Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 18:24
General
- Target install.ps1
- Size 21KB
- Sample260727-w2awsay1ev
- SHA256 3b760303efb36935bafc187d5f2660ab9607b22fdfb8d0213eb16c0f163fff3f
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps11⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\.herdr\packages\standalone\releases\.staging.0.7.5-preview.2026-07-21-0f10e1453a7f-x86_64-pc-windows-msvc.2836\herdr.exe"C:\Users\Admin\.herdr\packages\standalone\releases\.staging.0.7.5-preview.2026-07-21-0f10e1453a7f-x86_64-pc-windows-msvc.2836\herdr.exe" --version2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\.herdr\packages\standalone\releases\0.7.5-preview.2026-07-21-0f10e1453a7f-x86_64-pc-windows-msvc\herdr.exe"C:\Users\Admin\.herdr\packages\standalone\releases\0.7.5-preview.2026-07-21-0f10e1453a7f-x86_64-pc-windows-msvc\herdr.exe" --version2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
herdr.exe
memory/2836-20-0x0000027ECDE90000-0x0000027ECDE9A000-memory.dmp
memory/2836-22-0x0000027ECDEF0000-0x0000027ECDF0C000-memory.dmp
memory/2836-5-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-6-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-7-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-8-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-11-0x0000027ECDE70000-0x0000027ECDE8E000-memory.dmp
memory/2836-12-0x0000027ECE130000-0x0000027ECE1E2000-memory.dmp
memory/2836-21-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-14-0x0000027ECDE60000-0x0000027ECDE6A000-memory.dmp
memory/2836-15-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-16-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-17-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-18-0x0000027ECDEB0000-0x0000027ECDECE000-memory.dmp
memory/2836-3-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-19-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-13-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-0-0x00007FFFF8E1F000-0x00007FFFF8E20000-memory.dmp
memory/2836-23-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-24-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-25-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-26-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-27-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-28-0x0000027ECDEA0000-0x0000027ECDEA8000-memory.dmp
memory/2836-30-0x0000027ECDEE0000-0x0000027ECDEEA000-memory.dmp
memory/2836-29-0x0000027ECDED0000-0x0000027ECDED6000-memory.dmp
memory/2836-32-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-33-0x0000027ECEA90000-0x0000027ECEC52000-memory.dmp
memory/2836-34-0x0000027ECF190000-0x0000027ECF6B8000-memory.dmp
memory/2836-37-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2836-4-0x0000027ECDDE0000-0x0000027ECDE02000-memory.dmp
memory/2836-44-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp