c112ffc504d49d9185d662b73c7822e824d05cdf0408691a3ce03ab95223e74a

Analysis

max time kernel
298s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
src\main\resources\assets\sixsevenclient\spotify\smtc_bridge.ps1
Size 10KB
Sample260802-qrakdatele
SHA256 c112ffc504d49d9185d662b73c7822e824d05cdf0408691a3ce03ab95223e74a
MD5 8b426f349c72bc6414e131e770c2d468
SHA1 de4562d7549ff0f265a962524f0aaef04a53d86f
SHA512 ccf597925af503ad7d40ca689c8a985c63fcafe80659e0e7b646c285c85a28999708d32daef562a73d88449af09bc7a1b4e79c0487d9296db35688cbe4931531
SSDEEP 192:gLCcmwZiQUUgd2k8F04JCiRgdUVcKsyDDw5qfyDj/7+vckSGSCybIKDug1Cu3/Ow:gVrkUdiZqkUKq0P
TLSH
T19922F5193DD3A0792163E03E7E8E9242E734C40321AE7C50BA9CD695EF99DA2837D7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1720	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1720	powershell.exe
1720	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1180	1720	powershell.exe	88
PID 1180 wrote to memory of 4960	1180	csc.exe	89

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\src\main\resources\assets\sixsevenclient\spotify\smtc_bridge.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bsw2dt2a\bsw2dt2a.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B72.tmp" "c:\Users\Admin\AppData\Local\Temp\bsw2dt2a\CSCB61F5C42C6D7452FA9B8CDEB362481C5.TMP"
    3⤵
    PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8B72.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8B72.tmp
Size 1KB
SHA256 26457b57ac8daf1530c74783c7d022bee60b4947233a17196cd0de5b288381f9
MD5 274586d59a94b43b5e2d7c1a9b3a4f4e
SHA1 f8f6b230d2a68a3629830544bfd11ed501a9debf
SHA512 1c67c826df562b25c4ab006734ce5224c8a21a7b6a344137b6412ec453d57591cc11c438a59c9cfa012dc24a878904295f5d62b7fe7e11e9fc7a7cd243fa7e54
TLSH
T1AD21C30A43ED471EF07357316AF5135BA178FE94EFA2A35B8580521C2C41504EDA1F73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_h3gl1dfd.0yn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3gl1dfd.0yn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bsw2dt2a.dll

Path C:\Users\Admin\AppData\Local\Temp\bsw2dt2a\bsw2dt2a.dll
Size 5KB
SHA256 486064ca48750de19e69a44937a8564825d7c2b9140725a209966f3812d6097d
MD5 fc8589c4b0bf716895b8c553c0b55271
SHA1 3da905637c476d64de8e999af695f66ef4007770
SHA512 8af36754e4c6eff38e7fd5a179ddf31e5e44307c5fd890ed7f6bcf23cbaad63f4fbb5fc5738bcfcce0c1f3b5edc442e73393322eaab25b92cfe66c0fd3e86505
SSDEEP 96:Wsm0Jv2fYE1QFVo8vhLug1gdqaas0cyiYJSPK:i0J2wEWFvwg1gdq8yie
TLSH
T10AC1A61663D18938E87A837CECF3976127B0D8646972E39D1DA8792D3C023746622761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCB61F5C42C6D7452FA9B8CDEB362481C5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bsw2dt2a\CSCB61F5C42C6D7452FA9B8CDEB362481C5.TMP
Size 652B
SHA256 ff752df490797d87a7e2230dc619f3c4e5efea3fce511cc47cf9b47bb5dd7d39
MD5 e5a56fc385f9a63b7711fead16ca4e9b
SHA1 0a8735ef5bd3d958b5faa53463c658d603cd6b05
SHA512 68987868b39c3d12b21ef995b8442e6c9f2e871791d1a9b41aa1f307489239ac3b2a529249429ff9aa3bdd40f3ebf4fec9b2e69d4aade925e202cfc18d4ff798
TLSH
T123F0300D63F8020AF0F38B70B9F543A3A168BCA4DE7293ED1480031D2C645109561F71
MD5 SHA1 SHA512 TLSH

Submit Download

bsw2dt2a.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bsw2dt2a\bsw2dt2a.0.cs
Size 3KB
SHA256 4da2a0f6c16d73346e8e21ade7ecd39ceca7f581aacdc009f0e9e557587494ba
MD5 961f1371d72b211bf1a684de2e8d4dc6
SHA1 42a82f99b31df896bb2d830054466d8a20dd7aad
SHA512 eeef118a3384f2bb9c736a8d87276aa8939e54f54782a617f293d47ec034c2bf500446359a8ffa2aeb7e333597b2a08656b229b698af2c9329329363b5d3dde3
TLSH
T1468142082183703D6493623D7E4E41825B62C5031BFFF41ABE9C9721AF97AE693307E5
MD5 SHA1 SHA512 TLSH

Submit Download

bsw2dt2a.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bsw2dt2a\bsw2dt2a.cmdline
Size 369B
SHA256 0fc2cd1edf00a86fcaca503c907be97aab8616982707872aaddb2d537fc85c00
MD5 5848d5543d67a49a47ca712d4a3d8f5b
SHA1 8dfd98588b120a9ab0b0abfb710e5e4af6678359
SHA512 5f7b8202ce123501b7e32a4f0038ab01bb674d777decd99f1574bc2373c2d79b136357a07627f39cb0e504fd3bcf0ae28cf7fbb3a405a883f1e5a3cab61eeecb
TLSH
T1A1E0682F42B6C27D21F9200B2379C4ECA2F20B4339823FD45174548EE11780027E1B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1720-0-0x0000018925DF0000-0x0000018925E00000-memory.dmp

Download

memory/1720-13-0x0000018925DF0000-0x0000018925E00000-memory.dmp

Download

memory/1720-1-0x0000018925DF0000-0x0000018925E00000-memory.dmp

Download

memory/1720-10-0x0000018928550000-0x000001892855A000-memory.dmp

Download

memory/1720-11-0x0000018928560000-0x0000018928568000-memory.dmp

Download

memory/1720-9-0x0000018925DC0000-0x0000018925DE2000-memory.dmp

Download

memory/1720-12-0x0000018928890000-0x00000189288B6000-memory.dmp

Download

memory/1720-26-0x00000189285A0000-0x00000189285A8000-memory.dmp

Download

memory/1720-27-0x0000018925DF0000-0x0000018925E00000-memory.dmp

Download

memory/1720-28-0x0000018925DF0000-0x0000018925E00000-memory.dmp

Download

memory/1720-29-0x0000018925DF0000-0x0000018925E00000-memory.dmp

Download

memory/1720-30-0x0000018925DF0000-0x0000018925E00000-memory.dmp

Download

memory/1720-31-0x0000018925DF0000-0x0000018925E00000-memory.dmp

Download