5d5cd70cf760b62aa3eb044cd0e9d0a9d70bedf9c277fc26eced2915a18087f3

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ALPHA WEB BANKING _ Απόδειξη Συναλλαγής..js
Size 814KB
Sample260807-mazldsfc45
SHA256 5d5cd70cf760b62aa3eb044cd0e9d0a9d70bedf9c277fc26eced2915a18087f3
MD5 2fc5dddf808b0447b6d430e2fc629080
SHA1 0366e214048220e35f437cd56568fe57b2d3c318
SHA512 a1b0370b5113594cb2c13c6800759d0a8a9e84553feaff0705e04043fa02e02623cd7685199e924aa6285ee7e4f024a352ce3de9a9e2d611d44457321b6c3b3c
SSDEEP 24576:v0gngT90w4YVLHRlUYn0XmGyIzER9s4fj512B5hycRF:vohIYvVr7R9s6jIz
TLSH
T159058D9A9033DF3AD80879AC3B331993B7DC5536CF55AA609A8DDDBD10D846C39B09B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
936	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1892	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 936 set thread context of 1900	936	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
936	powershell.exe
936	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5248 wrote to memory of 1892	5248	wscript.exe	91
PID 1892 wrote to memory of 936	1892	wscript.exe	92
PID 936 wrote to memory of 4788	936	powershell.exe	94
PID 4788 wrote to memory of 428	4788	csc.exe	95
PID 936 wrote to memory of 1900	936	powershell.exe	96
PID 936 wrote to memory of 1900	936	powershell.exe	96
PID 936 wrote to memory of 1900	936	powershell.exe	96
PID 936 wrote to memory of 1900	936	powershell.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\ALPHA WEB BANKING _ Απόδειξη Συναλλαγής..js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\z407mjsz\run_26387_8d3d.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\z407mjsz\net_93298_8d1c.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xmg4ileg\xmg4ileg.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF652.tmp" "c:\Users\Admin\AppData\Local\Temp\xmg4ileg\CSCE063B76C766D4BDB8C96B48BA64A9FEC.TMP"
        5⤵
        
        PID:428
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1900

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESF652.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF652.tmp
Size 1KB
SHA256 d61aba072dbe5bba70c4d488a1de1af0f3c844f2eda7b6c9101beaad2e6c0518
MD5 eb0ab8a73d867032fe307049727e5fff
SHA1 936cec4c87a1292b911b44f86457cd2e0e8f588d
SHA512 cc90964bf76d3b9d0a36f3d992796592c84a049c7cf3cf31a1634466569f266910fb517c272a708b6c8446536b2acfc4d7f05ef0cc99f5366596de33574b626f
TLSH
T1CD216A0993E9470FF0B74732A9F6171BA278FD55EFA2935E894002282C42504EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

xmg4ileg.dll

Path C:\Users\Admin\AppData\Local\Temp\xmg4ileg\xmg4ileg.dll
Size 3KB
SHA256 45b89e63bebfb7866045f85b303c9fd2d60cba3d19aff06ec8ad9344fa183f04
MD5 3e794d035b837b5d55d20c771a7e96d6
SHA1 39d4cd06cf9894ae4f0a4b1b12d8ddbe6d307578
SHA512 bb909d6959554210b1c8966426577f16b1690b473100e349bdedc06336bbcc2d276ade16237ddd7a49bfdd6682cfae099d1f70f81795e183da50131addcf3ef1
TLSH
T16F51DD1A5BE84A2BF4730B316EF3472677B4FC109BB3635E1D900228AC616645A31FF0
MD5 SHA1 SHA512 TLSH

Submit Download

cfg_32853_8d1b

Path C:\Users\Admin\AppData\Local\Temp\z407mjsz\cfg_32853_8d1b
Size 329KB
SHA256 e38745a913cb584898db30cb48219ba5013b6d59932774e173323a08795f6a0d
MD5 ce07fcf31a685622f6fb4ccd9a1dd3dc
SHA1 5b798611edd2f8e13826da59d3b72f999ef7310c
SHA512 006098dac6dc7772592aa5b18b6e6e5d422776ca044cc9a08e329161a862e0b196e00c8596833ab2a7b4e60ddc7b6f6d7bf58644184afbe52a00e533c0941445
SSDEEP 6144:IHusf9ToVGr+LvZQ88KwPF54OdeUQT13Y+jWx/Rq8wfsbiNgKzqjdP:ausf9ToQ6VCKQYgvQJHjWTI2JP
TLSH
T1FB74230FEE59FD1A42DC32507CFD0B8D698DEAC408A7FD6A419774E262C6F05A24B5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_93298_8d1c.ps1

