Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
24/06/2026, 19:56
General
- Target trigger.ps1
- Size 87B
- Sample260624-ynnltsft5p
- SHA256 da449d171a1b499b1a84f2c0c697dff04ecf363cf78619393a277946d4e865c7
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -L -o micromamba.exe https://github.com/mamba-org/micromamba-releases/releases/latest/download/micromamba-win-642⤵
-
-
C:\Users\Admin\AppData\Local\micromamba\micromamba.exe"C:\Users\Admin\AppData\Local\micromamba\micromamba.exe" --version2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
micromamba.exe
memory/5044-11-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-14-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-5-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-6-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-7-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-9-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-4-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-10-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-8-0x00000154B6140000-0x00000154B68E6000-memory.dmp
memory/5044-13-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-0-0x00007FFA2DA3F000-0x00007FFA2DA40000-memory.dmp
memory/5044-15-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-16-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-18-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp
memory/5044-3-0x00000154B5460000-0x00000154B5482000-memory.dmp