d1dfe607f3b7f1ab3309bcac6540385a5b826c0f3f61f3e5ad55bba1d7f02ea8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sales_v2.ps1
Size 36KB
Sample260910-yy349see75
SHA256 d1dfe607f3b7f1ab3309bcac6540385a5b826c0f3f61f3e5ad55bba1d7f02ea8
MD5 0c3782cc8c95ddb8ca65df14bf8aaec2
SHA1 9bf4450353f7a817c1951baa698e3fd431d2495c
SHA512 050c2753cf0646dea55ac488a7adf31e610f10e880f25f5e2903d720939297d7f53281fdd09e77832237a4aef760b2d63c45b23ffe0b18813095df4c5bc27256
SSDEEP 768:wNs2AEpF7zBCns4K1NogIboIPArI1a2pot6QYfuurnnjBSOjg/zi:wNs2AEpF7zBCnsx1NogIboIorQa2poF0
TLSH
T17003B616385B192C05B30676BDA28449EF09473B84EE2901FDED44C07FBB668D6B9F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3080	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3080	powershell.exe
3080	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3080	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 4976	3080	powershell.exe	89
PID 4976 wrote to memory of 3480	4976	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sales_v2.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fj4ltear\fj4ltear.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES589B.tmp" "c:\Users\Admin\AppData\Local\Temp\fj4ltear\CSC6382DBC3AEFB41ABBDD57AEAA85D5921.TMP"
    3⤵
    PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES589B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES589B.tmp
Size 1KB
SHA256 a41e975f38f1a1b29f61abc5bb34b760ee52849dd2f0e7dbe38d9663f6c37663
MD5 8c07e2897b9b93eeeedf88c0eeebfd36
SHA1 ffe9dbb05ec9182921d3f9e082eeaf8602e72066
SHA512 b072c8cc42336738d866ba5101863404e4109f756d027041d7b40ac901aa4abdcfbd0de2bcde36e522fd54d7db99aac2a8200db2b0a3eb63f21dd251d88f8978
TLSH
T1E1215C0583E84B1EF073573179F9072BA134FDA5AF66A35B8580422C2C61114EFE1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5xljl2yw.i3p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5xljl2yw.i3p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fj4ltear.dll

Path C:\Users\Admin\AppData\Local\Temp\fj4ltear\fj4ltear.dll
Size 3KB
SHA256 4a20f313e3e08222cc5a12967fcf39a56c22d12bfcda92da14cdcfba2b6912bf
MD5 3c94cd328a77ac801727ebaf44dc3a3e
SHA1 a14950116aabcd30fe1ad5b8809e762d687b816b
SHA512 55e3a1e033827c9e8074a80c156a7dc46531487f123acd72566092ca99220b0d9aab9ddcfa2749ef090bb63b34178e94dfcbd0b7d016a57ecb3b7c0d0b53e823
TLSH
T1E6519C1B97E84A6BE4B70B346EF3071633A4F8609F72936E499042686C616645D32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6382DBC3AEFB41ABBDD57AEAA85D5921.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fj4ltear\CSC6382DBC3AEFB41ABBDD57AEAA85D5921.TMP
Size 652B
SHA256 7012f8e265373912d26d7a59ae0e61e65efc2942f00fbbbb5eb004422fd51a35
MD5 4a3b1cdc3a0cf5f85043c1cfe23c2ada
SHA1 1f826cf5519a0caf4e9b88665d0c1e27a11e10f9
SHA512 0d3cf9f498e23c5a870b038dce6884869a225c0c64833b9c4dc663f777afc4398c1dd838d2b23c9e9a96ccf13bf67251f948146d6be391f35ac07e73a22055d0
TLSH
T1F7F0170AA3F8020EF0B34B31BEF64363A1A8BC64DE3293AD1490035928645208962EB2
MD5 SHA1 SHA512 TLSH

Submit Download

fj4ltear.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fj4ltear\fj4ltear.0.cs
Size 195B
SHA256 0c22e48d3f9d2f354af65c45554f695484cbe61afda1f86775f72aed09fc7715
MD5 12518542fc8877cf32fd4ec59d04ee00
SHA1 689ae968b98158bd633f5c38e657018c4eb9363e
SHA512 1f9522e9c0df7bd8ae9a093116a009a9ae72e7c5a41da03b7e76a0760c77ea1d3cd28094be17e4ae7e6a6b1d1e0908d9c552150c35dafc56cc37a470c3d50aad
TLSH
T17CD0222832878BE7086241078C02908DFB6300A1077A1A00FAD82A12CD8B1229234C6C
MD5 SHA1 SHA512 TLSH

Submit Download

fj4ltear.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fj4ltear\fj4ltear.cmdline
Size 369B
SHA256 d19ef84bf341d78bbbd31b4257468fecaac71a01b9227c594e3e344f5afae764
MD5 461c0b38bb93979f07d5745e16d673d1
SHA1 7be08e73709d032f1d37994053116b9ef4e1292e
SHA512 c5d9ca55d553777f0acc7b8b0246470e9bedd936ab5ee18c3dba556f6a5cd412cdaca2809485c880489832a0c850e2a9368a5e10b75c836ae3f8a3a421caee0b
TLSH
T1FBE0683A43B6C2FD21F918073179C4ACA6724E4329403F885048440DE03740A6BE3761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3080-9-0x000002BAC9B60000-0x000002BAC9B82000-memory.dmp

Download

memory/3080-12-0x000002BAE2070000-0x000002BAE2080000-memory.dmp

Download

memory/3080-11-0x000002BAE2070000-0x000002BAE2080000-memory.dmp

Download

memory/3080-10-0x000002BAE4570000-0x000002BAE45C0000-memory.dmp

Download

memory/3080-0-0x000002BAE2070000-0x000002BAE2080000-memory.dmp

Download

memory/3080-1-0x000002BAE2070000-0x000002BAE2080000-memory.dmp

Download

memory/3080-25-0x000002BAC99C0000-0x000002BAC99C8000-memory.dmp

Download