Analysis
- max time kernel
149s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 16:03
General
- Target glib-2.0.dll
- Size 1.2MB
- Sample260916-thf8casfmc
- SHA256 29f281e0e9ebc9cc7b54af08535509feac1930a60d3d2e2fe9528f77711f04a8
Malware Config
Signatures
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\glib-2.0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\544a50e8.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\tar.exe"tar" -xf "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip" -C "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
python.zip
python312._pth
544a50e8.ps1
memory/4864-13-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-15-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-8-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-9-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-10-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-11-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-6-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-1-0x00007FFF31DEF000-0x00007FFF31DF0000-memory.dmp
memory/4864-14-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-7-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-17-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-16-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-18-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-19-0x000001F18ADE0000-0x000001F18ADFC000-memory.dmp
memory/4864-20-0x000001F1A3560000-0x000001F1A3566000-memory.dmp
memory/4864-5-0x000001F18AD50000-0x000001F18AD72000-memory.dmp
memory/4864-2-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-60-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-62-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp
memory/4864-64-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp