a412ca8fcffdb28e3727835fa3e138a2b29933f55183464373678f6281e4f715

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 42B
Sample261002-26rb8aaa37
SHA256 a412ca8fcffdb28e3727835fa3e138a2b29933f55183464373678f6281e4f715
MD5 f982fe2cea50bf1d07bbb35a5ec7406a
SHA1 468718bb9ad4236a44c0b736aa2c21881561c55d
SHA512 2136621b58d1dabe2ac7bbab44fd5d5492932561733ff491d598b081d96f19ebe3a61043ed9f02f365274cd28af12058e34ea3d94582f3e5ab1121437d65cbf3
MD5 SHA1 SHA512

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4516	powershell.exe
7	4516	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4516	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4516	powershell.exe
4516	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 2232	4516	powershell.exe	88
PID 2232 wrote to memory of 2156	2232	csc.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\krpsb3ab\krpsb3ab.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF75.tmp" "c:\Users\Admin\AppData\Local\Temp\krpsb3ab\CSC96534036F4D64E9CA5F6FFC2E73F3A3D.TMP"
    3⤵
    PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESAF75.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAF75.tmp
Size 1KB
SHA256 a0dfeda74a8db2fefd4c03012dbcd7a9abc2a8216010554397e9abb4398248be
MD5 bdb13ce7f71d63051ab1329fb37aea3c
SHA1 263076316b1d5b9fb0ccee7621602e411afb36f6
SHA512 c0a1d9c8b822569fc8c8ce698d326cfe8def936aa77ddabf1c028b61212723c3e8b4b8081954c3e0c6d780f3ac142b42f2abedce0e8e0950ae0f7f65f8c1471f
TLSH
T1C021800493E8471EF07757326AF5076B9228FD65EF61575B8540422C1C51544EFA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_k0dcersx.m30.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k0dcersx.m30.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

krpsb3ab.dll

Path C:\Users\Admin\AppData\Local\Temp\krpsb3ab\krpsb3ab.dll
Size 3KB
SHA256 6a9fe3d43cd050fed60d884d2cb69953b9a9aa82f212651175989654d021188f
MD5 fce91a77daf7391eac3dbc0d89efdf98
SHA1 adf7cfb0132a3554194f8f51c31d1b002c398cdc
SHA512 31cd70f85955fd0ef28eed4faf3cc64f9381487fb0dd00e4c7bf1473123ebf4e10014e6d2b723548effbfb59d5625aa1d5026883d4aed2a22822c23dfa3e9aec
TLSH
T1E451EF1A93E8466BE4734B319EF3436637B4F8149F73531A098002186C617645E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC96534036F4D64E9CA5F6FFC2E73F3A3D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\krpsb3ab\CSC96534036F4D64E9CA5F6FFC2E73F3A3D.TMP
Size 652B
SHA256 7aba153d966ccad36863022e6731f1de5594e7af95749ff87148daadf789208b
MD5 07e6c41d76b5e78d4b2299a950360973
SHA1 ff4ec30b2a6e63b966de3f1dfdd697d184ab08c2
SHA512 71a2c60c11efd7d368ae52777e570f4e022403a3e779b56ea3ec75ca4b95797d12826854cbb270e869eb3de2b53c62e00ad8a9c592d9de773ff14fd3251b7787
TLSH
T16CF0300963F8120AF4F38B31B9F543A39568BC65EE3253ED154003191874510D661F71
MD5 SHA1 SHA512 TLSH

Submit Download

krpsb3ab.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\krpsb3ab\krpsb3ab.0.cs
Size 274B
SHA256 60036692b91d9da79183ebb05c81c25fa49f07dac3b951002976146440045411
MD5 8db146cc6f928371afdf2df8932c327a
SHA1 114928afbe52e80d95afca3e4805cc0255ef50cb
SHA512 d8cccab9b16bd7657e63d74e096145ef258a0939944f9f0443cf688d93edf28740865e74800a8b29e559b5ad3ca3926feecb70db01256bbb770ccc477dd3c86d
TLSH
T198D012187AA3EB705062482A8D4ED0FCB62B942666AB2A006AB41311DF8B0064635A59
MD5 SHA1 SHA512 TLSH

Submit Download

krpsb3ab.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\krpsb3ab\krpsb3ab.cmdline
Size 369B
SHA256 20fa21d50e386bf30ef7bb7cf1449b70e5d4bedd7c65824475091912c2f0d768
MD5 54aeede5742725e1ee88d4c1a1c279c1
SHA1 c933005b5cca94c126fa24d501c210c814c19bce
SHA512 680f5eefe3d8d51f79c242f908349dc84d5b1b5f5bae74bf454b97d44794a4112efec9223df58d7835eae98aedb7962d52237c0ea08e723e25e00999a2252bf1
TLSH
T18DE06F2A8246C6FD01ED504B276AC4BC8272068F2980BF88A044848DE0270087BD2FAA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4516-0-0x0000026A7BD40000-0x0000026A7BD50000-memory.dmp

Download

memory/4516-1-0x0000026A7BD40000-0x0000026A7BD50000-memory.dmp

Download

memory/4516-7-0x0000026A7E260000-0x0000026A7E282000-memory.dmp

Download

memory/4516-10-0x0000026A7EB60000-0x0000026A7ED22000-memory.dmp

Download

memory/4516-23-0x0000026A7E6D0000-0x0000026A7E6D8000-memory.dmp

Download

memory/4516-24-0x0000026A7BD40000-0x0000026A7BD50000-memory.dmp

Download