Analysis
- max time kernel
149s - max time network
104s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/09/2026, 09:33
General
- Target 055da083df78e6d2b2eb10740a8feff3f293912aa9b0ebfd4dfcf257194c8027.bin.ps1
- Size 1.3MB
- Sample260915-ljcmjsfl3x
- SHA256 055da083df78e6d2b2eb10740a8feff3f293912aa9b0ebfd4dfcf257194c8027
Malware Config
Extracted
-
acrstealer
-
4.3.10-alpha1
-
cdn.tulipstone.cc
-
cloudflare.com
-
ddrs
https://telegra.ph/Built-in-Types-08-01
-
guids
f1575b64-8492-4e8b-b102-4d26e8c70371
019fd851-d0e2-7805-ae09-2dd1daa78960
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36
Signatures
- Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\055da083df78e6d2b2eb10740a8feff3f293912aa9b0ebfd4dfcf257194c8027.bin.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\055da083df78e6d2b2eb10740a8feff3f293912aa9b0ebfd4dfcf257194c8027.bin.ps12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/880-41-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/880-21-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/880-37-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/880-29-0x0000000005B10000-0x0000000005B2E000-memory.dmp
memory/880-35-0x000000000A480000-0x000000000AA3A000-memory.dmp
memory/880-34-0x0000000009D20000-0x0000000009D42000-memory.dmp
memory/880-33-0x0000000009CB0000-0x0000000009CCA000-memory.dmp
memory/880-32-0x0000000009DC0000-0x0000000009E56000-memory.dmp
memory/880-30-0x0000000005B30000-0x0000000005B7C000-memory.dmp
memory/880-36-0x000000000B0C0000-0x000000000B73C000-memory.dmp
memory/880-27-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/880-24-0x00000000054C0000-0x0000000005526000-memory.dmp
memory/880-28-0x00000000056B0000-0x0000000005A0B000-memory.dmp
memory/880-22-0x0000000004C20000-0x0000000004C42000-memory.dmp
memory/880-23-0x0000000004CC0000-0x0000000004D26000-memory.dmp
memory/880-18-0x0000000074B02000-0x0000000074B03000-memory.dmp
memory/880-19-0x0000000002630000-0x0000000002666000-memory.dmp
memory/880-20-0x0000000004E70000-0x00000000054BA000-memory.dmp
memory/3024-15-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-10-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-16-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-14-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-4-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-13-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-12-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-11-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-31-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-3-0x000002A81C480000-0x000002A81C4A2000-memory.dmp
memory/3024-9-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-8-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-7-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-6-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-5-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-17-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-47-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/3024-0-0x00007FF8A3C6F000-0x00007FF8A3C70000-memory.dmp
memory/4800-38-0x0000000000B30000-0x0000000000B6E000-memory.dmp
memory/4800-42-0x0000000002A60000-0x0000000002B1F000-memory.dmp
memory/4800-39-0x0000000002A60000-0x0000000002B1F000-memory.dmp
memory/4800-49-0x0000000002A60000-0x0000000002B1F000-memory.dmp
memory/4800-54-0x0000000002A60000-0x0000000002B1F000-memory.dmp
memory/4800-85-0x0000000002A60000-0x0000000002B1F000-memory.dmp
memory/4800-91-0x0000000002A60000-0x0000000002B1F000-memory.dmp
memory/4800-132-0x0000000002A60000-0x0000000002B1F000-memory.dmp
memory/4800-140-0x0000000002A60000-0x0000000002B1F000-memory.dmp
memory/4800-141-0x0000000002A60000-0x0000000002B1F000-memory.dmp
memory/4800-183-0x0000000002A60000-0x0000000002B1F000-memory.dmp