Analysis
- max time kernel
898s - max time network
431s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/07/2026, 04:29
General
- Target $R0/Uninstall Arcbound.exe
- Size 191KB
- Sample260708-e4js2aay6v
- SHA256 cbb62df66665787b5d66bd8a41a7ae9f4b50302643b280dc3e994b6b6a03d6b4
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes dropped EXE 1 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Loads dropped DLL 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Arcbound.exe"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Arcbound.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Temp\$R0', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_p0vfc25w.tez.ps1
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
Un_A.exe
memory/1740-72-0x0000000007CF0000-0x0000000007D01000-memory.dmp
memory/1740-71-0x0000000007D80000-0x0000000007E16000-memory.dmp
memory/1740-63-0x00000000702D0000-0x000000007031C000-memory.dmp
memory/2584-100-0x0000000006F40000-0x0000000006FE3000-memory.dmp
memory/2584-92-0x00000000702B0000-0x00000000702FC000-memory.dmp
memory/2584-91-0x00000000064B0000-0x00000000064FC000-memory.dmp
memory/2584-101-0x0000000070450000-0x00000000707A4000-memory.dmp
memory/2584-89-0x0000000005910000-0x0000000005C64000-memory.dmp
memory/2792-19-0x0000000005700000-0x0000000005766000-memory.dmp
memory/2792-31-0x0000000006340000-0x0000000006372000-memory.dmp
memory/2792-40-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/2792-43-0x0000000007710000-0x0000000007D8A000-memory.dmp
memory/2792-44-0x00000000070C0000-0x00000000070DA000-memory.dmp
memory/2792-45-0x0000000007130000-0x000000000713A000-memory.dmp
memory/2792-46-0x00000000072B0000-0x00000000072DA000-memory.dmp
memory/2792-47-0x00000000072E0000-0x0000000007304000-memory.dmp
memory/2792-48-0x0000000070A50000-0x0000000070DA4000-memory.dmp
memory/2792-41-0x0000000006320000-0x000000000633E000-memory.dmp
memory/2792-32-0x00000000702D0000-0x000000007031C000-memory.dmp
memory/2792-42-0x0000000006F70000-0x0000000007013000-memory.dmp
memory/2792-30-0x000000007F870000-0x000000007F880000-memory.dmp
memory/2792-29-0x0000000005E10000-0x0000000005E5C000-memory.dmp
memory/2792-28-0x0000000005D80000-0x0000000005D9E000-memory.dmp
memory/2792-27-0x0000000005770000-0x0000000005AC4000-memory.dmp
memory/2792-18-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/2792-17-0x00000000054F0000-0x0000000005512000-memory.dmp
memory/2792-16-0x0000000004E60000-0x0000000005488000-memory.dmp
memory/2792-15-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/2792-14-0x00000000047F0000-0x0000000004826000-memory.dmp
memory/2792-13-0x00000000027C0000-0x00000000027D0000-memory.dmp