Analysis
- max time kernel
38s - max time network
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 21:09
General
- Target XDLQZ.ps1
- Size 1KB
- Sample261011-zzyrlsxtbx
- SHA256 dc39349168907b1d837123465116e6bda65da4857ac5b298831634a4620f1a9d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\XDLQZ.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
__PSScriptPolicyTest_q1vyziok.xi2.psm1
memory/4496-10-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-14-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-6-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-7-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-8-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-9-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-0-0x00007FFF2632F000-0x00007FFF26330000-memory.dmp
memory/4496-11-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-2-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-5-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-22-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-16-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/4496-1-0x000001931A600000-0x000001931A622000-memory.dmp
memory/4496-18-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/5792-17-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp
memory/5792-15-0x000001F8557A0000-0x000001F8557E8000-memory.dmp
memory/5792-23-0x00007FFF261A0000-0x00007FFF26B44000-memory.dmp