Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 07:47
General
- Target loader.ps1.bin.ps1
- Size 443KB
- Sample260628-jms3laf13x
- SHA256 33a7648c64588e855b411fe9bcdb51489d4a33e4ab86705661049bb9b65ceddb
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\loader.ps1.bin.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Badlisted process makes network request
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ED88.tmp
memory/484-44-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-25-0x00000000060E0000-0x00000000060FE000-memory.dmp
memory/484-265-0x0000000074700000-0x0000000074EBC000-memory.dmp
memory/484-264-0x0000000074700000-0x0000000074EBC000-memory.dmp
memory/484-263-0x0000000074712000-0x0000000074713000-memory.dmp
memory/484-262-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/484-33-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-34-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-36-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-12-0x0000000002790000-0x00000000027C6000-memory.dmp
memory/484-14-0x0000000005540000-0x0000000005B8A000-memory.dmp
memory/484-37-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-15-0x0000000005200000-0x0000000005222000-memory.dmp
memory/484-17-0x0000000005310000-0x0000000005376000-memory.dmp
memory/484-38-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-20-0x0000000074712000-0x0000000074713000-memory.dmp
memory/484-23-0x0000000005B90000-0x0000000005EEB000-memory.dmp
memory/484-18-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/484-24-0x0000000074700000-0x0000000074EBC000-memory.dmp
memory/484-16-0x00000000052A0000-0x0000000005306000-memory.dmp
memory/484-56-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-26-0x00000000061A0000-0x00000000061EC000-memory.dmp
memory/484-27-0x0000000006D70000-0x00000000073EC000-memory.dmp
memory/484-28-0x0000000006710000-0x000000000672A000-memory.dmp
memory/484-57-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-32-0x0000000074700000-0x0000000074EBC000-memory.dmp
memory/484-96-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-89-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-86-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-82-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-81-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-77-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-73-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-71-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-62-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-64-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-58-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-54-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-53-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-52-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-51-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-50-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-49-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-48-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-47-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-46-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-55-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-43-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-45-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-42-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-41-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-40-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-39-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-35-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-95-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-94-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-93-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-92-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-91-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-90-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-88-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-87-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-85-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-60-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-84-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-83-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-79-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-80-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-78-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-76-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-75-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-74-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-72-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-68-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-63-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-70-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-69-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-67-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-66-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-65-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-61-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/484-59-0x00000000756C0000-0x00000000756C1000-memory.dmp
memory/4196-6-0x000001A665490000-0x000001A665606000-memory.dmp
memory/4196-4-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/4196-3-0x000001A665020000-0x000001A665042000-memory.dmp
memory/4196-0-0x00007FFB33A4F000-0x00007FFB33A50000-memory.dmp
memory/4196-19-0x000001A64C970000-0x000001A64C980000-memory.dmp
memory/4196-10-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/4196-13-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/4196-260-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/4196-9-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/4196-8-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/4196-7-0x000001A665820000-0x000001A665A2A000-memory.dmp
memory/4196-11-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp
memory/4196-5-0x00007FFB338C0000-0x00007FFB34264000-memory.dmp