a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe
Size 111.9MB
Sample261016-jbk8lsbs8t
SHA256 a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405
MD5 41c6455273a28d6294052a3db575f2ea
SHA1 9d096b140e38a6d880e0960725e4abbd47ea4582
SHA512 d9ea61522dc342a74bf79afe648b655f8e1f661e46bcde4c62846c3bd99c160010c14759968f86140f627b93b45bba23175515fdead17740a3da4f8ea3f5c94f
SSDEEP 1572864:1Pp36F/iKRzko0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZh:1PpIlkheuXpX/z/5NivOcC7hlTrv
TLSH
T16F48F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2404	powershell.exe
4860	powershell.exe
2404	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4600	26oPGTlr8cuV.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	26oPGTlr8cuV.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1932	cmd.exe
4148	cmd.exe
1936	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4860	powershell.exe
4860	powershell.exe
2404	powershell.exe
2404	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeIncreaseQuotaPrivilege	2404	powershell.exe
Token: SeSecurityPrivilege	2404	powershell.exe
Token: SeTakeOwnershipPrivilege	2404	powershell.exe
Token: SeLoadDriverPrivilege	2404	powershell.exe
Token: SeSystemProfilePrivilege	2404	powershell.exe
Token: SeSystemtimePrivilege	2404	powershell.exe
Token: SeProfSingleProcessPrivilege	2404	powershell.exe
Token: SeIncBasePriorityPrivilege	2404	powershell.exe
Token: SeCreatePagefilePrivilege	2404	powershell.exe
Token: SeBackupPrivilege	2404	powershell.exe
Token: SeRestorePrivilege	2404	powershell.exe
Token: SeShutdownPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeSystemEnvironmentPrivilege	2404	powershell.exe
Token: SeRemoteShutdownPrivilege	2404	powershell.exe
Token: SeUndockPrivilege	2404	powershell.exe
Token: SeManageVolumePrivilege	2404	powershell.exe
Token: 33	2404	powershell.exe
Token: 34	2404	powershell.exe
Token: 35	2404	powershell.exe
Token: 36	2404	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 1932	5880	a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe	90
PID 1932 wrote to memory of 4860	1932	cmd.exe	92
PID 5880 wrote to memory of 4148	5880	a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe	93
PID 4148 wrote to memory of 1920	4148	cmd.exe	95
PID 1920 wrote to memory of 1772	1920	net.exe	96
PID 5880 wrote to memory of 1936	5880	a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe	97
PID 1936 wrote to memory of 2404	1936	cmd.exe	99
PID 2404 wrote to memory of 2968	2404	powershell.exe	101
PID 5880 wrote to memory of 4600	5880	a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe	102

C:\Users\Admin\AppData\Local\Temp\a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe
"C:\Users\Admin\AppData\Local\Temp\a11758424a6ec560d2f4c37d0c596ee4fda2c26d645f6c872a30edd5d378d405.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('version 1.0.0','Program','OK','Information')"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('version 1.0.0','Program','OK','Information')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP,'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'; gpupdate /force""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP,'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'; gpupdate /force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force
      4⤵
      PID:2968
- C:\ProgramData\26oPGTlr8cuV.exe
  C:\ProgramData\26oPGTlr8cuV.exe
  2⤵
  - Executes dropped EXE
  - Checks for VirtualBox DLLs, possible anti-VM trick
  PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

26oPGTlr8cuV.exe

Path C:\ProgramData\26oPGTlr8cuV.exe
Size 809KB
SHA256 c62c4ef6244f7e552813c8b7e3c47dbc758fa2fcbad8c0d07225f444697e420f
MD5 76cb00a1eff64dc2b0b1e061b0aa109e
SHA1 ba967d8bc78b93513e12d0a72fb126142ebdf105
SHA512 7ba204ed24943efa9fcd603636883f5455caa23c9ec5943ade8a9b3a752d1fcd16ddf35544b17d06f17934d96ff6e9760706cfa2293410e15f85a5f0152e83a8
SSDEEP 6144:XmK/bwx6NI08VGSh1cjqrsr5y2JUQjWqX4C46I84eR+ZtBQ0QX3jUzgyOKbySeR4:XmibwM8VbQqrN9dWBaOmQ
TLSH
T1540574B2A312B541E843D37ABD1F2B575A7E3DC60224EA322099CF5134E29734579B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_kuqr5drn.uhf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kuqr5drn.uhf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2404-32-0x0000027BE9DD0000-0x0000027BE9DDA000-memory.dmp

Download

memory/2404-31-0x0000027BE9D10000-0x0000027BE9DC2000-memory.dmp

Download

memory/2404-30-0x0000027BE9CF0000-0x0000027BE9D0E000-memory.dmp

Download

memory/4860-12-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/4860-13-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/4860-14-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/4860-16-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/4860-1-0x00007FFE7CA4F000-0x00007FFE7CA50000-memory.dmp

Download

memory/4860-11-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/4860-10-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/4860-9-0x000001E4A90F0000-0x000001E4A9112000-memory.dmp

Download

memory/4860-7-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download