Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 16:49
General
- Target 34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe
- Size 751KB
- Sample260810-vb3y7sdl2v
- SHA256 34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 1 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe"C:\Users\Admin\AppData\Local\Temp\34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Frightens=gc -raw 'C:\Users\Admin\AppData\Local\magmaet\clenched\Hysterelcosis.Ski';$Cadmiummets=$Frightens.SubString(15121,3);.$Cadmiummets($Frightens) "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
nsExec.dll
Fenja.Bes
Hysterelcosis.Ski
unthick.ini
memory/5068-202-0x0000000000E10000-0x00000000020F6000-memory.dmp
memory/5844-166-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-144-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-145-0x0000000004F70000-0x0000000004F92000-memory.dmp
memory/5844-147-0x00000000057F0000-0x0000000005856000-memory.dmp
memory/5844-146-0x0000000005780000-0x00000000057E6000-memory.dmp
memory/5844-150-0x00000000059A0000-0x0000000005CFB000-memory.dmp
memory/5844-151-0x0000000005D50000-0x0000000005D6E000-memory.dmp
memory/5844-152-0x0000000005DB0000-0x0000000005DFC000-memory.dmp
memory/5844-153-0x0000000006D10000-0x0000000006DA6000-memory.dmp
memory/5844-154-0x0000000006290000-0x00000000062AA000-memory.dmp
memory/5844-155-0x00000000062E0000-0x0000000006302000-memory.dmp
memory/5844-156-0x00000000075C0000-0x0000000007B7A000-memory.dmp
memory/5844-142-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-158-0x0000000008200000-0x000000000887C000-memory.dmp
memory/5844-159-0x0000000007180000-0x00000000071B6000-memory.dmp
memory/5844-160-0x00000000709F0000-0x0000000070A3C000-memory.dmp
memory/5844-163-0x00000000071C0000-0x00000000071E0000-memory.dmp
memory/5844-165-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-164-0x00000000071F0000-0x0000000007293000-memory.dmp
memory/5844-143-0x0000000004FC0000-0x000000000560A000-memory.dmp
memory/5844-169-0x0000000007470000-0x0000000007481000-memory.dmp
memory/5844-167-0x00000000072F0000-0x00000000072FA000-memory.dmp
memory/5844-168-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-170-0x0000000007490000-0x00000000074A0000-memory.dmp
memory/5844-171-0x00000000074A0000-0x00000000074B5000-memory.dmp
memory/5844-172-0x00000000074F0000-0x000000000750C000-memory.dmp
memory/5844-175-0x00000000074E0000-0x00000000074E8000-memory.dmp
memory/5844-176-0x0000000074052000-0x0000000074053000-memory.dmp
memory/5844-177-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-178-0x00000000074F0000-0x000000000751A000-memory.dmp
memory/5844-179-0x0000000007540000-0x0000000007564000-memory.dmp
memory/5844-180-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-181-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-182-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-141-0x0000000002880000-0x00000000028B6000-memory.dmp
memory/5844-184-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-185-0x0000000008880000-0x000000000A2DB000-memory.dmp
memory/5844-186-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-187-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-188-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-190-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-191-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-192-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5844-140-0x0000000074052000-0x0000000074053000-memory.dmp