Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/08/2026, 12:31
General
- Target psl.exe
- Size 64KB
- Sample260827-pp7xesvcmc
- SHA256 68e81ce966ca0c016bb638d0d29b106a0da7eab2ddf70438d8182fa89baf5d78
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\psl.exe"C:\Users\Admin\AppData\Local\Temp\psl.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\WinPslUpd" psl.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\WinPslUpd\psl.exe"C:\ProgramData\WinPslUpd\psl.exe"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msvcp140.dll
psl.exe
ucrtbase.dll
vcruntime140_1.dll
DCRCVDrv.sys
memory/1248-25-0x0000000180000000-0x000000018019A000-memory.dmp
memory/1248-1082-0x0000000180000000-0x000000018019A000-memory.dmp
memory/1248-28-0x0000000180000000-0x000000018019A000-memory.dmp
memory/1248-26-0x0000000180000000-0x000000018019A000-memory.dmp
memory/1248-27-0x0000000180000000-0x000000018019A000-memory.dmp
memory/1248-24-0x0000000180000000-0x000000018019A000-memory.dmp
memory/1680-7-0x0000000000010000-0x000000000003D000-memory.dmp
memory/4228-114-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-92-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-36-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/4228-37-0x00000000056E0000-0x00000000056FA000-memory.dmp
memory/4228-38-0x0000000005700000-0x000000000572C000-memory.dmp
memory/4228-40-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-58-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-78-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-90-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-112-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-144-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-142-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-140-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-138-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-136-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-134-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-108-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-132-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-130-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-128-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-126-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-124-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-122-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-120-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-118-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-116-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-1311-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/4228-110-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-106-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-104-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-102-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-100-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-98-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-96-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-94-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-1310-0x0000000007170000-0x000000000772A000-memory.dmp
memory/4228-88-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-86-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-84-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-82-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-80-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-76-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-74-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-72-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-70-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-68-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-66-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-64-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-62-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-60-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-56-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-54-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-52-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-50-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-48-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-44-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-43-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-39-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-46-0x0000000005700000-0x0000000005726000-memory.dmp
memory/4228-1309-0x0000000006B10000-0x0000000006BA2000-memory.dmp
memory/4228-1306-0x00000000747F2000-0x00000000747F3000-memory.dmp
memory/4228-1305-0x0000000005AA0000-0x0000000005B06000-memory.dmp
memory/4228-29-0x0000000000400000-0x0000000000470000-memory.dmp
memory/4228-31-0x00000000747F2000-0x00000000747F3000-memory.dmp
memory/5952-0-0x0000000180000000-0x000000018019A000-memory.dmp
memory/5952-2-0x0000000180000000-0x000000018019A000-memory.dmp
memory/5952-3-0x0000000180000000-0x000000018019A000-memory.dmp
memory/5952-1-0x0000000180000000-0x000000018019A000-memory.dmp
memory/5952-4-0x0000000180000000-0x000000018019A000-memory.dmp
memory/5952-30-0x0000000180000000-0x000000018019A000-memory.dmp
memory/5952-35-0x0000000180000000-0x000000018019A000-memory.dmp
memory/5952-34-0x00007FF79E550000-0x00007FF79E565000-memory.dmp