Analysis
- max time kernel
299s - max time network
217s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/10/2026, 03:58
General
- Target A0-6A086A5-A4djfhhryy-45.ps1
- Size 4.3MB
- Sample261007-ejlf5a1zdy
- SHA256 c57fa43fe729fc45ac725798a3f12d1eafcbe9b91c14046e98485033cb7e4fc9
Malware Config
Signatures
- Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\A0-6A086A5-A4djfhhryy-45.ps11⤵
- Badlisted process makes network request
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Adobe\Sync\CloudAgent\609d19a4d0df59d5\complex.exe"C:\Users\Admin\AppData\Roaming\Adobe\Sync\CloudAgent\609d19a4d0df59d5\complex.exe" "C:\Users\Admin\AppData\Roaming\Adobe\Sync\CloudAgent\609d19a4d0df59d5\"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kuvddpa3.qcw.psm1
HTCTL32.DLL
MSVCR100.dll
NSM.LIC
PCICHEK.DLL
PCICL32.dll
client32.ini
complex.exe
pcicapi.dll
memory/4504-21-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-27-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-8-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-9-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-10-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-11-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-12-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-13-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-14-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-15-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-16-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-17-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-18-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-19-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-20-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-6-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-22-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-23-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-24-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-26-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-25-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-7-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-29-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-30-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-28-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-31-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-33-0x000001AE11160000-0x000001AE1116A000-memory.dmp
memory/4504-34-0x000001AE39900000-0x000001AE39912000-memory.dmp
memory/4504-35-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-64-0x000001AE3A310000-0x000001AE3A3C2000-memory.dmp
memory/4504-69-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-72-0x000001AE3A2E0000-0x000001AE3A2EA000-memory.dmp
memory/4504-5-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-63-0x000001AE3A2F0000-0x000001AE3A30E000-memory.dmp
memory/4504-4-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-3-0x000001AE29880000-0x000001AE298A2000-memory.dmp
memory/4504-77-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp
memory/4504-0-0x00007FF8A3C6F000-0x00007FF8A3C70000-memory.dmp
memory/4504-80-0x000001AE3A3F0000-0x000001AE3A40E000-memory.dmp
memory/4504-82-0x000001AE3A3D0000-0x000001AE3A4C0000-memory.dmp
memory/4504-83-0x00007FF8A3AE0000-0x00007FF8A4484000-memory.dmp