mofksys | ecba08fd6e47535e2fecf0673ce5e6b49e752e9d6df0b02846ec1aef72a183a8

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LOA-AD-169919-169930.pdf.js
Size 2.8MB
Sample260812-j7261ascle
SHA256 ecba08fd6e47535e2fecf0673ce5e6b49e752e9d6df0b02846ec1aef72a183a8
MD5 56a1a04402525db58d698133ba613816
SHA1 6630ac851417dc223a752f37a22f68b1ef80ddb5
SHA512 51373947263912aa1d457543ee9f68c13fb59bbb530f9ac82ba8fcd70c2154917ee7c28bb97daf800703155c2bf6db593471f98ad3179e6dac5121abe696f01a
SSDEEP 12288:0c5PaLPI1IuivT41LOAtIgaREB3TeVyZHrRRkWs+0+GiTg1/bR40STZi/3ZNx0/e:0c5PaTI1I/vT48AFtkkKL
TLSH
T11ED5FA91361D2A151821379DE48C925E8F55C09A1FE2EAF0F8DF06E4654F10E2EECF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution mofksys worm

Malware Config

Signatures

Family: Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys

Detects Mofksys worm 4 IoCs

resource	yara_rule
behavioral2/memory/4340-24-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/memory/4340-26-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/memory/4340-29-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral2/memory/4340-31-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4420	powershell.exe

ConfuserEx .NET packer 2 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/4420-21-0x00000288AE060000-0x00000288AE074000-memory.dmp	ConfuserEx
behavioral2/memory/4420-23-0x00000288AE340000-0x00000288AE354000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 18 IoCs

description	pid	Process	procid_target
PID 4420 set thread context of 4340	4420	powershell.exe	95
PID 4420 set thread context of 704	4420	powershell.exe	96
PID 4420 set thread context of 2948	4420	powershell.exe	97
PID 4420 set thread context of 2564	4420	powershell.exe	98
PID 4420 set thread context of 2744	4420	powershell.exe	100
PID 4420 set thread context of 4032	4420	powershell.exe	102
PID 4420 set thread context of 1336	4420	powershell.exe	104
PID 4420 set thread context of 5892	4420	powershell.exe	106
PID 4420 set thread context of 4456	4420	powershell.exe	107
PID 4420 set thread context of 5748	4420	powershell.exe	108
PID 4420 set thread context of 5460	4420	powershell.exe	110
PID 4420 set thread context of 6036	4420	powershell.exe	112
PID 4420 set thread context of 5964	4420	powershell.exe	113
PID 4420 set thread context of 5264	4420	powershell.exe	116
PID 4420 set thread context of 4996	4420	powershell.exe	117
PID 4420 set thread context of 3040	4420	powershell.exe	118
PID 4420 set thread context of 1700	4420	powershell.exe	119
PID 4420 set thread context of 4824	4420	powershell.exe	121

