Analysis
- max time kernel
149s - max time network
107s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 08:27
General
- Target d8e18668b2df7bd01b48b0afc72818a7a42808714b09b0e3dc2b4713435dca5f.ps1
- Size 1KB
- Sample260802-kcl2zaydrd
- SHA256 d8e18668b2df7bd01b48b0afc72818a7a42808714b09b0e3dc2b4713435dca5f
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d8e18668b2df7bd01b48b0afc72818a7a42808714b09b0e3dc2b4713435dca5f.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oayt2dk1\oayt2dk1.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES258.tmp" "c:\Users\Admin\AppData\Local\Temp\oayt2dk1\CSC175169EFCA8943FEB2250C336146E87.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES258.tmp
oayt2dk1.dll
CSC175169EFCA8943FEB2250C336146E87.TMP
oayt2dk1.0.cs
oayt2dk1.cmdline
memory/4220-87-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-63-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-4-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-5-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-6-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-7-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-8-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-9-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-10-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-85-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-13-0x000002885F3B0000-0x000002885F400000-memory.dmp
memory/4220-12-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-14-0x000002885F4C0000-0x000002885F572000-memory.dmp
memory/4220-24-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-25-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-26-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-30-0x000002885F320000-0x000002885F328000-memory.dmp
memory/4220-31-0x000002885F8D0000-0x000002885FC7C000-memory.dmp
memory/4220-40-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-33-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-37-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-41-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-58-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-76-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-84-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-81-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-82-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-113-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-114-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-104-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-136-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-157-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-163-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-162-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-147-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-90-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-99-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-97-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-98-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-165-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-96-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-95-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-94-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-93-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-92-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-89-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-91-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-0-0x00007FF8C7C6F000-0x00007FF8C7C70000-memory.dmp
memory/4220-100-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-86-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-164-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-3-0x000002885F2B0000-0x000002885F2D2000-memory.dmp
memory/4220-11-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-83-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-80-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-74-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-102-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-77-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-78-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-79-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-88-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-73-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-72-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-69-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-68-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-67-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-66-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-64-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-70-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-71-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-57-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-62-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-61-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-59-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-60-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-54-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-55-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-56-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-53-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-52-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-50-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-75-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-49-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-47-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-48-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-46-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-43-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-42-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-65-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-39-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-38-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-44-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-45-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-51-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-36-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-35-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-34-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-32-0x0000028846D60000-0x0000028847D60000-memory.dmp
memory/4220-166-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-167-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-168-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/4220-170-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp