Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 12:12
General
- Target vcapcha.ps1
- Size 5KB
- Sample260804-pdkyhsag56
- SHA256 cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\vcapcha.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4rq4ut2e\4rq4ut2e.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES84F5.tmp" "c:\Users\Admin\AppData\Local\Temp\4rq4ut2e\CSC51B8422BC98448E4AD5D7D9D8C2C69F7.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
4rq4ut2e.dll
RES84F5.tmp
4rq4ut2e.0.cs
4rq4ut2e.cmdline
CSC51B8422BC98448E4AD5D7D9D8C2C69F7.TMP
memory/1220-29-0x0000023E62470000-0x0000023E62E14000-memory.dmp
memory/1856-41-0x0000023F23D30000-0x0000023F23D4E000-memory.dmp
memory/1856-75-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-5-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-6-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-7-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-8-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-9-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-10-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-11-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-12-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-13-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-14-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-15-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-16-0x0000023F23D90000-0x0000023F23F52000-memory.dmp
memory/1856-17-0x0000023F24490000-0x0000023F249B8000-memory.dmp
memory/1856-1-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-31-0x0000023F23980000-0x0000023F23988000-memory.dmp
memory/1856-37-0x0000023F23F60000-0x0000023F24012000-memory.dmp
memory/1856-36-0x0000023F23CF0000-0x0000023F23D0E000-memory.dmp
memory/1856-38-0x0000023F23BE0000-0x0000023F23BEA000-memory.dmp
memory/1856-39-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-40-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-0-0x0000023F0AF0C000-0x0000023F0AF0D000-memory.dmp
memory/1856-44-0x0000023F23CF0000-0x0000023F23CFA000-memory.dmp
memory/1856-4-0x0000023F23780000-0x0000023F237A2000-memory.dmp
memory/1856-45-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-47-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-48-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-49-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-52-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-53-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-55-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-56-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-54-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-57-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-58-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-63-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-65-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-68-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-69-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-70-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-74-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-46-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-76-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-77-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-78-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-79-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-80-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-81-0x0000023F0A770000-0x0000023F0B114000-memory.dmp
memory/1856-83-0x0000023F0A770000-0x0000023F0B114000-memory.dmp