443f8d200f34118a39a44515e273ab4ccd0410948e6236afec0be544dee469fb

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
powershell-stage2.ps1
Size 244KB
Sample260815-grthtaeb58
SHA256 443f8d200f34118a39a44515e273ab4ccd0410948e6236afec0be544dee469fb
MD5 803eb027b14fa82ea0683b92eacc9a24
SHA1 000c0628ba6b85460257a1815fccbebf33bb56bf
SHA512 9a9417b798924468f1615f4c825552bea4911083867b0b248d3b92dbdd5fd2ca4ec8bb562c37074926b77cf40b9bde02b22729c83f5363ba0bd68f98bd151266
SSDEEP 6144:ka5mch1d4UkSmFRXsKK71uSwdgoelpLkh7NZW5As6VAQZMz/DYm:kumGH47R2ucLkh7DgALej/DJ
TLSH
T15C342326DA21BAEFC36DD22D202A6344108A8FCDDD4D8CDC9E7EF981461D6EC816D44F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	4952	powershell.exe
16	4952	powershell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/4952-25-0x00000205ADF80000-0x00000205ADFC0000-memory.dmp	ConfuserEx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4952	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1720	4952	powershell.exe	85
PID 1720 wrote to memory of 1596	1720	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\powershell-stage2.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d3in3fik\d3in3fik.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A35.tmp" "c:\Users\Admin\AppData\Local\Temp\d3in3fik\CSCFEC30BCFF454A8BA56B701B2B8B1392.TMP"
    3⤵
    PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3A35.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3A35.tmp
Size 1KB
SHA256 f1b153c59708556f734a8aca3d80ae743e53db43a34ccc23477edf06c1c49f87
MD5 93eac1239a2c36c4c8736d963c554896
SHA1 8730cfa87f0c5aa74ee1aede9d3c8d7d23b6fee9
SHA512 34783ca18b69c66b90342961b17c57fd6c035f01987f1437c0c340d902c8af92205cefe8bb3bb45645dc97956784dc5630a563f7837372e95e128f9c6aac1403
TLSH
T10721EB4583E8471FF0B3873169F6032FA238FD65EF62675B8641422C2C51644EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ixwxi12d.2o1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ixwxi12d.2o1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

d3in3fik.dll

Path C:\Users\Admin\AppData\Local\Temp\d3in3fik\d3in3fik.dll
Size 3KB
SHA256 9077825998094e65e47eeeb812913790b936b5ae7aa26c00c9be18aab1d848bf
MD5 c7040b80a0454e43154b70bc76c2fa0e
SHA1 331a2eb70634d916bc8c677135b5c6afff6a6cb1
SHA512 075da97c1019d1fe55bdc057343582ed6da86ca1500cacba899792c0f928f98a27c34dc69810d4c26039d822817cc9e7c613d2b2b61ae4145016ca4d60c02cd9
TLSH
T109510E2AA3E8822BE4B70730AEF3436237B4FC459F7357694980022CAC207649D35FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFEC30BCFF454A8BA56B701B2B8B1392.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\d3in3fik\CSCFEC30BCFF454A8BA56B701B2B8B1392.TMP
Size 652B
SHA256 40c7b1cfe932e62962173d4aad857ac2578cfc2d43d8b9460137282c8facb885
MD5 9e2fbbb841d7054bd6a80c68e9fde24e
SHA1 f2e93737a63966a7751ee8a58bb31b6622838325
SHA512 cb01ee71fef9a690ea70d43ed560e3074b5893eb84acd9465722546ec88f0c40aaa5d8037aa44bd85e7cf2e4d099a0f59254a0857cadfca970db3698b2b3bcd7
TLSH
T197F05E4963F8420EF0F74B30BDF6436391A9BC65DE3297ED1541031D2C64A148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

d3in3fik.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\d3in3fik\d3in3fik.0.cs
Size 248B
SHA256 48e7a944bad9befdeaa91ee7cee14e9d47edead99d02a2c0b7b90087329eb5ad
MD5 9b7ef3dfb301cc9bcd43a87a2e4b1669
SHA1 aac69c5165a20a2e089cc054ef41230e67399e4e
SHA512 791ea4dcf4f0e63ece8870ffbd9e86c2f33dbd5b4cdaadfc0d9d666fc2eea10f2f4ca9e0a85d587aa06705d9017cfe2586ddcacc62de3b20fff4306b22d02772
TLSH
T122D02B28B3B78A290542101B5C45E07CBB27410B055D0A05B9AC4601DF470084026E08
MD5 SHA1 SHA512 TLSH

Submit Download

d3in3fik.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\d3in3fik\d3in3fik.cmdline
Size 369B
SHA256 91a94c8ba3e236e3967f267c6d93cfd8dad7d5e64b395110188f99f93a44c3de
MD5 2f4b7f9752d95e56315be0349ee46230
SHA1 aba9da678d7d933461cc16ad6fbb868fcc71a4dd
SHA512 1b48459294f9872c9b49b900bfb65c1521a35ec7966948d536137def0bc2acc2eec5501a0a238ea6ceebe1317797da948cbd792e7c040d1dad3428576ab4501b
TLSH
T193E06F7B5256C27D01EA100B227AC4EC927287C329C07F84A060848DE137182ABE2B8A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4952-0-0x0000020594A80000-0x0000020594A90000-memory.dmp

Download

memory/4952-2-0x00000205ADA80000-0x00000205ADAA2000-memory.dmp

Download

memory/4952-1-0x0000020594A80000-0x0000020594A90000-memory.dmp

Download

memory/4952-22-0x00000205ADA70000-0x00000205ADA78000-memory.dmp

Download

memory/4952-23-0x0000020594A80000-0x0000020594A90000-memory.dmp

Download

memory/4952-24-0x0000020594A80000-0x0000020594A90000-memory.dmp

Download

memory/4952-25-0x00000205ADF80000-0x00000205ADFC0000-memory.dmp

Download

memory/4952-26-0x00000205ADFC0000-0x00000205ADFC6000-memory.dmp

Download

memory/4952-28-0x0000020594A80000-0x0000020594A90000-memory.dmp

Download

memory/4952-27-0x0000020594A80000-0x0000020594A90000-memory.dmp

Download

memory/4952-29-0x0000020594A80000-0x0000020594A90000-memory.dmp

Download

memory/4952-30-0x0000020594A80000-0x0000020594A90000-memory.dmp

Download