Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 00:10
General
- Target AlphaXLauncher.exe
- Size 19KB
- Sample260701-af4fbact3s
- SHA256 1934f0295229c7add71777f10dac0a91272a2c8769ef3742f80d498037673079
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AlphaXLauncher.exe"C:\Users\Admin\AppData\Local\Temp\AlphaXLauncher.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Bin\AlphaXBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bin\AlphaXBootstrapper.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bin\AlphaX.exe"C:\Users\Admin\AppData\Local\Temp\Bin\AlphaX.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AlphaX.exe
AlphaX.exe.config
AlphaXBootstrapper.exe
__PSScriptPolicyTest_yk4i5o0f.tne.ps1
memory/3904-183-0x00000000061E0000-0x00000000061E8000-memory.dmp
memory/3904-182-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/3904-181-0x0000000000110000-0x0000000000140000-memory.dmp
memory/5816-3-0x0000000005970000-0x0000000005A02000-memory.dmp
memory/5816-0-0x00000000747A2000-0x00000000747A3000-memory.dmp
memory/5816-11-0x00000000747A2000-0x00000000747A3000-memory.dmp
memory/5816-2-0x0000000005E90000-0x000000000644A000-memory.dmp
memory/5816-1-0x0000000000F60000-0x0000000000F6A000-memory.dmp
memory/5816-55-0x0000000074790000-0x0000000074F4C000-memory.dmp
memory/5816-41-0x0000000074790000-0x0000000074F4C000-memory.dmp
memory/5908-33-0x0000000007800000-0x00000000078A3000-memory.dmp
memory/5908-17-0x0000000006020000-0x000000000637B000-memory.dmp
memory/5908-21-0x00000000065A0000-0x00000000065EC000-memory.dmp
memory/5908-22-0x0000000007740000-0x0000000007776000-memory.dmp
memory/5908-23-0x0000000074790000-0x0000000074F4C000-memory.dmp
memory/5908-24-0x00000000702C0000-0x000000007030C000-memory.dmp
memory/5908-31-0x0000000006B50000-0x0000000006B70000-memory.dmp
memory/5908-32-0x0000000074790000-0x0000000074F4C000-memory.dmp
memory/5908-18-0x0000000074790000-0x0000000074F4C000-memory.dmp
memory/5908-34-0x0000000007FA0000-0x000000000861C000-memory.dmp
memory/5908-35-0x0000000007960000-0x000000000797A000-memory.dmp
memory/5908-36-0x00000000079D0000-0x00000000079DA000-memory.dmp
memory/5908-37-0x0000000007BD0000-0x0000000007C66000-memory.dmp
memory/5908-38-0x0000000074790000-0x0000000074F4C000-memory.dmp
memory/5908-40-0x0000000074790000-0x0000000074F4C000-memory.dmp
memory/5908-20-0x0000000006550000-0x000000000656E000-memory.dmp
memory/5908-9-0x0000000005830000-0x0000000005896000-memory.dmp
memory/5908-4-0x0000000003050000-0x0000000003086000-memory.dmp
memory/5908-10-0x0000000005F70000-0x0000000005FD6000-memory.dmp
memory/5908-5-0x0000000005920000-0x0000000005F6A000-memory.dmp
memory/5908-6-0x0000000074790000-0x0000000074F4C000-memory.dmp
memory/5908-8-0x0000000074790000-0x0000000074F4C000-memory.dmp
memory/5908-7-0x0000000005780000-0x00000000057A2000-memory.dmp
memory/6952-64-0x0000000009D50000-0x0000000009D62000-memory.dmp
memory/6952-63-0x0000000009D20000-0x0000000009D2A000-memory.dmp
memory/6952-59-0x000000000B4F0000-0x000000000B50E000-memory.dmp
memory/6952-58-0x000000000B520000-0x000000000B596000-memory.dmp
memory/6952-56-0x0000000009E20000-0x0000000009E5E000-memory.dmp
memory/6952-57-0x0000000009DE0000-0x0000000009DEE000-memory.dmp
memory/6952-54-0x00000000000A0000-0x00000000000B2000-memory.dmp