Analysis
- max time kernel
20s - max time network
23s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
15/08/2026, 11:19
General
- Target TorioClient.exe
- Size 97.3MB
- Sample260815-ne3dhsfd64
- SHA256 dd88588b7ee5431e0e42df11d9c1995af63d9f7a5d8fbd2491fd271a8c5bbece
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TorioClient.exe"C:\Users\Admin\AppData\Local\Temp\TorioClient.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -Command "if (-not (Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore')) { New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft' -Name 'WindowsStore' -Force | Out-Null }; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore' -Name 'AutoDownload' -Value 2 -Type DWord -ErrorAction SilentlyContinue; if (-not (Test-Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate')) { New-Item -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore' -Name 'WindowsUpdate' -Force | Out-Null }; Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate' -Name 'AutoDownload' -Value 2 -Type DWord -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
__PSScriptPolicyTest_g0ey2l0z.zbf.ps1
memory/1104-134-0x0000025C3A730000-0x0000025C3A750000-memory.dmp
memory/1104-80-0x0000025C30D00000-0x0000025C30D50000-memory.dmp
memory/1104-21-0x0000021B98500000-0x0000021B98550000-memory.dmp
memory/1104-25-0x0000025C2D5C0000-0x0000025C2D600000-memory.dmp
memory/1104-13-0x0000025C2F570000-0x0000025C2F790000-memory.dmp
memory/1104-29-0x0000025C36AD0000-0x0000025C37310000-memory.dmp
memory/1104-37-0x0000025C2F8C0000-0x0000025C2F940000-memory.dmp
memory/1104-49-0x0000025C2F980000-0x0000025C2F9A0000-memory.dmp
memory/1104-69-0x0000025C30CE0000-0x0000025C30D00000-memory.dmp
memory/1104-106-0x0000025C38E80000-0x0000025C38EA0000-memory.dmp
memory/1104-76-0x0000025C30E90000-0x0000025C30FA0000-memory.dmp
memory/1104-65-0x0000025C30CB0000-0x0000025C30CE0000-memory.dmp
memory/1104-61-0x0000025C30B90000-0x0000025C30BB0000-memory.dmp
memory/1104-57-0x0000025C30C10000-0x0000025C30C60000-memory.dmp
memory/1104-53-0x0000025C2F9C0000-0x0000025C2F9E0000-memory.dmp
memory/1104-45-0x0000025C2F940000-0x0000025C2F960000-memory.dmp
memory/1104-42-0x0000025C2F7D0000-0x0000025C2F7E0000-memory.dmp
memory/1104-33-0x0000021B98360000-0x0000021B98380000-memory.dmp
memory/1104-85-0x0000025C39910000-0x0000025C3A0A0000-memory.dmp
memory/1104-88-0x0000025C31000000-0x0000025C31030000-memory.dmp
memory/1104-92-0x0000025C38F50000-0x0000025C38FF0000-memory.dmp
memory/1104-122-0x0000025C3A780000-0x0000025C3A7B0000-memory.dmp
memory/1104-118-0x0000025C39080000-0x0000025C390A0000-memory.dmp
memory/1104-126-0x0000025C3AA30000-0x0000025C3ABF0000-memory.dmp
memory/1104-9-0x0000025C35330000-0x0000025C36290000-memory.dmp
memory/1104-130-0x0000025C3A7B0000-0x0000025C3A7E0000-memory.dmp
memory/1104-17-0x0000021B983A0000-0x0000021B98500000-memory.dmp
memory/1104-221-0x0000025C4DD70000-0x0000025C4DD90000-memory.dmp
memory/1104-114-0x0000025C3A5B0000-0x0000025C3A600000-memory.dmp
memory/1104-102-0x0000025C3A4A0000-0x0000025C3A560000-memory.dmp
memory/1104-98-0x0000025C39020000-0x0000025C39050000-memory.dmp
memory/1104-139-0x0000025C3ACD0000-0x0000025C3AD20000-memory.dmp
memory/1104-143-0x0000025C3B2B0000-0x0000025C3B310000-memory.dmp
memory/1104-147-0x0000025C3ADC0000-0x0000025C3AE00000-memory.dmp
memory/1104-151-0x0000025C38E60000-0x0000025C38E70000-memory.dmp
memory/1104-160-0x0000025C3B950000-0x0000025C3BAB0000-memory.dmp
memory/1104-164-0x0000025C3B750000-0x0000025C3B7C0000-memory.dmp
memory/1104-176-0x0000025C3C8A0000-0x0000025C3C950000-memory.dmp
memory/1104-184-0x0000021B98350000-0x0000021B98360000-memory.dmp
memory/1104-180-0x0000025C3CC50000-0x0000025C3CE60000-memory.dmp
memory/1104-188-0x0000025C3AC00000-0x0000025C3AC10000-memory.dmp
memory/1104-172-0x0000025C3C780000-0x0000025C3C7F0000-memory.dmp
memory/1104-168-0x0000025C3C5C0000-0x0000025C3C780000-memory.dmp
memory/1104-193-0x0000025C436A0000-0x0000025C43A20000-memory.dmp
memory/1104-211-0x0000025C43E40000-0x0000025C43E60000-memory.dmp
memory/1104-198-0x0000025C43A20000-0x0000025C43AB0000-memory.dmp
memory/1104-5-0x0000025C2E4B0000-0x0000025C2F340000-memory.dmp
memory/1104-202-0x0000025C40AE0000-0x0000025C40B00000-memory.dmp
memory/1104-110-0x0000025C39070000-0x0000025C39080000-memory.dmp
memory/1488-216-0x00000201A8FF0000-0x00000201A9AB2000-memory.dmp
memory/1488-192-0x00000201A97BA000-0x00000201A97BB000-memory.dmp
memory/1488-217-0x00000201A8FF0000-0x00000201A9AB2000-memory.dmp
memory/1488-215-0x00000201C1F70000-0x00000201C1F92000-memory.dmp
memory/1488-220-0x00000201A8FF0000-0x00000201A9AB2000-memory.dmp