Analysis
- max time kernel
149s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/08/2026, 22:18
General
- Target IDTOKEN.exe
- Size 171KB
- Sample260830-177j6a1dra
- SHA256 0be45e8716100308e4039c8b936ab35034a207db0157c3e59a6639caab0c4c5a
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDTOKEN.exe"C:\Users\Admin\AppData\Local\Temp\IDTOKEN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6f4cb9d6b19f44449c483c7f5a869488\sys_run.bat"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Write-Host ''; Write-Host '██╗██████╗ ████████╗ ██████╗ ██╗ ██╗███████╗███╗ ██╗' -ForegroundColor Blue; Write-Host '██║██╔══██╗╚══██╔══╝██╔═══██╗██║ ██╔╝██╔════╝████╗ ██║' -ForegroundColor Blue; Write-Host '██║██║ ██║ ██║ ██║ ██║█████╔╝ █████╗ ██╔██╗ ██║' -ForegroundColor Blue; Write-Host '██║██║ ██║ ██║ ██║ ██║██╔═██╗ ██╔══╝ ██║╚██╗██║' -ForegroundColor Blue; Write-Host '██║██████╔╝ ██║ ╚██████╔╝██║ ██╗███████╗██║ ╚████║' -ForegroundColor Blue; Write-Host '╚═╝╚═════╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝╚═╝ ╚═══╝' -ForegroundColor Blue; Write-Host ''; Write-Host ' Cracked By SCARS' -ForegroundColor Red; Write-Host ' https://discord.gg/1477' -ForegroundColor Red; Write-Host ''"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sys_run.bat
memory/3804-0-0x0000000074B62000-0x0000000074B63000-memory.dmp
memory/3804-1-0x0000000000180000-0x00000000001B0000-memory.dmp
memory/3804-2-0x0000000002610000-0x0000000002616000-memory.dmp
memory/3804-3-0x00000000076E0000-0x0000000007C9A000-memory.dmp
memory/3804-4-0x0000000074B50000-0x000000007530C000-memory.dmp
memory/3804-26-0x0000000074B50000-0x000000007530C000-memory.dmp
memory/3804-25-0x0000000074B62000-0x0000000074B63000-memory.dmp
memory/4456-15-0x0000000074B50000-0x000000007530C000-memory.dmp
memory/4456-19-0x0000000006450000-0x000000000646E000-memory.dmp
memory/4456-9-0x00000000057C0000-0x0000000005E0A000-memory.dmp
memory/4456-14-0x0000000005EF0000-0x0000000005F56000-memory.dmp
memory/4456-13-0x0000000005E80000-0x0000000005EE6000-memory.dmp
memory/4456-12-0x0000000005770000-0x0000000005792000-memory.dmp
memory/4456-18-0x0000000005F60000-0x00000000062BB000-memory.dmp
memory/4456-11-0x0000000074B50000-0x000000007530C000-memory.dmp
memory/4456-20-0x0000000006490000-0x00000000064DC000-memory.dmp
memory/4456-21-0x0000000007C90000-0x000000000830C000-memory.dmp
memory/4456-22-0x00000000069B0000-0x00000000069CA000-memory.dmp
memory/4456-24-0x0000000074B50000-0x000000007530C000-memory.dmp
memory/4456-10-0x0000000074B50000-0x000000007530C000-memory.dmp
memory/4456-8-0x0000000004F80000-0x0000000004FB6000-memory.dmp