67dc2a7036860a68e5312c212c31b8772ac463ed0289fcc44897867f55075e89

Analysis

max time kernel
152s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Oldblturer.exe
Size 168.6MB
Sample260712-rbq3vsbs3l
SHA256 67dc2a7036860a68e5312c212c31b8772ac463ed0289fcc44897867f55075e89
MD5 fbe2635ee2c0e774247127b54371b343
SHA1 e1b2434bc210206da2e8f6f442c11de19b87a11d
SHA512 2832fd5f238aa5d2b7c4ce3bfc81c71a3ea764ca596cc360fbd08270e1a885a9b5a2c6d21912d902997f70c675e6212cb0c755ddd6890becf22959205d9c06c6
SSDEEP 1572864:vOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:DgmeNxNNZxqV
TLSH
T1E2887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3220	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5128	WMIC.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3220	powershell.exe
3220	powershell.exe
3220	powershell.exe
3220	powershell.exe
3220	powershell.exe
5128	WMIC.exe
5128	WMIC.exe
5128	WMIC.exe
5128	WMIC.exe
6108	WMIC.exe
6108	WMIC.exe
6108	WMIC.exe
6108	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeShutdownPrivilege	1148	Oldblturer.exe
Token: SeCreatePagefilePrivilege	1148	Oldblturer.exe
Token: SeIncreaseQuotaPrivilege	5128	WMIC.exe
Token: SeSecurityPrivilege	5128	WMIC.exe
Token: SeTakeOwnershipPrivilege	5128	WMIC.exe
Token: SeLoadDriverPrivilege	5128	WMIC.exe
Token: SeSystemProfilePrivilege	5128	WMIC.exe
Token: SeSystemtimePrivilege	5128	WMIC.exe
Token: SeProfSingleProcessPrivilege	5128	WMIC.exe
Token: SeIncBasePriorityPrivilege	5128	WMIC.exe
Token: SeCreatePagefilePrivilege	5128	WMIC.exe
Token: SeBackupPrivilege	5128	WMIC.exe
Token: SeRestorePrivilege	5128	WMIC.exe
Token: SeShutdownPrivilege	5128	WMIC.exe
Token: SeDebugPrivilege	5128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5128	WMIC.exe
Token: SeRemoteShutdownPrivilege	5128	WMIC.exe
Token: SeUndockPrivilege	5128	WMIC.exe
Token: SeManageVolumePrivilege	5128	WMIC.exe
Token: 33	5128	WMIC.exe
Token: 34	5128	WMIC.exe
Token: 35	5128	WMIC.exe
Token: 36	5128	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5128	WMIC.exe
Token: SeSecurityPrivilege	5128	WMIC.exe
Token: SeTakeOwnershipPrivilege	5128	WMIC.exe
Token: SeLoadDriverPrivilege	5128	WMIC.exe
Token: SeSystemProfilePrivilege	5128	WMIC.exe
Token: SeSystemtimePrivilege	5128	WMIC.exe
Token: SeProfSingleProcessPrivilege	5128	WMIC.exe
Token: SeIncBasePriorityPrivilege	5128	WMIC.exe
Token: SeCreatePagefilePrivilege	5128	WMIC.exe
Token: SeBackupPrivilege	5128	WMIC.exe
Token: SeRestorePrivilege	5128	WMIC.exe
Token: SeShutdownPrivilege	5128	WMIC.exe
Token: SeDebugPrivilege	5128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5128	WMIC.exe
Token: SeRemoteShutdownPrivilege	5128	WMIC.exe
Token: SeUndockPrivilege	5128	WMIC.exe
Token: SeManageVolumePrivilege	5128	WMIC.exe
Token: 33	5128	WMIC.exe
Token: 34	5128	WMIC.exe
Token: 35	5128	WMIC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3220	1148	Oldblturer.exe	87
PID 1148 wrote to memory of 4948	1148	Oldblturer.exe	88
PID 1148 wrote to memory of 3528	1148	Oldblturer.exe	90
PID 3220 wrote to memory of 3076	3220	powershell.exe	91
PID 3076 wrote to memory of 4352	3076	csc.exe	92
PID 1148 wrote to memory of 2160	1148	Oldblturer.exe	93
PID 2160 wrote to memory of 5128	2160	cmd.exe	95
PID 1148 wrote to memory of 2256	1148	Oldblturer.exe	97
PID 2256 wrote to memory of 6108	2256	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe
"C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -STA -ExecutionPolicy Bypass -WindowStyle Hidden -NoLogo -File C:\Users\Admin\AppData\Local\Temp\loader_1783866297676.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pn1zgskd\pn1zgskd.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7891.tmp" "c:\Users\Admin\AppData\Local\Temp\pn1zgskd\CSC630F623924C84B0CA26169B4E415E94C.TMP"
      4⤵
      PID:4352
- C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe
  "C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\317_data_8laujazo" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1644 --field-trial-handle=1648,i,4178970810593169340,11551340975239893735,262144 --enable-features=kWebSQLAccess --disable-features=RendererCodeIntegrity,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:4948
- C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe
  "C:\Users\Admin\AppData\Local\Temp\Oldblturer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\317_data_8laujazo" --mojo-platform-channel-handle=1980 --field-trial-handle=1648,i,4178970810593169340,11551340975239893735,262144 --enable-features=kWebSQLAccess --disable-features=RendererCodeIntegrity,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name /value
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name /value"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

