Analysis
- max time kernel
149s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 12:19
General
- Target E18D10F2AB43.ps1
- Size 28KB
- Sample260808-phc4gawfrc
- SHA256 5dc0a9d83867ae1be8bbc36463b4627cf44aaf8dd2da025699318ffcb549e7e3
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- cURL User-Agent 4 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\E18D10F2AB43.ps12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w5sezwi5\w5sezwi5.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17F3.tmp" "c:\Users\Admin\AppData\Local\Temp\w5sezwi5\CSCA4D165C35BC84E2987503AE6D7158490.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jkbewzpd\jkbewzpd.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1880.tmp" "c:\Users\Admin\AppData\Local\Temp\jkbewzpd\CSC3991EA2B73DA405E9533521EF6B034E2.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\djhgbvrk\djhgbvrk.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES191C.tmp" "c:\Users\Admin\AppData\Local\Temp\djhgbvrk\CSCFAD192C574A47DAB73236741FB6316E.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rxlxbcak\rxlxbcak.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES19A8.tmp" "c:\Users\Admin\AppData\Local\Temp\rxlxbcak\CSC4B530E9CA5E147099A836BB2A78C4D65.TMP"4⤵
-
-
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe" -k netsvcs2⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES17F3.tmp
RES1880.tmp
RES191C.tmp
RES19A8.tmp
djhgbvrk.dll
jkbewzpd.dll
rxlxbcak.dll
w5sezwi5.dll
CSCFAD192C574A47DAB73236741FB6316E.TMP
djhgbvrk.0.cs
djhgbvrk.cmdline
CSC3991EA2B73DA405E9533521EF6B034E2.TMP
jkbewzpd.0.cs
jkbewzpd.cmdline
CSC4B530E9CA5E147099A836BB2A78C4D65.TMP
rxlxbcak.0.cs
rxlxbcak.cmdline
CSCA4D165C35BC84E2987503AE6D7158490.TMP
w5sezwi5.0.cs
w5sezwi5.cmdline
memory/4344-16-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-4-0x0000023FB8C40000-0x0000023FB8C62000-memory.dmp
memory/4344-30-0x0000023FB8BB0000-0x0000023FB8BB8000-memory.dmp
memory/4344-69-0x0000023FB8CA0000-0x0000023FB8CA8000-memory.dmp
memory/4344-17-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-0-0x00007FF89765F000-0x00007FF897660000-memory.dmp
memory/4344-15-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-14-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-56-0x0000023FB8C90000-0x0000023FB8C98000-memory.dmp
memory/4344-13-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-12-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-11-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-10-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-9-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-8-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-6-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-7-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-43-0x0000023FB8C70000-0x0000023FB8C78000-memory.dmp
memory/4344-5-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-1-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4344-84-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/4532-85-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-86-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-91-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-90-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-89-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-88-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-93-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-82-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-92-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-87-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-70-0x000001865C4F0000-0x000001865C560000-memory.dmp
memory/4532-83-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-81-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-80-0x0000000180000000-0x0000000180076000-memory.dmp
memory/4532-73-0x0000000180000000-0x0000000180076000-memory.dmp