7e65494ef503f9ad559b1577b6eb9ad94242d016973a986104d4e3e78f46cce6

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SquadSeed-2.1.1/Check-SquadSeedPlayers.ps1
Size 46KB
Sample260807-phzbpsfg83
SHA256 7e65494ef503f9ad559b1577b6eb9ad94242d016973a986104d4e3e78f46cce6
MD5 42ad82cb8694bfb764af435296e568a3
SHA1 42d7205d6daa6623946dedc395e42539066276d4
SHA512 128ecf84a697c6687c92b64a09ae9d5694b9f2d69caf8e8542eb1887a21c199f0ed25fc04cd14577faa757f8346ac51fcbaaa4cd796e2355de00ea6a16a3aa94
SSDEEP 768:f459G+RbDGZDnWqE1hMhF5vDVj7Z5cyYdQdaNtz7lH6f14fyVPT1NmKGmmNejIf:f2R/0Dv38dQdglH6f14fyto
TLSH
T1EB23952975AAD26957C72466C8CF90403E321137610CDD187DDEE2C8AFCE53CC6B96AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	936	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
936	PowerShell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4936	cmd.exe
5980	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
936	PowerShell.exe
936	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	PowerShell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 2364	936	PowerShell.exe	90
PID 2364 wrote to memory of 4636	2364	csc.exe	91
PID 936 wrote to memory of 4936	936	PowerShell.exe	92
PID 4936 wrote to memory of 3476	4936	cmd.exe	93
PID 936 wrote to memory of 5980	936	PowerShell.exe	94
PID 5980 wrote to memory of 5984	5980	cmd.exe	95

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\SquadSeed-2.1.1\Check-SquadSeedPlayers.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zeix5rvu\zeix5rvu.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES695F.tmp" "c:\Users\Admin\AppData\Local\Temp\zeix5rvu\CSC99798E0B4B1345BEA53817E25F54913C.TMP"
    3⤵
    PID:4636
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "chcp 65001 >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3476
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "chcp 65001 >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES695F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES695F.tmp
Size 1KB
SHA256 a8c788d5964b11ff19e76e4bedb52c2bb5702ef8378d61734c395a8a9ab6bf08
MD5 7a3a5219477fbd5157e2b7f5e582d774
SHA1 a52d924520b3428550c5389605e661de6cdef448
SHA512 d43de031b667a345feeb23ceab105596af529d0ef1c03b5732cf9781bdaa44b5fc8376fe045ac85cf189cc6cbaa672e73812ec5a6dfd00d1726e926aaf731761
TLSH
T16A21CC0483ED471BF0B7573169FA471FA275FDA9EF6263AA854002291C12504EEE1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

zeix5rvu.dll

Path C:\Users\Admin\AppData\Local\Temp\zeix5rvu\zeix5rvu.dll
Size 4KB
SHA256 b75215c80435c14146332a26c14455beb3e41213e3a448d73febf6361669c966
MD5 1a40c7de4e7fc18c9eec918614860770
SHA1 a1ec174a0003caa32213d0760cc95d1a61017c5e
SHA512 7114797118dcfb6ef1b6126c9b33bb498c382d338a240c9241399d8647a1683728d83777c22867112226efdbb2bd059be77744b26987a0a5e14dd9125f17f84f
TLSH
T17A814317CBE94666E0760B30ADF3471673B0F8105F63635F1AA10229ACA1365AE32FF0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC99798E0B4B1345BEA53817E25F54913C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zeix5rvu\CSC99798E0B4B1345BEA53817E25F54913C.TMP
Size 652B
SHA256 64178908b4c7dc0fa19322d710032f21f19ec0e5f0f9018301e5b165f652d6a7
MD5 b57139b5d278f5ef136bd77f9957c7e1
SHA1 c60ad806226c38e770a8a3867b75ab2090bc739d
SHA512 f3621a658d70e2430b5934921628fc7a84c7dce67b43ba1aa65e54a35ccbafd42589b4569fbc200acbc7c2213398998449636a6f18c0e45edaa3134d9d04f80d
TLSH
T191F05E0963F8020EF0F34B30BDF68363A1A9BCA5DE3293ED148003196875510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zeix5rvu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zeix5rvu\zeix5rvu.0.cs
Size 1KB
SHA256 f456878d7c6020c9e20581d5d5a2096dc31a698861cc15b1c4f5bf82c6958cbf
MD5 0cd55077ca0c69f11dc8a5900ce29d9e
SHA1 97180214add7442a02589833cf6aa1d3f6a69947
SHA512 b58990f9da36a2f6e247d02653709ca0ee901087756f7823104b364d47ebd3d30418c40a7bf25f1fc7dc49115ffc554a8a7562eb99294f80dd5fd59ff07cf37a
TLSH
T149219E506E92859004B6502CDFCB65AABA17402B277E3C10B63E1221AF9706BE57DFDC
MD5 SHA1 SHA512 TLSH

Submit Download

zeix5rvu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zeix5rvu\zeix5rvu.cmdline
Size 607B
SHA256 b3743c720fa18aae620ce10efebe7bc9fed9bacfd00577988ee352595a4b2aa7
MD5 a9866e532495e6ff5c525587b8fe773b
SHA1 11e39a5aeda3734e49cae2f5949b53d5a38d6bc1
SHA512 d883c8634c53633e11302ac2825c67bd4c82e705baadf1a033a42e49f4ada4bd9cdf03ae9c7f69389327c6e582dad555bad64c935c4bcd9803c549e0a1fbbca6
TLSH
T178F0E139037BC5BE86EB3443156FCAACC2F7036B3082BF487584882EE5A39001B90B90
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-16-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-25-0x000001D212BC0000-0x000001D212BC8000-memory.dmp

Download

memory/936-9-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-7-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-6-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-15-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-5-0x000001D22AF30000-0x000001D22AF52000-memory.dmp

Download

memory/936-0-0x00007FFDFB5AF000-0x00007FFDFB5B0000-memory.dmp

Download

memory/936-4-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-23-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-3-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-8-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-26-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-27-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-28-0x000001D22E2F0000-0x000001D22E4B2000-memory.dmp

Download

memory/936-29-0x000001D22E9F0000-0x000001D22EF18000-memory.dmp

Download

memory/936-30-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-31-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-33-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-34-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download

memory/936-35-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp

Download