317_debug.log

Path C:\Users\Admin\AppData\Local\Temp\317_debug.log
Size 496B
SHA256 037b85988f5f8f164026dc7d640459b6976930a4b545985d864eedd5d757ef1e
MD5 9e9ebccbf0e403640734151a5f8af5fc
SHA1 97ea156c79987859d9b8e595da1595ab3da17049
SHA512 1b9a8b214a43d9056bcffaeefaaf87a5cdf7db264011b2e5811e45564423bcb9fc306f75ee69a84e91ffb0b1b51218cb537bd593975f90b319ab7b9785ede9c3
TLSH
T10DF0B49D5DB7C1AA8D784115C072CF2985DB7803A98C31C7BB52440D47D55C7BCD2D18
MD5 SHA1 SHA512 TLSH

Submit Download

RES7891.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7891.tmp
Size 1KB
SHA256 fbf6a082cb6c3a95a8aa873eef183b6e68fe0ffc298d914752f7e365738802f8
MD5 3f7a2a4bfd125039397d2f0f6ebc4cab
SHA1 526bcb3a0c29225dc6711953afa8633187d8e1b6
SHA512 a11b34e7822e009d91b01f4ec0cafad035fdff10469e1666658cc9a8770d498b4a422c16b8200198c517477ed2c2e0fbb402217ecb81cede7fbdd36a14f26a6e
TLSH
T1E121CC0493EC470EF0735731B9F6072F92B4FD68EFA1675B844002282C11644EEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

loader_1783866297676.ps1

Path C:\Users\Admin\AppData\Local\Temp\loader_1783866297676.ps1
Size 30KB
SHA256 009ca366bbf7148be0468629e57fd98074b596a02faf42975eabc2974c59d135
MD5 8f4bdb48fa4a519f91fdf1a9e8fe0476
SHA1 216bcc154e9340f942921472d17232b24e36858a
SHA512 c4f80a419f437da614d3d8aa2f82a6ee945ed2dfb2f26ef6772dcd655bae130ca213b9707b52c65309ed66dbc09cc79f37b589793dbb2f244942ad78644ee213
SSDEEP 192:pitgXyY6g/IH4BtMyyBo70eHIep2ghmJBzBBpPFUDjuy7f9TojcM1S/1Xj+Dyxdc:EtgVi0ANpPFUDjRcVXARb8
TLSH
T14CE29654A2FE0D29C3D3403A5BB17A007E2610B7931D9854B3DF83A8AF928A747B7DD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pn1zgskd.dll

Path C:\Users\Admin\AppData\Local\Temp\pn1zgskd\pn1zgskd.dll
Size 3KB
SHA256 8f57f77101323aeb24c7b8e7e83a28ad525b09df40f2d92737b10fb786140985
MD5 78b0e5c8c5a017b1ebfb6cac9e67710a
SHA1 4e0c5644f316f1c915344f91c0be3f5d5448cebd
SHA512 e16f1da7f7b523b1b4520c0f97a02b41e636619d539c3dd9c604c21a42f794e12d4ba54df5d99762a3661c2fd8ced60205302af25956eff70471598ba0cf6b5f
TLSH
T10451DE16A7F8466BE4770734AEE3436677B4F814AFB3972D49800218AC107649E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC630F623924C84B0CA26169B4E415E94C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\pn1zgskd\CSC630F623924C84B0CA26169B4E415E94C.TMP
Size 652B
SHA256 a28e512fd1d9a821ea75dc0c369e96830d79f4bd7386da76e093fa565871992b
MD5 af468a9737fc739f8ef6e85bc62adaf9
SHA1 c7923b64d44ca94bdeebc230a8fdecb0196ecf4f
SHA512 79d3ef109eb27a2f4e91b2567b6e69defd8dd3b88981514898d96fa63ab13bd6d262075e3ced777f3c10f87d14541a6ba52f8c8533baf125243b26da710982df
TLSH
T1A3F05E49A3F8520EF0F34B30FDF6436391A9BC64DE7293ED144003196C64A108A72FB6
MD5 SHA1 SHA512 TLSH

Submit Download

pn1zgskd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pn1zgskd\pn1zgskd.0.cs
Size 209B
SHA256 8e989516e25af008eb9ce2645276000b480890e55fa001a50f3eebbddfa23464
MD5 ddbeb10ddbefd09de0061465d3af002f
SHA1 d22a9e60e39101cfeb598c76984336e00926f7db
SHA512 d8155852e7d971370bf0330dfa45fff3801cbe68ef220a9dcfc20d38543e443368da43fe1e3ee20e2cc29209985c73064763fdcabe768b115f49d970fe7e06e8
TLSH
T17AD0231835F36DB0401348130C46F1FD77235137756D1905B7A50310DF4B01C4131E1A
MD5 SHA1 SHA512 TLSH

Submit Download

pn1zgskd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\pn1zgskd\pn1zgskd.cmdline
Size 369B
SHA256 f48e04e6bb872dbcb2b8039db409a1064508b9cc1823b69579a3046f713631b5
MD5 39d660a0974c0a3b41836dd0b0fdf553
SHA1 dcf78924851163493ad33cd03448e58b35529ea5
SHA512 097cdf17ba277d6c4c2e40cf17464540257071c99ec5b91da409665b3934b7fb1c92c13923fae0dcd6dd6dba8c3740d94a59e5c958c5f5cf5e73b6355466f3e6
TLSH
T11DE0262E935EC67D15FD104B226ADDECC2720B9729857FD4E150846EE0371086BD27B5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3076-28-0x00000222E32A0000-0x00000222E3C44000-memory.dmp

Download

memory/3220-15-0x00000178F71E0000-0x00000178F7202000-memory.dmp

Download

memory/3220-30-0x00000178F7260000-0x00000178F7268000-memory.dmp

Download

memory/3220-31-0x00000178FD0D0000-0x00000178FD10E000-memory.dmp

Download

memory/3220-32-0x00000178FD090000-0x00000178FD09E000-memory.dmp

Download