Analysis
- max time kernel
149s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 13:00
General
- Target code.ps1
- Size 12KB
- Sample260822-p81bpavbqa
- SHA256 648fc9ef0352c6433a8f5ab588cfcca2868c7a6b5d95bd4328825b8332da7671
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Deletes itself 1 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\code.ps11⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2396-0-0x00007FFE601FF000-0x00007FFE60200000-memory.dmp
memory/2396-3-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-4-0x000002839BD00000-0x000002839BD22000-memory.dmp
memory/2396-5-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-6-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-7-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-8-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-9-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-12-0x000002839BD50000-0x000002839BD6E000-memory.dmp
memory/2396-13-0x000002839BFF0000-0x000002839C0A2000-memory.dmp
memory/2396-14-0x000002839BD40000-0x000002839BD4A000-memory.dmp
memory/2396-15-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-16-0x000002839BDA0000-0x000002839BDCA000-memory.dmp
memory/2396-17-0x000002839BDA0000-0x000002839BDC4000-memory.dmp
memory/2396-18-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-19-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-20-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-21-0x000002839C4D0000-0x000002839C692000-memory.dmp
memory/2396-22-0x000002839CBD0000-0x000002839D0F8000-memory.dmp
memory/2396-23-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-29-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-30-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-31-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-32-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-33-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-34-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-35-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-36-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-38-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-39-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-40-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-41-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-37-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp
memory/2396-48-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp