Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
22/08/2026, 12:35
General
- Target Game.ps1
- Size 11KB
- Sample260822-psfmcathqe
- SHA256 f8e7d1461714bf2759392b61e5ade016fd236775a78da7506a2989dbe7f6cc84
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Deletes itself 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Game.ps11⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3468-0-0x00007FFEE26EF000-0x00007FFEE26F0000-memory.dmp
memory/3468-1-0x000001C2F8750000-0x000001C2F8772000-memory.dmp
memory/3468-2-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-5-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-6-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-7-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-10-0x000001C2F87F0000-0x000001C2F880E000-memory.dmp
memory/3468-11-0x000001C2F8A50000-0x000001C2F8B02000-memory.dmp
memory/3468-12-0x000001C2F8810000-0x000001C2F881A000-memory.dmp
memory/3468-13-0x000001C2F8C90000-0x000001C2F8CBA000-memory.dmp
memory/3468-14-0x000001C2F8C90000-0x000001C2F8CB4000-memory.dmp
memory/3468-15-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-16-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-17-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-18-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-19-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-20-0x000001C2F8F30000-0x000001C2F90F2000-memory.dmp
memory/3468-21-0x000001C2F9630000-0x000001C2F9B58000-memory.dmp
memory/3468-22-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-28-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-29-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-30-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-31-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-32-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-33-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-34-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-35-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-36-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-37-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-38-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-39-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-40-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp
memory/3468-50-0x00007FFEE2560000-0x00007FFEE2F04000-memory.dmp