Analysis
- max time kernel
11s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 12:40
General
- Target slk4yzllfrl7ldvh.exe
- Size 1.1MB
- Sample260831-pwdbdsvvbx
- SHA256 30af47aac1590910d889350cdd153d349d359bad2c8d908b0bfa865dac4b1b03
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\slk4yzllfrl7ldvh.exe"C:\Users\Admin\AppData\Local\Temp\slk4yzllfrl7ldvh.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|Zdv15qWBx7tOTA4GNfgC/W98p7GKaK5SkbY0FJnXtzS3vPGM7DEPW50h4dH7FwGsWindowsControl472|XDSCJHfFmHjOkfuYR+55GF8CdkLiJQRJoq6Xm8gEsRI=C:\Program Files\junk.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "junk" /tr "C:\Program Files\junk.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "junk" /tr "C:\Program Files\junk.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junk.exe"C:\Program Files\junk.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junk.exe"C:\Program Files\junk.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junk.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/1416-528-0x000001D229330000-0x000001D2293A8000-memory.dmp
memory/1676-525-0x00007FFE62750000-0x00007FFE62766000-memory.dmp
memory/1676-532-0x00007FFE62750000-0x00007FFE62766000-memory.dmp
memory/3388-357-0x0000016F83900000-0x0000016F83920000-memory.dmp
memory/3388-359-0x0000016F93E50000-0x0000016F93F50000-memory.dmp
memory/3388-386-0x0000016F94160000-0x0000016F94180000-memory.dmp
memory/3388-337-0x0000016F801E0000-0x0000016F802E0000-memory.dmp
memory/3388-369-0x0000016F83AE0000-0x0000016F83B00000-memory.dmp
memory/3572-64-0x000002AB01CD0000-0x000002AB01CF0000-memory.dmp
memory/3572-97-0x000002AB143F0000-0x000002AB14410000-memory.dmp
memory/3572-65-0x000002AB00DD0000-0x000002AB00ED0000-memory.dmp
memory/3572-76-0x000002AB01DF0000-0x000002AB01E10000-memory.dmp
memory/3572-32-0x000002AB001E0000-0x000002AB002E0000-memory.dmp
memory/4828-12-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-36-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-29-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-28-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-13-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-0-0x000002457AF90000-0x000002457B0A2000-memory.dmp
memory/4828-274-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-1-0x00007FFE4D74F000-0x00007FFE4D750000-memory.dmp
memory/4828-2-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-11-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-3-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-4-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-10-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-5-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-6-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-7-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-8-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/4828-9-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5216-482-0x00007FFE62750000-0x00007FFE62766000-memory.dmp
memory/5540-289-0x000002490B650000-0x000002490B651000-memory.dmp
memory/5540-285-0x000002490B510000-0x000002490B511000-memory.dmp
memory/5540-281-0x000002490B4F0000-0x000002490B4F1000-memory.dmp
memory/5540-284-0x000002490B510000-0x000002490B511000-memory.dmp
memory/5540-287-0x000002490B520000-0x000002490B521000-memory.dmp
memory/5540-282-0x000002490B500000-0x000002490B501000-memory.dmp
memory/5540-283-0x000002490B500000-0x000002490B501000-memory.dmp
memory/5540-280-0x000002490B4F0000-0x000002490B4F1000-memory.dmp
memory/5540-286-0x000002490B520000-0x000002490B521000-memory.dmp
memory/5540-288-0x000002490B650000-0x000002490B651000-memory.dmp
memory/5540-290-0x000002490B660000-0x000002490B661000-memory.dmp
memory/5540-526-0x00007FFE62750000-0x00007FFE62766000-memory.dmp
memory/5540-291-0x000002490B660000-0x000002490B661000-memory.dmp
memory/5540-529-0x00007FFE62750000-0x00007FFE62766000-memory.dmp
memory/5820-527-0x00007FFE62750000-0x00007FFE62766000-memory.dmp