Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
25/06/2026, 12:20
General
- Target client.exe
- Size 3.6MB
- Sample260625-ph6qsaby8p
- SHA256 cef768a9d6a7727fef428e06e68232bb917ab8d00dac2e3b10523864be75d8e6
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to get system information as a root user.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct).displayName -join ', '"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exeC:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct).displayName -join ', '"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_fvutv41d.qbe.ps1
svchost.exe
memory/756-0-0x00007FF669C50000-0x00007FF66C77C000-memory.dmp
memory/756-39-0x00007FF669C50000-0x00007FF66C77C000-memory.dmp
memory/2128-23-0x000001F36EF30000-0x000001F36EF5A000-memory.dmp
memory/2128-5-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-9-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-10-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-11-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-12-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-13-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-14-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-15-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-16-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-19-0x000001F36E800000-0x000001F36E81E000-memory.dmp
memory/2128-20-0x000001F36E970000-0x000001F36EA22000-memory.dmp
memory/2128-21-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-22-0x000001F36E820000-0x000001F36E82A000-memory.dmp
memory/2128-24-0x000001F36EF30000-0x000001F36EF54000-memory.dmp
memory/2128-7-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-26-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-6-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-1-0x00007FFEDC33F000-0x00007FFEDC340000-memory.dmp
memory/2128-8-0x00007FFEDC1B0000-0x00007FFEDCB54000-memory.dmp
memory/2128-4-0x000001F36E730000-0x000001F36E752000-memory.dmp
memory/4064-37-0x0000023FCDC90000-0x0000023FCDD42000-memory.dmp
memory/6060-47-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-50-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-42-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-43-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-44-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-45-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-41-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-48-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-46-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-49-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-31-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-51-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-52-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-53-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp
memory/6060-54-0x00007FF6A9590000-0x00007FF6AC0BC000-memory.dmp