Path C:\Users\Admin\AppData\Local\Temp\z407mjsz\net_93298_8d1c.ps1
Size 5KB
SHA256 0290012987434b3b0eda51dabcf55142dd7dd0e162a9f98c15d70ac48c4ba5ec
MD5 00eabed038e68c5bfdd46d0fc172d28a
SHA1 938aa66589d0890491fb70ffe3d4440ed1ec1a80
SHA512 76d3df26666a5c39cd5a055c453fea64f7e192a4d5cc4bd36453e7ce8aab850ddf47f4314d8b0ca68d4ac695f46288bf43035c31affbbc6a82b6be7303519b03
SSDEEP 96:aJcQulO9GG3z5Xayg9GUij/f5m3UXRf58khQGIoBY67tKhwwDMJWtUvrcXquyUNk:gmOEG39XaygEUij/fwWRfBhIomItKh4j
TLSH
T1F3C1860B7ADA4BFA02C3707459B65551B2A8D437225F1D04F2ECC2CAAF06434D7F52AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run_26387_8d3d.vbs

Path C:\Users\Admin\AppData\Local\Temp\z407mjsz\run_26387_8d3d.vbs
Size 228B
SHA256 78ba8ab2dd5d4f03b2ce5c780538c6cd5485b62e95d7b34aac0a2c29e65b7f79
MD5 ce5f44a01a4e49410ae8e326d345b0b4
SHA1 b8190970661bda6de76fc43900215174b070fd98
SHA512 c7d4d763c541d133001c52b34dbd07c5583efee4691dde8d2e276728dc6b88ee74dc2a9711ac071305996786f19868bfc98c0b2c5ddb28b553a6c92475920750
TLSH
T102D02320753AF21CCC39C97905B7C67C85E3945D2300575267D09544FAC117DCEAD64A
MD5 SHA1 SHA512 TLSH

Submit Download

tmp_39520_8d1a

Path C:\Users\Admin\AppData\Local\Temp\z407mjsz\tmp_39520_8d1a
Size 39KB
SHA256 7dd379aa71bf1e5dd0081cabfe7df2cf16556be3f19b32ea6434a93a073a5279
MD5 e882c43a2a2d0d14e7b9d0568b7eadcd
SHA1 b77f099e7800d95f449b28f49e7c6d0cce7c34ce
SHA512 001f7ce28eec5717cdcf627433df9b7cdff05b48060ea58a9999d7555ed616177c3dfb4d4a2f1fa0b50865cccd325273039af9fa74767fb4ae433c03b492923e
SSDEEP 768:/bzarQt5oIuXpjUhZnbTVuj/REdxnAdKjL11klKyY4aS7Uv8GWkjvUhs0eZ2:zzjt59u5GZn/sju/nAdM1mHtaoGvUhsi
TLSH
T101030278C4B98974874D1CFFCAE64F03A6880DE0C0ABE9154878B7D9171B5EB89CB439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCE063B76C766D4BDB8C96B48BA64A9FEC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xmg4ileg\CSCE063B76C766D4BDB8C96B48BA64A9FEC.TMP
Size 652B
SHA256 d2851c766498ed336720fdca46ebeeaf3652cb80a5d0901b9a6e2dcb532078d5
MD5 b4be30ca2ed4d3891e522855d65ff6d3
SHA1 9ef93bd1a75fd0616510f00e07458d3b1a74b1af
SHA512 266b7d29132d8d125d1d56e66e87291988923cdf1c4ee8cb3e6f442614f448a6486c462c46b0fdba25c0fb4a2bdfc57a5fbcf472aa8339a6051ebc248d0ffbc3
TLSH
T1B5F05E4963F8020EF0F34B31BDF64363A1A9FC64DE7293ED1850031928649248962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xmg4ileg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xmg4ileg\xmg4ileg.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

xmg4ileg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xmg4ileg\xmg4ileg.cmdline
Size 369B
SHA256 dc69261994cccaf06443e99e118c45e0bad133f9ff75f605f5be310d0f55cfaf
MD5 9a347c30cb6f2ebe8ae7245f3684391e
SHA1 7af3931897042e3bf48d40d5272d9a48b3102d22
SHA512 a49955ce36c2bed56be9f8dd1c52c2d3727ec83ad420f6438b4d2abc41370d20cef11de855623ccbc99838594c48217f4dafa20e33c7709e52b51286486b4e28
TLSH
T166E0C03A426EC67D21ED304B2A79C4ACC27207433941BF846992881DF05740027D1F86
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-12-0x0000021A21870000-0x0000021A21886000-memory.dmp

Download

memory/936-26-0x0000021A21880000-0x0000021A21888000-memory.dmp

Download

memory/936-6-0x0000021A217E0000-0x0000021A21802000-memory.dmp

Download

memory/936-27-0x0000021A21AE0000-0x0000021A21AE8000-memory.dmp

Download

memory/1900-28-0x0000000000400000-0x000000000048E000-memory.dmp

Download

memory/4788-24-0x000002530E300000-0x000002530ECA4000-memory.dmp

Download