c112ffc504d49d9185d662b73c7822e824d05cdf0408691a3ce03ab95223e74a

Analysis

max time kernel
298s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
src\main\resources\assets\sixsevenclient\spotify\smtc_bridge.ps1
Size 10KB
Sample260802-qrakdatele
SHA256 c112ffc504d49d9185d662b73c7822e824d05cdf0408691a3ce03ab95223e74a
MD5 8b426f349c72bc6414e131e770c2d468
SHA1 de4562d7549ff0f265a962524f0aaef04a53d86f
SHA512 ccf597925af503ad7d40ca689c8a985c63fcafe80659e0e7b646c285c85a28999708d32daef562a73d88449af09bc7a1b4e79c0487d9296db35688cbe4931531
SSDEEP 192:gLCcmwZiQUUgd2k8F04JCiRgdUVcKsyDDw5qfyDj/7+vckSGSCybIKDug1Cu3/Ow:gVrkUdiZqkUKq0P
TLSH
T19922F5193DD3A0792163E03E7E8E9242E734C40321AE7C50BA9CD695EF99DA2837D7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
620	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
620	PowerShell.exe
620	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 5484	620	PowerShell.exe	91
PID 5484 wrote to memory of 5716	5484	csc.exe	92

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\src\main\resources\assets\sixsevenclient\spotify\smtc_bridge.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v2zujgal\v2zujgal.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B41.tmp" "c:\Users\Admin\AppData\Local\Temp\v2zujgal\CSC91532D4E634E4919B1989DD227822380.TMP"
    3⤵
    PID:5716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES7B41.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7B41.tmp
Size 1KB
SHA256 903c3ffe058a0b328e984ead56fa428eb0a54ac23b1553f85e4a13552fe06b40
MD5 f1df04b8e1c6a3a774448ccc49071c8a
SHA1 a4acb0b050cc04d89bf9d781208e589cd02c2124
SHA512 b6cbd92d5ccfcf77098b990c2d9cba832a9ec5f666ae0b34633bf70f10c9947bb8de61f1fd40e7357e49195d5421d04889697d5d97fca541ced53878cb033615
TLSH
T14B21DD0583EC871FF0B357316AFA532FA174FDA5DFA2A36A4540022C2C01504EEE1A73
MD5 SHA1 SHA512 TLSH

Submit Download

v2zujgal.dll

Path C:\Users\Admin\AppData\Local\Temp\v2zujgal\v2zujgal.dll
Size 5KB
SHA256 37484fc0fd4fd53524c2b4aba4473237cbe921bc0ecf769a3f63e88c9911b5f3
MD5 10f4f90778ffc33b8d5794c847571ae5
SHA1 7d47977a1cab846464badbe3241ac5e57d6a8183
SHA512 4fa9f97814f992afc2d3f20470c98768a0fe9085f6fa063ae5e777397c1fd397deb8f7ab3b1b24733fab206d882bd0b65dec2b1f553d7cdc1b92fd8e87a444ad
SSDEEP 96:Xsm0Jv2fYE1QFVo8vhLd1gdqaasscsiYJS7K:F0J2wEWFvD1gdqEsiS
TLSH
T164C1B51163D58939E87B837CECF3875127B0D8646E72E35E1D98B92D3C423382622761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC91532D4E634E4919B1989DD227822380.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\v2zujgal\CSC91532D4E634E4919B1989DD227822380.TMP
Size 652B
SHA256 5a53455f066109193cefd5569572c145a2a8b078d780ab7686e9492587cbb8ba
MD5 f8b2673f60498c5184ade4cf3dca1f1f
SHA1 4e03718898ef831cb7a70ec0db25428587da593c
SHA512 f18aa46d54ad95e2ec77324dce7508ca852efa58a276081e23fdf8fe0696a0b16486b93e4eeee7703ba9552d98c3ff21c4ccfb1a03c558776a2d471b388ac2ef
TLSH
T107F0540963F8120EF1F35B30BDF5436791A9BCA5DE7293ED5880431918645109571F71
MD5 SHA1 SHA512 TLSH

Submit Download

v2zujgal.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\v2zujgal\v2zujgal.0.cs
Size 3KB
SHA256 4da2a0f6c16d73346e8e21ade7ecd39ceca7f581aacdc009f0e9e557587494ba
MD5 961f1371d72b211bf1a684de2e8d4dc6
SHA1 42a82f99b31df896bb2d830054466d8a20dd7aad
SHA512 eeef118a3384f2bb9c736a8d87276aa8939e54f54782a617f293d47ec034c2bf500446359a8ffa2aeb7e333597b2a08656b229b698af2c9329329363b5d3dde3
TLSH
T1468142082183703D6493623D7E4E41825B62C5031BFFF41ABE9C9721AF97AE693307E5
MD5 SHA1 SHA512 TLSH

Submit Download

v2zujgal.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\v2zujgal\v2zujgal.cmdline
Size 369B
SHA256 528ecba853e38658dd8975a61f087c3b0245f360bb075db7af60a1d61b1b80d8
MD5 95bd2886bb0ec53cf829e9eead0e5478
SHA1 e04a584edfc9df8a010ca1ba5c89ef0b5b6b0d57
SHA512 d5dc8f5c3be4ac4f34a08edb1d5ccf577608e627cf9c1a1800c40969e4c6829de9daf89287319d2cf0029e6b7d55c8aa204a201862370ac7134d8b8c91935463
TLSH
T176E0C02A8646C37F41FD500F2169C5BCC6B20F4B2E403F8450604C6DD01700B37D276B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/620-8-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-18-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-10-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-9-0x000001AD718A0000-0x000001AD718AA000-memory.dmp

Download

memory/620-11-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-12-0x000001AD718B0000-0x000001AD718B8000-memory.dmp

Download

memory/620-13-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-14-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-15-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-16-0x000001AD71960000-0x000001AD71986000-memory.dmp

Download

memory/620-17-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-0-0x00007FFB0BAEF000-0x00007FFB0BAF0000-memory.dmp

Download

memory/620-7-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-6-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-5-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-31-0x000001AD718F0000-0x000001AD718F8000-memory.dmp

Download

memory/620-4-0x000001AD593D0000-0x000001AD593F2000-memory.dmp

Download

memory/620-1-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-33-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-34-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/620-35-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download