Overview

overview

7

Static

static

1

BUILD_EXE.cmd

windows10-2004-x64

7

BUILD_EXE.cmd

windows11-ltsc_2024-x64

7

BUILD_EXE.ps1

windows10-2004-x64

7

BUILD_EXE.ps1

windows11-ltsc_2024-x64

7

XenoDumpInspector.js

windows10-2004-x64

3

XenoDumpInspector.js

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    898s
  • max time network
    680s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 16:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BUILD_EXE.ps1
  • Size 1KB
  • Sample260804-ve97paszew
  • SHA256 602cecb661067927fe42dfee3a2cbc9fa618116022fe76ca2fa7e9c47927c70c
  • MD5 SHA1 SHA512 TLSH
Score
7/10
execution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\BUILD_EXE.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:exe /optimize+ /langversion:5 /reference:System.dll /reference:System.Core.dll /reference:System.Security.dll /out:C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.cs
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA8C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5FD2C9C114D0452C881DC4C4AD4517.TMP"
        3⤵
          PID:2272
      • C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe
        "C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1484

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          RESDA8C.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\RESDA8C.tmp
          • Size 1KB
          • SHA256 41eb6ab70c0a3f1c75d2148cd45657efcf0a836a686fb74572e1273b799bf0a4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          XenoDumpInspector.exe
          • Path C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe
          • Size 12KB
          • SHA256 87ba6965b29dc69d877d47ec30bb2ef09646b01e1225b17fc01d4a4054322906
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_coyqgva1.rcl.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_coyqgva1.rcl.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CSC5FD2C9C114D0452C881DC4C4AD4517.TMP
          • Path \??\c:\Users\Admin\AppData\Local\Temp\CSC5FD2C9C114D0452C881DC4C4AD4517.TMP
          • Size 1KB
          • SHA256 0de4aaed3c8e53f6817db7fcf3827487b234968b7f9a27b4ce5db28849155ff7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1484-19-0x0000000000EA0000-0x0000000000EAA000-memory.dmp
          Download

          memory/4980-0-0x0000021DB2620000-0x0000021DB2630000-memory.dmp
          Download

          memory/4980-1-0x0000021DB2620000-0x0000021DB2630000-memory.dmp
          Download

          memory/4980-9-0x0000021D99F10000-0x0000021D99F32000-memory.dmp
          Download

          memory/4980-21-0x0000021DB2620000-0x0000021DB2630000-memory.dmp
          Download

          memory/4980-20-0x0000021DB2620000-0x0000021DB2630000-memory.dmp
          Download