Analysis
- user interaction
yes - max time kernel
153s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
19/08/2026, 02:00
General
- Target breal.ps1
- Size 5KB
- Sample260819-cfczgacl21
- SHA256 59633eea711aef7275ab4edd2c2b4594eb53591237756829b323a6a33ea08efd
Malware Config
Signatures
- Badlisted process makes network request 15 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops file in Program Files directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\breal.ps11⤵
- Badlisted process makes network request
- Drops file in Program Files directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g5r3nufr\g5r3nufr.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7105.tmp" "c:\Users\Admin\AppData\Local\Temp\g5r3nufr\CSC252C48784C3949ABBCB05696FF7E247.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Microsoft.PackageManagement.NuGetProvider.dll
p4zhiksu.vuh
RES7105.tmp
__PSScriptPolicyTest_5vfpsyym.qjm.ps1
g5r3nufr.dll
CSC252C48784C3949ABBCB05696FF7E247.TMP
g5r3nufr.0.cs
g5r3nufr.cmdline
memory/4376-25-0x00000229431F0000-0x00000229431FA000-memory.dmp
memory/4376-50-0x00000229431E0000-0x00000229431E8000-memory.dmp
memory/4376-21-0x0000022942D40000-0x0000022942D4A000-memory.dmp
memory/4376-22-0x0000022943200000-0x000002294321A000-memory.dmp
memory/4376-23-0x0000022942D50000-0x0000022942D58000-memory.dmp
memory/4376-1-0x0000022940C00000-0x0000022940C10000-memory.dmp
memory/4376-24-0x00000229431E0000-0x00000229431E6000-memory.dmp
memory/4376-26-0x0000022940C00000-0x0000022940C10000-memory.dmp
memory/4376-27-0x0000022940C00000-0x0000022940C10000-memory.dmp
memory/4376-28-0x0000022940C00000-0x0000022940C10000-memory.dmp
memory/4376-29-0x00007FF49F3B0000-0x00007FF49F3C0000-memory.dmp
memory/4376-31-0x0000022943210000-0x000002294323E000-memory.dmp
memory/4376-32-0x0000022943290000-0x00000229432D4000-memory.dmp
memory/4376-34-0x0000022943260000-0x0000022943278000-memory.dmp
memory/4376-35-0x00000229432E0000-0x00000229432F4000-memory.dmp
memory/4376-33-0x0000022943240000-0x0000022943256000-memory.dmp
memory/4376-36-0x0000022942D50000-0x0000022942D5A000-memory.dmp
memory/4376-37-0x0000022943340000-0x0000022943380000-memory.dmp
memory/4376-10-0x00007FF49F3B0000-0x00007FF49F3C0000-memory.dmp
memory/4376-19-0x0000022940BF0000-0x0000022940BFA000-memory.dmp
memory/4376-17-0x0000022940BD0000-0x0000022940BEC000-memory.dmp
memory/4376-18-0x0000022942C80000-0x0000022942D33000-memory.dmp
memory/4376-7-0x0000022940B30000-0x0000022940B52000-memory.dmp
memory/4376-20-0x00000229431C0000-0x00000229431DC000-memory.dmp
memory/4376-53-0x0000022940C00000-0x0000022940C10000-memory.dmp
memory/4376-66-0x00000229437D0000-0x0000022943816000-memory.dmp
memory/4376-67-0x0000022943300000-0x0000022943308000-memory.dmp
memory/4376-68-0x00007FFD005D0000-0x00007FFD00683000-memory.dmp
memory/4376-69-0x00000229437A0000-0x00000229437BC000-memory.dmp
memory/4376-70-0x0000022943840000-0x0000022943856000-memory.dmp
memory/4376-71-0x0000022943890000-0x00000229438B6000-memory.dmp
memory/4376-73-0x0000022943860000-0x000002294387A000-memory.dmp
memory/4376-72-0x0000022943330000-0x0000022943340000-memory.dmp
memory/4376-74-0x0000022943910000-0x0000022943934000-memory.dmp
memory/4376-75-0x00000229437C0000-0x00000229437D0000-memory.dmp
memory/4376-76-0x0000022943820000-0x000002294382E000-memory.dmp
memory/4376-77-0x0000022943830000-0x000002294383A000-memory.dmp
memory/4376-78-0x0000022943940000-0x000002294395A000-memory.dmp
memory/4376-79-0x0000022943AE0000-0x0000022943C56000-memory.dmp
memory/4376-80-0x00000229438E0000-0x00000229438EA000-memory.dmp
memory/4376-9-0x0000022940C00000-0x0000022940C10000-memory.dmp
memory/4376-111-0x0000022940C00000-0x0000022940C10000-memory.dmp
memory/4376-0-0x0000022940C00000-0x0000022940C10000-memory.dmp
memory/4376-122-0x00000229437F0000-0x000002294381C000-memory.dmp
memory/4376-129-0x0000022940C00000-0x0000022940C10000-memory.dmp
memory/4376-134-0x0000022940C00000-0x0000022940C10000-memory.dmp