Analysis
- user interaction
yes - max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/09/2026, 11:20
General
- Target Usdt-flasher.exe
- Size 12.0MB
- Sample260928-nfmdpasdlc
- SHA256 426e2ae7a21506e8d56493739f6e9c5afaf6018c505ee63371763624c75425fa
Malware Config
Extracted
-
svcstealer
-
http://185.156.72.89/nzcwzue/pqrfxn.php
-
http://185.156.72.8/diamo/post.php
-
http://194.38.21.76/diamo/post.php
-
bot_urls
http://213.226.113.54/bin/bot.dll
-
build_id
youfxs
-
srv_delay
1
-
srv_retry
1
Signatures
- Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 3 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Usdt-flasher.exe"C:\Users\Admin\AppData\Local\Temp\Usdt-flasher.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JEOF9.tmp\Usdt-flasher.tmp"C:\Users\Admin\AppData\Local\Temp\is-JEOF9.tmp\Usdt-flasher.tmp" /SL5="$400B0,2111313,813056,C:\Users\Admin\AppData\Local\Temp\Usdt-flasher.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Usdt-flasher.exe"C:\Users\Admin\AppData\Local\Temp\Usdt-flasher.exe" /VERYSILENT4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-I44G3.tmp\Usdt-flasher.tmp"C:\Users\Admin\AppData\Local\Temp\is-I44G3.tmp\Usdt-flasher.tmp" /SL5="$500B0,2111313,813056,C:\Users\Admin\AppData\Local\Temp\Usdt-flasher.exe" /VERYSILENT5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\Sysnative\regsvr32.exe" /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\Brown6.pfx"6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\Brown6.pfx\"' }) { exit 0 } else { exit 1 }"7⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell.exe" -NoProfile -NonInteractive -Command -7⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Windows\system32\regsvr32.EXE"C:\Windows\system32\regsvr32.EXE" /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\Brown6.pfx"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\Brown6.pfx\"' }) { exit 0 } else { exit 1 }"2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\regsvr32.EXE"C:\Windows\system32\regsvr32.EXE" /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\Brown6.pfx"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\Brown6.pfx\"' }) { exit 0 } else { exit 1 }"2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Brown6.pfx
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_yw1aovsu.jeh.ps1
Usdt-flasher.tmp
memory/548-147-0x0000024ADAFD0000-0x0000024ADB082000-memory.dmp
memory/1104-116-0x00007FF9FCA60000-0x00007FF9FCD17000-memory.dmp
memory/1240-157-0x00007FF9FCA60000-0x00007FF9FCD17000-memory.dmp
memory/1240-151-0x00007FF9FCA60000-0x00007FF9FCD17000-memory.dmp
memory/1868-69-0x0000000003EB0000-0x0000000003F31000-memory.dmp
memory/1868-63-0x0000000003EB0000-0x0000000003F31000-memory.dmp
memory/1868-71-0x0000000001510000-0x0000000001543000-memory.dmp
memory/1868-64-0x0000000003EB0000-0x0000000003F31000-memory.dmp
memory/1868-73-0x0000000003EB0000-0x0000000003F31000-memory.dmp
memory/1868-68-0x0000000003EB0000-0x0000000003F31000-memory.dmp
memory/1868-81-0x0000000003EB0000-0x0000000003F31000-memory.dmp
memory/1868-83-0x0000000003EB0000-0x0000000003F31000-memory.dmp
memory/2056-11-0x0000000000790000-0x0000000000866000-memory.dmp
memory/2056-1-0x0000000000790000-0x0000000000866000-memory.dmp
memory/2080-54-0x0000000000790000-0x0000000000866000-memory.dmp
memory/2080-8-0x0000000000790000-0x0000000000866000-memory.dmp
memory/2080-67-0x0000000000790000-0x0000000000866000-memory.dmp
memory/4140-10-0x00000000007B0000-0x0000000000B12000-memory.dmp
memory/4140-6-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/4204-55-0x0000000000550000-0x00000000008B2000-memory.dmp
memory/4204-66-0x0000000000550000-0x00000000008B2000-memory.dmp
memory/4204-16-0x0000000002A40000-0x0000000002A41000-memory.dmp
memory/4204-56-0x0000000002A40000-0x0000000002A41000-memory.dmp
memory/4992-65-0x00007FF9FCA60000-0x00007FF9FCD17000-memory.dmp
memory/4992-58-0x0000000048180000-0x00000000481FD000-memory.dmp
memory/4992-57-0x00007FF9FCA60000-0x00007FF9FCD17000-memory.dmp
memory/5532-107-0x00000245B1BD0000-0x00000245B1C82000-memory.dmp
memory/5604-36-0x0000022AB53F0000-0x0000022AB54A2000-memory.dmp
memory/5604-24-0x0000022AB5080000-0x0000022AB50A2000-memory.dmp
memory/5604-35-0x0000022AB5350000-0x0000022AB536E000-memory.dmp
memory/5604-38-0x0000022AB53A0000-0x0000022AB53BE000-memory.dmp
memory/5604-37-0x0000022AB5370000-0x0000022AB537A000-memory.dmp