Analysis
- max time kernel
38s - max time network
44s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 12:45
General
- Target 568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134.exe
- Size 22.0MB
- Sample261003-py5teszyat
- SHA256 568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134.exe"C:\Users\Admin\AppData\Local\Temp\568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -STA -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\nsp362B.tmp\payload\Install-CLIPVIDE.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vbkpds2k\vbkpds2k.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E21.tmp" "c:\Users\Admin\AppData\Local\Temp\vbkpds2k\CSC1920EC01B6B54A6782F2CADD793A7EA.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CLIPVIDE-Setup-7c125224-f6ee-4220-b675-28dc534f7012\node\node-v24.21.0-win-x64\node.exe"C:\Users\Admin\AppData\Local\Temp\CLIPVIDE-Setup-7c125224-f6ee-4220-b675-28dc534f7012\node\node-v24.21.0-win-x64\node.exe" --version3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541.zip
LICENSE
LICENSE
LICENSE
witness.js
package.json
package.json
LICENSE
LICENSE
LICENSE.md
LICENSE
RES6E21.tmp
System.dll
nsDialogs.dll
Install-CLIPVIDE.ps1
vbkpds2k.dll
CSC1920EC01B6B54A6782F2CADD793A7EA.TMP
vbkpds2k.0.cs
vbkpds2k.cmdline
memory/2984-10-0x0000000073C29000-0x0000000073C2A000-memory.dmp
memory/2984-216-0x0000000000400000-0x000000000045C000-memory.dmp
memory/2984-168-0x0000000000400000-0x000000000045C000-memory.dmp
memory/2984-170-0x0000000073CE0000-0x0000000073CEC000-memory.dmp
memory/2984-171-0x0000000073C20000-0x0000000073C2F000-memory.dmp
memory/3024-180-0x00000000056A0000-0x0000000005706000-memory.dmp
memory/3024-188-0x0000000007290000-0x000000000790C000-memory.dmp
memory/3024-191-0x0000000007040000-0x00000000070D2000-memory.dmp
memory/3024-190-0x0000000007ED0000-0x000000000848A000-memory.dmp
memory/3024-205-0x0000000004A60000-0x0000000004A68000-memory.dmp
memory/3024-206-0x0000000007010000-0x000000000701A000-memory.dmp
memory/3024-207-0x0000000073350000-0x0000000073B0C000-memory.dmp
memory/3024-208-0x0000000073350000-0x0000000073B0C000-memory.dmp
memory/3024-209-0x000000000A410000-0x000000000A4A6000-memory.dmp
memory/3024-210-0x000000000A3A0000-0x000000000A3C2000-memory.dmp
memory/3024-213-0x0000000073362000-0x0000000073363000-memory.dmp
memory/3024-214-0x0000000073350000-0x0000000073B0C000-memory.dmp
memory/3024-189-0x00000000061F0000-0x000000000620A000-memory.dmp
memory/3024-192-0x0000000006FC0000-0x0000000006FCA000-memory.dmp
memory/3024-222-0x000000000AB40000-0x000000000AB52000-memory.dmp
memory/3024-228-0x0000000073350000-0x0000000073B0C000-memory.dmp
memory/3024-186-0x0000000005C90000-0x0000000005CDC000-memory.dmp
memory/3024-896-0x0000000073350000-0x0000000073B0C000-memory.dmp
memory/3024-185-0x00000000058D0000-0x00000000058EE000-memory.dmp
memory/3024-184-0x0000000005910000-0x0000000005C6B000-memory.dmp
memory/3024-181-0x0000000005710000-0x0000000005776000-memory.dmp
memory/3024-179-0x0000000004D80000-0x0000000004DA2000-memory.dmp
memory/3024-1135-0x0000000073350000-0x0000000073B0C000-memory.dmp
memory/3024-178-0x0000000073350000-0x0000000073B0C000-memory.dmp
memory/3024-177-0x0000000004E20000-0x000000000546A000-memory.dmp
memory/3024-176-0x0000000073350000-0x0000000073B0C000-memory.dmp
memory/3024-175-0x0000000002410000-0x0000000002446000-memory.dmp
memory/3024-174-0x0000000073362000-0x0000000073363000-memory.dmp