Analysis
- geolocation tags
- max time kernel
599s - max time network
462s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 02:55
General
- Target ArmDot 2026 Latest Version/ArmDot 2026/keygens/cpp/ArmDotKeyGen.ps1
- Size 36KB
- Sample260711-devcssay2j
- SHA256 fcd80504d1e408d6184294f0f39b3f8a4fbb6e6a491f52a1620f00f2fe8bc299
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\ArmDot 2026 Latest Version\ArmDot 2026\keygens\cpp\ArmDotKeyGen.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3132-0-0x00007FFA37DBF000-0x00007FFA37DC0000-memory.dmp
memory/3132-3-0x000001D6F7550000-0x000001D6F7572000-memory.dmp
memory/3132-4-0x00007FFA37C30000-0x00007FFA385D4000-memory.dmp
memory/3132-5-0x00007FFA37C30000-0x00007FFA385D4000-memory.dmp
memory/3132-6-0x00007FFA37C30000-0x00007FFA385D4000-memory.dmp
memory/3132-7-0x00007FFA37C30000-0x00007FFA385D4000-memory.dmp
memory/3132-8-0x00007FFA37C30000-0x00007FFA385D4000-memory.dmp
memory/3132-9-0x00007FFA37C30000-0x00007FFA385D4000-memory.dmp
memory/3132-10-0x00007FFA37C30000-0x00007FFA385D4000-memory.dmp
memory/3132-12-0x00007FFA37C30000-0x00007FFA385D4000-memory.dmp