adb4aa39c6cd6d30850fcbd2be0298f4e0ceedee57f4820b39beb48ebedf13cc

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-26nlbsaa33
SHA256 adb4aa39c6cd6d30850fcbd2be0298f4e0ceedee57f4820b39beb48ebedf13cc
MD5 47e4272fe7f980bc809e85f896564a6e
SHA1 981a421cdc6d0780d223320c1d43df3c187c1aa0
SHA512 f50e22cd6343089c5f5bdea7b9b5d8920a107b1fd373fabdbb1a1ca199f69e08d45dbed3901dcea04c6d350f529a5b0a7bdd8465a7ff64bb870781eef9ddafca
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4736	powershell.exe
7	4736	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4736	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4736	powershell.exe
4736	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4196	4736	powershell.exe	88
PID 4196 wrote to memory of 3192	4196	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ykl1qxjt\ykl1qxjt.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9834.tmp" "c:\Users\Admin\AppData\Local\Temp\ykl1qxjt\CSCBA43B14A45224FBFB181A93E2D701664.TMP"
    3⤵
    PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9834.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9834.tmp
Size 1KB
SHA256 1465ba99522706d0f909ada9241bae3681e8ea4c33a3ff7fd0f59fdbc0a58283
MD5 8b1f596f8c3df0755f8fc4ea80456532
SHA1 a0e09f13342317eaa283e576f2f7b9e0fcded2e2
SHA512 9b736258d1cbbfeb62de0595222802e89935853fc829d924b337c58d845489fee35e13be2e3a3ffec3fefdd42d9c04c36a427a6b04dc75d0e28b1b7ea2af1688
TLSH
T10621EB0A83EC8B1EF0730731B8F6172BA239FDA4EF62935B8440422C1C41544EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_41fafl5p.2ls.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_41fafl5p.2ls.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ykl1qxjt.dll

Path C:\Users\Admin\AppData\Local\Temp\ykl1qxjt\ykl1qxjt.dll
Size 3KB
SHA256 36e81f9757bf7460540134aa43c4f9118a884feb2dbd3eb47b20fdcd39915cab
MD5 ffafc0f1cf26e13697faa1f0c9d7c50e
SHA1 1415f76ae78f7274c6b85794e9f12d9e588ec5d2
SHA512 7d5b1d10c271a60ed1e497d8b42345ce8a28e60f4533f2f3e6691e30bbe9ffecb451de990e2c8511a6b720b437f0412c93c1624ef5d157eb32ba04f3a3fb70dc
TLSH
T10A51CF1A57E4466BE4770731AEE3436737B4FC209F73535E1980026CAC617A45E36BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBA43B14A45224FBFB181A93E2D701664.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ykl1qxjt\CSCBA43B14A45224FBFB181A93E2D701664.TMP
Size 652B
SHA256 dcaa8f73c669f69ee2a9335ea7dfc07d6284c241d463422626800a9137a8deb8
MD5 369b22315fc59b1d9b38d38f1657bdf0
SHA1 8ad4d4f46c2790d6528d1e517c161d182c048e01
SHA512 246b214089fc23b6fe372adf147cad91371727f15b0af2baf8dc441d1af5b57f94808912924f84fc8b1f6c3abef3289ed3f2673be0166b8e64044d47a9f83a09
TLSH
T1EFF05E0A63F8420EF0F35B70BDF6436391A9BC64DF3293ED1840036D28649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ykl1qxjt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ykl1qxjt\ykl1qxjt.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

ykl1qxjt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ykl1qxjt\ykl1qxjt.cmdline
Size 369B
SHA256 0ca9c5c7880da15e0a5a1de0eee5a062e634ec3f542efa371ee241838bc6765b
MD5 07161551f8d38be58270e59756ab086e
SHA1 3df84314e373178b1214dc6b8a3a5549be451660
SHA512 12f3a06faa53b688321c392a7fd4dfda0d54f441789ea0117d1d84493d8ff70b0ec2b5689428cc9260ddbe287e99db07d70136dd5b0a91e1743cc8c93f254295
TLSH
T10FE0C03E424EC37D91DD2047A169C5ACC2724F432A483FE4505B483DD33708827D1749
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4736-2-0x00000177C6D30000-0x00000177C6D52000-memory.dmp

Download

memory/4736-10-0x00000177C74F0000-0x00000177C76B2000-memory.dmp

Download

memory/4736-1-0x00000177C6370000-0x00000177C6380000-memory.dmp

Download

memory/4736-0-0x00000177C6370000-0x00000177C6380000-memory.dmp

Download

memory/4736-23-0x00000177C6360000-0x00000177C6368000-memory.dmp

Download

memory/4736-25-0x00000177C6370000-0x00000177C6380000-memory.dmp

Download

memory/4736-24-0x00000177C6370000-0x00000177C6380000-memory.dmp

Download

memory/4736-28-0x00000177C6E60000-0x00000177C6FAE000-memory.dmp

Download