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5988	taskkill.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	5988	taskkill.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
4340	aspnet_compiler.exe
4340	aspnet_compiler.exe
704	aspnet_compiler.exe
704	aspnet_compiler.exe
2948	aspnet_compiler.exe
2948	aspnet_compiler.exe
2564	aspnet_compiler.exe
2564	aspnet_compiler.exe
2744	aspnet_compiler.exe
2744	aspnet_compiler.exe
4032	aspnet_compiler.exe
4032	aspnet_compiler.exe
1336	aspnet_compiler.exe
1336	aspnet_compiler.exe
5892	aspnet_compiler.exe
5892	aspnet_compiler.exe
4456	aspnet_compiler.exe
4456	aspnet_compiler.exe
5748	aspnet_compiler.exe
5748	aspnet_compiler.exe
5460	aspnet_compiler.exe
5460	aspnet_compiler.exe
6036	aspnet_compiler.exe
6036	aspnet_compiler.exe
5964	aspnet_compiler.exe
5964	aspnet_compiler.exe
5264	aspnet_compiler.exe
5264	aspnet_compiler.exe
4996	aspnet_compiler.exe
4996	aspnet_compiler.exe
3040	aspnet_compiler.exe
3040	aspnet_compiler.exe
1700	aspnet_compiler.exe
1700	aspnet_compiler.exe
4824	aspnet_compiler.exe
4824	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 4420	2392	wscript.exe	88
PID 4420 wrote to memory of 3400	4420	powershell.exe	90
PID 4420 wrote to memory of 3816	4420	powershell.exe	91
PID 4420 wrote to memory of 5000	4420	powershell.exe	92
PID 4420 wrote to memory of 5236	4420	powershell.exe	93
PID 4420 wrote to memory of 4832	4420	powershell.exe	94
PID 4420 wrote to memory of 4340	4420	powershell.exe	95
PID 4420 wrote to memory of 4340	4420	powershell.exe	95
PID 4420 wrote to memory of 4340	4420	powershell.exe	95
PID 4420 wrote to memory of 4340	4420	powershell.exe	95
PID 4420 wrote to memory of 4340	4420	powershell.exe	95
PID 4420 wrote to memory of 4340	4420	powershell.exe	95
PID 4420 wrote to memory of 704	4420	powershell.exe	96
PID 4420 wrote to memory of 704	4420	powershell.exe	96
PID 4420 wrote to memory of 704	4420	powershell.exe	96
PID 4420 wrote to memory of 704	4420	powershell.exe	96
PID 4420 wrote to memory of 704	4420	powershell.exe	96
PID 4420 wrote to memory of 704	4420	powershell.exe	96
PID 4420 wrote to memory of 2948	4420	powershell.exe	97
PID 4420 wrote to memory of 2948	4420	powershell.exe	97
PID 4420 wrote to memory of 2948	4420	powershell.exe	97
PID 4420 wrote to memory of 2948	4420	powershell.exe	97
PID 4420 wrote to memory of 2948	4420	powershell.exe	97
PID 4420 wrote to memory of 2948	4420	powershell.exe	97
PID 4420 wrote to memory of 2564	4420	powershell.exe	98
PID 4420 wrote to memory of 2564	4420	powershell.exe	98
PID 4420 wrote to memory of 2564	4420	powershell.exe	98
PID 4420 wrote to memory of 2564	4420	powershell.exe	98
PID 4420 wrote to memory of 2564	4420	powershell.exe	98
PID 4420 wrote to memory of 2564	4420	powershell.exe	98
PID 4420 wrote to memory of 4648	4420	powershell.exe	99
PID 4420 wrote to memory of 2744	4420	powershell.exe	100
PID 4420 wrote to memory of 2744	4420	powershell.exe	100
PID 4420 wrote to memory of 2744	4420	powershell.exe	100
PID 4420 wrote to memory of 2744	4420	powershell.exe	100
PID 4420 wrote to memory of 2744	4420	powershell.exe	100
PID 4420 wrote to memory of 2744	4420	powershell.exe	100
PID 4420 wrote to memory of 2112	4420	powershell.exe	101
PID 4420 wrote to memory of 4032	4420	powershell.exe	102
PID 4420 wrote to memory of 4032	4420	powershell.exe	102
PID 4420 wrote to memory of 4032	4420	powershell.exe	102
PID 4420 wrote to memory of 4032	4420	powershell.exe	102
PID 4420 wrote to memory of 4032	4420	powershell.exe	102
PID 4420 wrote to memory of 4032	4420	powershell.exe	102
PID 4420 wrote to memory of 4072	4420	powershell.exe	103
PID 4420 wrote to memory of 1336	4420	powershell.exe	104
PID 4420 wrote to memory of 1336	4420	powershell.exe	104
PID 4420 wrote to memory of 1336	4420	powershell.exe	104
PID 4420 wrote to memory of 1336	4420	powershell.exe	104
PID 4420 wrote to memory of 1336	4420	powershell.exe	104
PID 4420 wrote to memory of 1336	4420	powershell.exe	104
PID 4420 wrote to memory of 1596	4420	powershell.exe	105
PID 4420 wrote to memory of 5892	4420	powershell.exe	106
PID 4420 wrote to memory of 5892	4420	powershell.exe	106
PID 4420 wrote to memory of 5892	4420	powershell.exe	106
PID 4420 wrote to memory of 5892	4420	powershell.exe	106
PID 4420 wrote to memory of 5892	4420	powershell.exe	106
PID 4420 wrote to memory of 5892	4420	powershell.exe	106
PID 4420 wrote to memory of 4456	4420	powershell.exe	107
PID 4420 wrote to memory of 4456	4420	powershell.exe	107
PID 4420 wrote to memory of 4456	4420	powershell.exe	107
PID 4420 wrote to memory of 4456	4420	powershell.exe	107
PID 4420 wrote to memory of 4456	4420	powershell.exe	107
PID 4420 wrote to memory of 4456	4420	powershell.exe	107

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\LOA-AD-169919-169930.pdf.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_LQxQRwLUlBay_1786522771583.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3400
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5000
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5236
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4832
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4340
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2564
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4648
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4072
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1336
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1596
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4456
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5748
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5648
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5460
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1476
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6036
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5964
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5468
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5264
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1700
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4956
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4824
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_LQxQRwLUlBay_1786522771583.ps1

Path C:\Temp\ps_LQxQRwLUlBay_1786522771583.ps1
Size 2.0MB
SHA256 d34b4d151c32c7cac9e18b8605c4970b1015e892fbf22ab04c50950eac1db8b7
MD5 ffc62cb4ddc4a40a069b7ef6f1b45ce6
SHA1 657caec9070d1ca64f421df43002748b9dad7590
SHA512 52de3fdfd2c4ccc54f6f37c4b4a075dcb54ff3b751e939f9dc77a14cb3e13fc6daf6bf4510cbd2b241b120a3262b494b24b6ccba60cca59013d48e3582852caa
SSDEEP 24576:gPbxBlZRj2qjUyOywuQctZ7KpdbJH/d9UF4k6zNHggwU3fwE8yeHb+wE8yeHb+wq:h
TLSH
T18BA543D52D5429F4E11CE1E9863C9DA5D377276ADC49EB8B0322478282DCA0A7F1CCBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4340-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4340-31-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4340-29-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4340-26-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4420-10-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-19-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-1-0x00007FFC7966F000-0x00007FFC79670000-memory.dmp

Download

memory/4420-11-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-12-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-13-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-14-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-15-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-16-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-17-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-18-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-9-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-20-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-22-0x00000288AE110000-0x00000288AE116000-memory.dmp

Download

memory/4420-21-0x00000288AE060000-0x00000288AE074000-memory.dmp

Download

memory/4420-23-0x00000288AE340000-0x00000288AE354000-memory.dmp

Download

memory/4420-8-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-6-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-5-0x00000288AE070000-0x00000288AE092000-memory.dmp

Download

memory/4420-2-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-38-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-39-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/4420-120-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download