Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/07/2026, 06:39
General
- Target psl.exe
- Size 3.6MB
- Sample260714-heysfaas5t
- SHA256 68e91f0bde5d4c602eefa5e8057d65cf5a4af17021215736de2359fb4d577ce0
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\psl.exe"C:\Users\Admin\AppData\Local\Temp\psl.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\WinPslUpd" psl.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\WinPslUpd\psl.exe"C:\ProgramData\WinPslUpd\psl.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
psl.exe
DCRCVDrv.sys
memory/2832-4-0x0000000000400000-0x0000000000470000-memory.dmp
memory/2832-5-0x0000000075062000-0x0000000075063000-memory.dmp
memory/2832-6-0x0000000075050000-0x000000007580C000-memory.dmp
memory/2832-7-0x00000000058E0000-0x00000000058FA000-memory.dmp
memory/2832-8-0x0000000005900000-0x000000000592C000-memory.dmp
memory/2832-9-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-12-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-10-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-39-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-40-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-132-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-130-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-126-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-124-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-122-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-118-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-116-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-114-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-108-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-106-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-104-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-102-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-100-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-98-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-96-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-94-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-91-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-88-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-86-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-84-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-82-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-78-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-76-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-72-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-70-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-68-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-66-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-62-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-60-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-58-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-56-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-52-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-50-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-48-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-46-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-44-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-42-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-36-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-34-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-32-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-30-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-28-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-26-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-24-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-128-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-120-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-112-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-110-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-92-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-80-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-74-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-64-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-54-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-18-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-16-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-22-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-20-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-14-0x0000000005900000-0x0000000005926000-memory.dmp
memory/2832-1270-0x0000000005CA0000-0x0000000005D06000-memory.dmp
memory/2832-1271-0x0000000006AF0000-0x0000000006B82000-memory.dmp
memory/2832-1272-0x0000000007150000-0x000000000770A000-memory.dmp
memory/2832-1273-0x0000000075062000-0x0000000075063000-memory.dmp
memory/2832-1274-0x0000000075050000-0x000000007580C000-memory.dmp
memory/4256-2-0x0000000000010000-0x000000000003D000-memory.dmp