Analysis
- geolocation tags
- user interaction
yes - max time kernel
151s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 18:50
General
- Target meccha-camouflage-v1.7.2.exe
- Size 54.4MB
- Sample260802-xg2dnsec87
- SHA256 2e3364b4a9d3557bfe9d53cdc080ec1d29777c7414d593ed1c8cd4f0567683f6
Malware Config
Signatures
- Loads dropped DLL 39 IoCs
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\meccha-camouflage-v1.7.2.exe"C:\Users\Admin\AppData\Local\Temp\meccha-camouflage-v1.7.2.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JAB0AGEAcgBnAGUAdAAgAD0AIABbAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQARgB1AGwAbABQAGEAdABoACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwATQBlAGMAYwBoAGEAQwBhAG0AbwB1AGYAbABhAGcAZQAnACkALgBUAHIAaQBtAEUAbgBkACgAJwBcACcAKQA7ACAAJABwAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgAEcAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAOwAgACQAYwBvAG4AZgBpAGcAdQByAGUAZAAgAD0AIABAACgAJABwAHIAZQBmAGUAcgBlAG4AYwBlAC4ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAApADsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGMAYQBuAGQAaQBkAGEAdABlACAAaQBuACAAJABjAG8AbgBmAGkAZwB1AHIAZQBkACkAIAB7ACAAaQBmACAAKABbAHMAdAByAGkAbgBnAF0AOgA6AEkAcwBOAHUAbABsAE8AcgBXAGgAaQB0AGUAUwBwAGEAYwBlACgAJABjAGEAbgBkAGkAZABhAHQAZQApACkAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQA7ACAAdAByAHkAIAB7ACAAJABuAG8AcgBtAGEAbABpAHoAZQBkACAAPQAgAFsASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABGAHUAbABsAFAAYQB0AGgAKABbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBFAHgAcABhAG4AZABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAVgBhAHIAaQBhAGIAbABlAHMAKAAkAGMAYQBuAGQAaQBkAGEAdABlACkAKQAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ADsAIABpAGYAIAAoAFsAUwB0AHIAaQBuAGcAQwBvAG0AcABhAHIAZQByAF0AOgA6AE8AcgBkAGkAbgBhAGwASQBnAG4AbwByAGUAQwBhAHMAZQAuAEUAcQB1AGEAbABzACgAJAB0AGEAcgBnAGUAdAAsACAAJABuAG8AcgBtAGEAbABpAHoAZQBkACkAKQAgAHsAIABlAHgAaQB0ACAAMAAgAH0AIAB9ADsAIABpAGYAIAAoACQAcAByAGUAZgBlAHIAZQBuAGMAZQAuAEgAaQBkAGUARQB4AGMAbAB1AHMAaQBvAG4AcwBGAHIAbwBtAEwAbwBjAGEAbABVAHMAZQByAHMAIAAtAGUAcQAgACQAdAByAHUAZQAgAC0AbwByACAAJABwAHIAZQBmAGUAcgBlAG4AYwBlAC4ASABpAGQAZQBFAHgAYwBsAHUAcwBpAG8AbgBzAEYAcgBvAG0ATABvAGMAYQBsAEEAZABtAGkAbgBzACAALQBlAHEAIAAkAHQAcgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAMwAgAH0AOwAgAGUAeABpAHQAIAAyAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBjAGMAaABhAEMAYQBtAG8AdQBmAGwAYQBnAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwADsAIABlAHgAaQB0ACAAMAA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
startup-20260803-002311-3468.log
StartupProfileData-NonInteractive
MecchaCamouflage.Controller.dll
MecchaCamouflage.Core.dll
Microsoft.Win32.Registry.dll
Microsoft.Win32.SystemEvents.dll
System.Collections.Concurrent.dll
System.Collections.Immutable.dll
System.Collections.NonGeneric.dll
System.Collections.Specialized.dll
System.Collections.dll
System.ComponentModel.EventBasedAsync.dll
System.ComponentModel.Primitives.dll
System.ComponentModel.TypeConverter.dll
System.ComponentModel.dll
System.Diagnostics.Process.dll
System.Diagnostics.StackTrace.dll
System.Drawing.Common.dll
System.Drawing.Primitives.dll
System.IO.Pipelines.dll
System.Linq.Parallel.dll
System.Linq.dll
System.Memory.dll
System.Private.CoreLib.dll
System.Private.Uri.dll
System.Private.Windows.Core.dll
System.Private.Windows.GdiPlus.dll
System.Reflection.Metadata.dll
System.Runtime.InteropServices.dll
System.Security.Cryptography.dll
System.Text.Encodings.Web.dll
System.Text.Json.dll
System.Threading.Tasks.Parallel.dll
System.Threading.dll
System.Windows.Forms.Primitives.dll
System.Windows.Forms.dll
WebView2Loader.dll
meccha-camouflage.dll
__PSScriptPolicyTest_v0rfa5d5.zmc.ps1
memory/2444-354-0x000001EC66530000-0x000001EC66620000-memory.dmp
memory/4208-345-0x000001362B980000-0x000001362BA70000-memory.dmp
memory/4208-331-0x00007FF8E6D7F000-0x00007FF8E6D80000-memory.dmp
memory/4208-332-0x00007FF8E6BF0000-0x00007FF8E7594000-memory.dmp
memory/4208-333-0x00007FF8E6BF0000-0x00007FF8E7594000-memory.dmp
memory/4208-347-0x00007FF8E6BF0000-0x00007FF8E7594000-memory.dmp
memory/4208-346-0x00007FF8E6BF0000-0x00007FF8E7594000-memory.dmp
memory/4208-336-0x000001362B340000-0x000001362B362000-memory.dmp
memory/4208-343-0x000001362B4C0000-0x000001362B4CA000-memory.dmp
memory/4208-341-0x000001362B3E0000-0x000001362B3FE000-memory.dmp
memory/4208-342-0x000001362B400000-0x000001362B4B2000-memory.dmp
memory/4208-338-0x00007FF8E6BF0000-0x00007FF8E7594000-memory.dmp
memory/4208-337-0x00007FF8E6BF0000-0x00007FF8E7594000-memory.dmp