c0adb0e65a915ee89e148ac52f23c8d04a377c2e2c1209a8ddc88479b8bdfe49

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ.js
Size 165KB
Sample260804-p6ra1abc49
SHA256 c0adb0e65a915ee89e148ac52f23c8d04a377c2e2c1209a8ddc88479b8bdfe49
MD5 caaefa7d1cfcfc3aa1713c1cc10e1130
SHA1 cc4d21054143987ea7ca39e951ae95f105073d6f
SHA512 506de612a19bc03c532b6b02ac9b8a84b6e592bd9ac9fe027af9a853e3e0197c7784509f6332b7ca97e3f80f7bd4758a6a8116e18c561e41b7a7bda9238c721c
SSDEEP 3072:XRwtMFRiP0sS4s70uxgK5n5PHI+Ibtn+E/MFHwk0CA5sy6QtUmc:hwtMriMf7Rx7Po+IB+ZFHwk9A5w03c
TLSH
T1C5F3B09196802B78FAA44FDE101D11A6D2F2F1663D2A2346FDB26F47F736D14B834A34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 27 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2768	powershell.exe
8	2768	powershell.exe
9	2768	powershell.exe
10	2768	powershell.exe
12	2768	powershell.exe
13	2768	powershell.exe
14	2768	powershell.exe
15	2768	powershell.exe
16	2768	powershell.exe
17	2768	powershell.exe
18	2768	powershell.exe
19	2768	powershell.exe
20	2768	powershell.exe
21	2768	powershell.exe
22	2768	powershell.exe
23	2768	powershell.exe
24	2768	powershell.exe
25	2768	powershell.exe
26	2768	powershell.exe
27	2768	powershell.exe
28	2768	powershell.exe
29	2768	powershell.exe
30	2768	powershell.exe
31	2768	powershell.exe
32	2768	powershell.exe
33	2768	powershell.exe
34	2768	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3404	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	powershell.exe
2768	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 4208	2096	wscript.exe	89
PID 4208 wrote to memory of 5940	4208	conhost.exe	90
PID 5940 wrote to memory of 3404	5940	conhost.exe	91
PID 3404 wrote to memory of 3344	3404	cmd.exe	92
PID 3404 wrote to memory of 2768	3404	cmd.exe	93

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless conhost.exe --headless cmd.exe /c "echo $ExecutionContext.InvokeCommand.InvokeScript([Environment]::GetEnvironmentVariable('ZLeKq7bK8MNVc0L','Process'))| powershell.exe -w H -NOP -noNI -"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\System32\conhost.exe
    conhost.exe --headless cmd.exe /c "echo $ExecutionContext.InvokeCommand.InvokeScript([Environment]::GetEnvironmentVariable('ZLeKq7bK8MNVc0L','Process'))| powershell.exe -w H -NOP -noNI -"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Windows\System32\cmd.exe
      cmd.exe /c "echo $ExecutionContext.InvokeCommand.InvokeScript([Environment]::GetEnvironmentVariable('ZLeKq7bK8MNVc0L','Process'))| powershell.exe -w H -NOP -noNI -"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $ExecutionContext.InvokeCommand.InvokeScript([Environment]::GetEnvironmentVariable('ZLeKq7bK8MNVc0L','Process'))"
        5⤵
        
        PID:3344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -w H -NOP -noNI -
        5⤵
        Badlisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2768-0-0x00007FFC1769F000-0x00007FFC176A0000-memory.dmp

Download

memory/2768-3-0x00000219C9990000-0x00000219C99B2000-memory.dmp

Download

memory/2768-4-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/2768-5-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/2768-6-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/2768-7-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/2768-8-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/2768-9-0x00000219C9A00000-0x00000219C9A50000-memory.dmp

Download

memory/2768-10-0x00000219C9A50000-0x00000219C9A62000-memory.dmp

Download

memory/2768-11-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/2768-12-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/2768-13-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/2768-14-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download