Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 14:35
General
- Target 5ab6146383251745d552bfc9cd4561ee1a74fb2e5b0aac0e9d60028db4dee087.exe
- Size 8.8MB
- Sample260813-rxzbcsbe59
- SHA256 5ab6146383251745d552bfc9cd4561ee1a74fb2e5b0aac0e9d60028db4dee087
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL 19 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ab6146383251745d552bfc9cd4561ee1a74fb2e5b0aac0e9d60028db4dee087.exe"C:\Users\Admin\AppData\Local\Temp\5ab6146383251745d552bfc9cd4561ee1a74fb2e5b0aac0e9d60028db4dee087.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5ab6146383251745d552bfc9cd4561ee1a74fb2e5b0aac0e9d60028db4dee087.exe"C:\Users\Admin\AppData\Local\Temp\5ab6146383251745d552bfc9cd4561ee1a74fb2e5b0aac0e9d60028db4dee087.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "python.exe -m pip install --upgrade pip"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "winget install Git.Git -i --interactive"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command choco"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command choco4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell winget install Chocolatey.Chocolatey --silent --accept-package-agreements --accept-source-agreements"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell winget install Chocolatey.Chocolatey --silent --accept-package-agreements --accept-source-agreements4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell winget install Chocolatey.Chocolatey --silent --accept-package-agreements --accept-source-agreements"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell winget install Chocolatey.Chocolatey --silent --accept-package-agreements --accept-source-agreements4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "iex \"& {$(irm get.scoop.sh)} -RunAsAdmin\""3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $env:Path += \";$HOME\scoop\shims\" "3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command scoop update3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
base_library.zip
cacert.pem
md.cp312-win_amd64.pyd
md__mypyc.cp312-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python312.dll
select.pyd
unicodedata.pyd
__PSScriptPolicyTest_2adae3i0.vhe.ps1
memory/1196-76-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/1196-94-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/1196-84-0x0000027A1F0E0000-0x0000027A1F0FE000-memory.dmp
memory/1196-85-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/1196-86-0x0000027A1F0A0000-0x0000027A1F0AA000-memory.dmp
memory/1196-87-0x0000027A1F100000-0x0000027A1F11C000-memory.dmp
memory/1196-88-0x0000027A1F0B0000-0x0000027A1F0B8000-memory.dmp
memory/1196-89-0x0000027A1F0C0000-0x0000027A1F0C6000-memory.dmp
memory/1196-90-0x0000027A1F120000-0x0000027A1F12A000-memory.dmp
memory/1196-91-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/1196-93-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/1196-83-0x0000027A1F090000-0x0000027A1F09A000-memory.dmp
memory/1196-82-0x0000027A1EFD0000-0x0000027A1F082000-memory.dmp
memory/1196-81-0x0000027A1EFB0000-0x0000027A1EFCE000-memory.dmp
memory/1196-70-0x00007FFCEA8CF000-0x00007FFCEA8D0000-memory.dmp
memory/1196-78-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/1196-71-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/1196-77-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/1196-75-0x0000027A06F00000-0x0000027A06F22000-memory.dmp
memory/1196-72-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/4580-138-0x00000158BBB30000-0x00000158BBBE2000-memory.dmp
memory/4644-100-0x00000232D3130000-0x00000232D3633000-memory.dmp
memory/6124-107-0x0000015D7E590000-0x0000015D7E642000-memory.dmp