8919d4baa298e7b1b9b4161c720c75608280497b9a7b51da36fed754964fdcef

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb311f38-8969-4c36-84a5-3a44fcfae09c.ps1
Size 12KB
Sample260910-pbt4eabq5v
SHA256 8919d4baa298e7b1b9b4161c720c75608280497b9a7b51da36fed754964fdcef
MD5 58360eb1e4a6564a371004455f5fb6cd
SHA1 f7b40e83c240d6abdb05c281e1739cb2c6348afc
SHA512 8f166861ea2dd485b54623840ecbc004d6ae2c20cb73b05e53e5965bac1ede54fe58672bb64118ee4731a00258d8cf805d0d6f36706624efe03647fce53cc508
SSDEEP 192:wpHsyZ3dPpvGd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJt2:wpHpZtPpGd1JNsvYlGwAXJk
TLSH
T12E4271E56725922A8872611DCECEA04DF60355331EBB1B15BEBC87312F3A064F27A74D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3528	PowerShell.exe
9	3528	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3528	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3528	PowerShell.exe
3528	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	PowerShell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3824	3528	PowerShell.exe	90
PID 3824 wrote to memory of 2096	3824	csc.exe	91
PID 3528 wrote to memory of 1232	3528	PowerShell.exe	92
PID 1232 wrote to memory of 6024	1232	csc.exe	93

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\cb311f38-8969-4c36-84a5-3a44fcfae09c.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x05v2am1\x05v2am1.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4145.tmp" "c:\Users\Admin\AppData\Local\Temp\x05v2am1\CSC8027531364C44398272EC26552D25D6.TMP"
    3⤵
    PID:2096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5bymd3wv\5bymd3wv.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CDC.tmp" "c:\Users\Admin\AppData\Local\Temp\5bymd3wv\CSC193876B89A24A3F8889ABD7C238EA9D.TMP"
    3⤵
    PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5bymd3wv.dll

Path C:\Users\Admin\AppData\Local\Temp\5bymd3wv\5bymd3wv.dll
Size 7KB
SHA256 5ce499465764357bd9b0df619d4e00f18308ba1a41411c95f4111145e1ea9285
MD5 a6ae83ae533a3f32ea3a7a08735ec489
SHA1 4dafd66917abe91d9699684bb435751a0c49be2c
SHA512 81433b7c350c3cb24855ac3b4dfa92b9361bcda32a58e0e0d0c7f7bb677ed9e50b846a93881d6df7edd255a29b5ba77c5daece9342e3d00df754b84214cdf8bd
SSDEEP 96:DguYgZxIVIkaxN3rISmCU7YCaMNdHXHLaQlK:DguYgEda/3yUCrv7aj
TLSH
T14FF1F95ECB8C8275E95E0B39A4F306016BB4C4448F338A5B09EC91073E67B991B633D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4145.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4145.tmp
Size 1KB
SHA256 e60330f2102a17e7602b709989e59f0983be6b11b42fdd2d7b8ccd604be27749
MD5 89dedbec626d46b20b3548f965fd54bd
SHA1 ca6e990758220a35ee76a00010f6bfb8eb06019e
SHA512 455b6c088b64af1723d55505cfa9cf047f7ac62f13bf3f4e8542e95a001a4528697d2fe698aee584014ae8148ca6ff1fca3f901dd23ce06610762a1d97e9969d
TLSH
T15721A60983FD8B1FF077473169FA132F9278FC69DFA2535A894442282C41504EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES5CDC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5CDC.tmp
Size 1KB
SHA256 cd8dc1a8e6d1a2beb383454f6f53983faab9db1da50b65c484a5bb5d91ac5066
MD5 3fa964c03c4eedfb4083449495a972ba
SHA1 7a569eafc6238f7cd8e475dc8ce209af1096bb12
SHA512 efb018e9d739ef1abc6eb8d54a026c63bff00cf96c3935a8f6bf7364cfd2f5fb6ae35c1efcd79badc42572ddaa0c79950ee5b79947a9ac7558f90896842b5fa9
TLSH
T19321EF0583EC474EF07307326AF6172F9674FD68EFA2579A8541422C2C41244EFE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

x05v2am1.dll

Path C:\Users\Admin\AppData\Local\Temp\x05v2am1\x05v2am1.dll
Size 3KB
SHA256 9b8fb365481221a1cb8b7f059487eba0029fda35633100fb52eb3cbc1a36cdc4
MD5 f7be9733a91a55316642ed1a5b826d00
SHA1 40efc5944dd5cfa50c3ff1ed35b763539c9bbb29
SHA512 ae761018980123d070ca35431fc088ec103bb47009ccb507125e50b6ee1796ef58b75149fd14c522915e2296f5080a6ce855b1b2a7deccafced639266bf2467b
TLSH
T16751DB0B67E8462BE4770730AEF3432A37B8F8548F73635D09904328BC657645A32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

