0e28f2ad37d1e2f4ca30773ec2428a92b20af7fbdf44790fb59455127c455750

Analysis

max time kernel
183s
max time network
185s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/06/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file01.ps1
Size 3KB
Sample260626-m3j2eaax2t
SHA256 0e28f2ad37d1e2f4ca30773ec2428a92b20af7fbdf44790fb59455127c455750
MD5 9f7920edb0ed84fb0ed9f67918fe9a24
SHA1 7702a5d9f68993f12948a2026250169ca1187617
SHA512 03155567781e0480df5a707a27f58a0575078b0f8cc1ae9ece1d2901589fd4f16e462cc16dcff14bcd2df5df7900887081539aefdaa4e2a82d11e189ee60d651
TLSH
T17A81953F6E4B625210F3C756BD8940D5EB7A02BB261C090074EDD6842F7167C83A6ECD
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4012	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4012	powershell.exe
4012	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4940	4012	powershell.exe	83
PID 4940 wrote to memory of 4908	4940	csc.exe	84

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rkkhbdni\rkkhbdni.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B80.tmp" "c:\Users\Admin\AppData\Local\Temp\rkkhbdni\CSCC94C7697988448759763FB05704310.TMP"
    3⤵
    PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES2B80.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2B80.tmp
Size 1KB
SHA256 d7b944ed94c8badafa44d8a302b2142941f1f2d915be0485e4eea2b9736af4bc
MD5 0c1b097276adc0a71e8145f71065e595
SHA1 9f80ab36e1a8bd3e66bb665c8dbbbe708db816d2
SHA512 07bd1195a0709263b85106b41c4a388c7c39d0ae93953dafa5fd30686df0e572fedb7d69ce0064ea225930ad2fae705810d28dcf071a445987673937836ed399
TLSH
T12B21EB4683E8471EF0B3173179F6532FA238FD58EFA293AB9540422C2C51204EEE0A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fapnbfuj.cub.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fapnbfuj.cub.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rkkhbdni.dll

Path C:\Users\Admin\AppData\Local\Temp\rkkhbdni\rkkhbdni.dll
Size 3KB
SHA256 789c2d7a8b025286a88d23e8eb93583bbd930b3e8b995183882b05b3861d04da
MD5 3a208d923bb8f4d7f17822aa4632dbc1
SHA1 3dd796e2f76a1c58dc5efd33925981d56656a14c
SHA512 9f09ba0a8e6a47b1d700f43cbe47462c490b161b495e25054792286564b0de4f1403bcda1ab2140f78abfb56ad3b27cf5d38e745bd28234e73e9eb3dcd95fccd
TLSH
T1CB51FE2AA3E406A7F4B30734AEE3435377B9FC509F72536D58804228AC207540E72FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC94C7697988448759763FB05704310.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rkkhbdni\CSCC94C7697988448759763FB05704310.TMP
Size 652B
SHA256 33508cdc1ec88ab64fba5873675695ead8981655e3e3fdd442cdd3d69ba505f2
MD5 e99cc7615de851e1fb51e26bd304ca54
SHA1 3045ab31d0fd5b806d9bc47abe784b06db77a4a1
SHA512 f34171eb1efb967627410204f439712b6e027796aab62ddbd6c877b0889bcd216630a1cca6afe39fb6b8ce2d473f222de89b94c5e043c6d80fa2915fbacd54fd
TLSH
T1A3F05E0A63F8120EF0F35B30BDF683A391A9BC64EE3293FD2454031D2C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rkkhbdni.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rkkhbdni\rkkhbdni.0.cs
Size 191B
SHA256 0b8e7f5e4b2092619377d2067e2a1432829cf757f0618ea44d3f75e45bbb215a
MD5 a6c0c238d56cdd4f52366c172de32959
SHA1 52d50bfb1bce004648ad362a250e66f657ca2a22
SHA512 338e23df2151146435505841ee21cf67a453606778f2347e039ec17fb47205a32a9208f57ee4f26abf04c8d155e8249ba5811cd56d91747e612a39160c6f4152
TLSH
T1EDC0223823938A21003201075C00A0E8FA3321A023BB2801F5F95A228E8E1101230D19
MD5 SHA1 SHA512 TLSH

Submit Download

rkkhbdni.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rkkhbdni\rkkhbdni.cmdline
Size 369B
SHA256 277ac942e6b5c65b6c36e065ee4f339ce92953b8e1bae10e9eae303487cc8c50
MD5 de3a1c049d2155da1712feb9d7833a1d
SHA1 77678bce40dd323e4fbbb4aa9c0c3f6bb54433ef
SHA512 fa02a8f4c53fb72d827ff23d96fca37335bb8e80778829057995a4234ada28fee817ba75ca8f94fa6b3c832093eaeaa70da241ec180bbe5d2832f1891419bca0
TLSH
T13CE06F3B4386C27D21E9100B2A6BE6ADC67207832A803F84D240888DE02B0002FF2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4012-0-0x000002B0A5280000-0x000002B0A5290000-memory.dmp

Download

memory/4012-10-0x000002B0A5280000-0x000002B0A5290000-memory.dmp

Download

memory/4012-23-0x000002B0A5270000-0x000002B0A5278000-memory.dmp

Download

memory/4012-7-0x000002B0A5240000-0x000002B0A5262000-memory.dmp

Download

memory/4012-1-0x000002B0A5280000-0x000002B0A5290000-memory.dmp

Download

memory/4012-27-0x000002B0A5280000-0x000002B0A5290000-memory.dmp

Download

memory/4012-26-0x000002B0A5280000-0x000002B0A5290000-memory.dmp

Download

memory/4012-28-0x000002B0A5280000-0x000002B0A5290000-memory.dmp

Download