Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/08/2026, 10:09
General
- Target 8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada.exe
- Size 826KB
- Sample260801-l626qasdkc
- SHA256 8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada.exe"C:\Users\Admin\AppData\Local\Temp\8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle minimized ""$Manvrens=GC -raw 'C:\Users\Admin\AppData\Local\Temp\politimesterens\malposed\humate\Pretangible.Kuv';$Reduplicate=$Manvrens.SubString(54487,3); .$Reduplicate($Manvrens)""2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_q0euxnkn.tfv.ps1
nsExec.dll
Pretangible.Kuv
Terminational.gen
memory/1140-61-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/1140-65-0x0000000007290000-0x000000000729A000-memory.dmp
memory/1140-33-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/1140-34-0x00000000056D0000-0x0000000005736000-memory.dmp
memory/1140-31-0x0000000004DC0000-0x00000000053E8000-memory.dmp
memory/1140-42-0x0000000005740000-0x0000000005A94000-memory.dmp
memory/1140-43-0x0000000005D30000-0x0000000005D4E000-memory.dmp
memory/1140-44-0x0000000005D60000-0x0000000005DAC000-memory.dmp
memory/1140-45-0x0000000006EF0000-0x0000000006F86000-memory.dmp
memory/1140-46-0x0000000006210000-0x000000000622A000-memory.dmp
memory/1140-47-0x0000000006280000-0x00000000062A2000-memory.dmp
memory/1140-48-0x0000000007570000-0x0000000007B14000-memory.dmp
memory/1140-30-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/1140-50-0x00000000081A0000-0x000000000881A000-memory.dmp
memory/1140-51-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1140-52-0x0000000007120000-0x0000000007152000-memory.dmp
memory/1140-53-0x0000000070690000-0x00000000706DC000-memory.dmp
memory/1140-62-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/1140-29-0x0000000004750000-0x0000000004786000-memory.dmp
memory/1140-63-0x0000000007160000-0x000000000717E000-memory.dmp
memory/1140-32-0x0000000004D60000-0x0000000004D82000-memory.dmp
memory/1140-66-0x00000000073F0000-0x0000000007401000-memory.dmp
memory/1140-64-0x0000000007190000-0x0000000007233000-memory.dmp
memory/1140-67-0x0000000007440000-0x000000000744E000-memory.dmp
memory/1140-68-0x0000000007450000-0x0000000007464000-memory.dmp
memory/1140-69-0x0000000007490000-0x00000000074AA000-memory.dmp
memory/1140-70-0x0000000007480000-0x0000000007488000-memory.dmp
memory/1140-71-0x00000000074F0000-0x000000000751A000-memory.dmp
memory/1140-72-0x0000000007520000-0x0000000007544000-memory.dmp
memory/1140-74-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/1140-73-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/1140-76-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/1140-28-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/1140-78-0x0000000007B90000-0x0000000007B93000-memory.dmp
memory/1140-79-0x0000000008820000-0x000000000D299000-memory.dmp
memory/1140-80-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1140-82-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/1140-81-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/1140-83-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/1140-84-0x0000000007B90000-0x0000000007B93000-memory.dmp
memory/3696-86-0x0000000000A10000-0x0000000001C64000-memory.dmp