5bymd3wv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5bymd3wv\5bymd3wv.0.cs
Size 10KB
SHA256 e098b4d074052a8cfb3a15706dfc9827e9b0200e0163b68fa4760d60ff032ab8
MD5 def95e06ed7e895f86ad3f65c3d9459a
SHA1 73c4ad4388d69cfd24b32b8f82aac11a23a5f122
SHA512 c3c89a45ce0d1534a790e3d61d70c8482bbc669739b979ab924ce97c1d7f6653e0c2f819e2894bae1489ce66583d6142a90d53376c83367146b3faa8f2952be7
SSDEEP 192:4Gd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJ2:4Gd1JNsvYlGwAXJ2
TLSH
T15E2240E56725922A8C76211D9ECEA05DF60352331FBA16167ABC87312F3A068F27770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bymd3wv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5bymd3wv\5bymd3wv.cmdline
Size 369B
SHA256 a23c9c5182acb72c2fc538f99f93a954e2e7963181df6038d133008dfc3a390a
MD5 c77f611a5f4c888deaa027d74fd0d435
SHA1 0856160820a7e18ea212347be85f44b9845f0530
SHA512 787bc3ad00d7266bc97992e8768fa28af59a5f5b4289cabeda896640c4e6d7e73f4e657cde1d85bc4d84e434d4a98621801a5171ece99a3f9ebb403cc834ed01
TLSH
T1F8E0C66A426AC27D03ED204B266ECCADD272078B39803F849042A40DE3270806BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC193876B89A24A3F8889ABD7C238EA9D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5bymd3wv\CSC193876B89A24A3F8889ABD7C238EA9D.TMP
Size 652B
SHA256 0bc03c2f6968d7150fa69cec683d804b8f01038bca9e1f1d59f40413d8b4129e
MD5 8731540c3540491eba08f83b10b26222
SHA1 34dd9f1b71feab094fa0851be9f4ff91dd4a0e78
SHA512 b33036404dfd58c6e5214fd2144ebcecbff4665a8c18565c91904867d87af0a39460de65f393d8e7656bbb645f77a58b4791b288049bc337fb08509f6f90e5ed
TLSH
T1FFF05E0963F8020EF0F34B70BEF643A395A9FC65DE3293ED148003192C646108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8027531364C44398272EC26552D25D6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\x05v2am1\CSC8027531364C44398272EC26552D25D6.TMP
Size 652B
SHA256 ef0fbede1a00495025794014c503d1e98c561e73b292b6e09ff74ed8c5ecdc82
MD5 61f2feecc064649bc97c745c51e88ee1
SHA1 3e1ad5c52bb77dd8869294cdad649eddd9972d9a
SHA512 9085c24e439f4528df48e34952fc6ef709098fd3d958f0ab98afd754ef8975d786f905be935347eb2348bbd5481b3da6b72600390ecaa09eb8266c50ceabe9e8
TLSH
T1F0F0824963FC020EF0F34B30BDF6436791A8BC64DE3293ED1590036D2C655109962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

x05v2am1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\x05v2am1\x05v2am1.0.cs
Size 295B
SHA256 e79f623eda1fb8bfb3ceb441dadf01a25b45f37f19f39ff256c77d52f8b454e8
MD5 4e3d809d9542dd5a09b58080bdc7fd32
SHA1 dccce4d18ce5b086d3c6a5935736cb2acba0df08
SHA512 8bb09adc1e7a0f9620704dd757bbdf21e114639012660612955e657f42fe431e499618f6b9fbbc30d67cb5415900cbb865412be033797a216fe88f916480fc6e
TLSH
T18BE0CD1C6AF29AB0806348154C47D5FD761B51363179160576F50320EF4B0094139559
MD5 SHA1 SHA512 TLSH

Submit Download

x05v2am1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\x05v2am1\x05v2am1.cmdline
Size 369B
SHA256 f324d3f998be7041b16f0f8c35b1d79cf2f81fc4f97550e68695a4f5c2fea0db
MD5 b96861ed43cf1c97787fa2ebd5fa4299
SHA1 b543e72cc0e5bf2fa2d426ecc58f21b9d6be08da
SHA512 3cdaff10e726a9e6b3cc08e1d0975816e3e45d698e6c10544ab8a5c2583c4a342335c72c29d1981976c1478991d307804fdc8b77c21c550146c3973449fd5ba5
TLSH
T155E0D83BA366C67E15F914073269C5AC82720A472D497F885190485ED0AB01477D1755
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3528-25-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3528-5-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3528-22-0x000001EEA7990000-0x000001EEA7998000-memory.dmp

Download

memory/3528-0-0x00007FFA7686F000-0x00007FFA76870000-memory.dmp

Download

memory/3528-23-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3528-24-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3528-20-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3528-7-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3528-13-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3528-6-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3528-26-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3528-4-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/3528-39-0x000001EEA7A40000-0x000001EEA7A48000-memory.dmp

Download

memory/3528-3-0x000001EEA79A0000-0x000001EEA79C2000-memory.dmp

Download

memory/3528-41-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download