- geolocation tags
- user interaction
yes - max time kernel
40s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
23/06/2026, 19:08
General
- Target bot.ps1
- Size 80KB
- Sample260623-xtcwvafw8j
- SHA256 c0135124d201b7c810349fce0dc8d267bfd91e8d763d1f5684c1da334bb53dae
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bot.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_divecpsj.0ce.ps1
memory/4220-0-0x00007FFEA820F000-0x00007FFEA8210000-memory.dmp
memory/4220-1-0x0000023AA1120000-0x0000023AA1142000-memory.dmp
memory/4220-7-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp
memory/4220-9-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp
memory/4220-10-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp
memory/4220-11-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp
memory/4220-13-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp
memory/4220-14-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp