Analysis
- max time kernel
899s - max time network
463s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 16:55
General
- Target BUILD_EXE.ps1
- Size 1KB
- Sample260804-ve97paszew
- SHA256 602cecb661067927fe42dfee3a2cbc9fa618116022fe76ca2fa7e9c47927c70c
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\BUILD_EXE.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:exe /optimize+ /langversion:5 /reference:System.dll /reference:System.Core.dll /reference:System.Security.dll /out:C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.cs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC82799E3BA34E4D05AF954A479F5A43EA.TMP"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe"C:\Users\Admin\AppData\Local\Temp\XenoDumpInspector.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESC1C.tmp
XenoDumpInspector.exe
CSC82799E3BA34E4D05AF954A479F5A43EA.TMP
memory/2420-15-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-17-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-7-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-8-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-9-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-10-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-11-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-12-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-13-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-0-0x00007FFCF55BF000-0x00007FFCF55C0000-memory.dmp
memory/2420-16-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-6-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-5-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-4-0x0000020EFE280000-0x0000020EFE2A2000-memory.dmp
memory/2420-1-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-32-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2420-31-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/4864-26-0x0000000000230000-0x000000000023A000-memory.dmp
memory/4864-29-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/4864-28-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/4864-27-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/4864-33-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp