Analysis
- max time kernel
149s - max time network
146s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
17/10/2026, 01:25
General
- Target irm https://xmake.io/psget.text | iex.ps1
- Size 37B
- Sample261017-bs8fgagv2v
- SHA256 f5ff18c20f54920226d4886ff2eb75fa3c163bf8e68663cc4e38d91950eb8900
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\irm https_\xmake.io\psget.text _ iex.ps1"1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4960-xmake-installer.exe"C:\Users\Admin\AppData\Local\Temp\4960-xmake-installer.exe" /NOADMIN /S /D=C:\Users\Admin\xmake2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\xmake\xmake.exe"C:\Users\Admin\xmake\xmake.exe" --version2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c ver3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\xmake\xmake.exe"C:\Users\Admin\xmake\xmake.exe" update --integrate2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c ver3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\where.exewhere.exe pwsh.exe3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exeC:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe -c $PSVersionTable3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exeC:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe -c "Write-Output $PROFILE.CurrentUserAllHosts"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_d68cd3c9402b1000517d792489e785a0
4960-xmake-installer.exe
__PSScriptPolicyTest_2pxfc2nc.uqc.ps1
System.dll
is_host.lua
is_subhost.lua
tonumber.lua
tostring.lua
type.lua
unpack.lua
check_main.lua
cfeatures.lua
cxxfeatures.lua
features.lua
has_flags.lua
features.lua
has_flags.lua
icpx.lua
has_flags.lua
features.lua
main.lua
main.lua
faq.lua
ProjectConfiguration(mode,arch)
XmakePath(mode,arch)
File.c(filec)
File.none(filenone)
File.none(filenone)
depot_tools.lua
devel.lua
llvm-mingw.lua
llvm.lua
mingw-w64.lua
msvc.lua
msys2-mingw32.lua
msys2-mingw64.lua
msys2.lua
python2.lua
python3.lua
xmake.lua
main.cpp
xmake.lua
xmake.lua
main.cpp
main.qml
qml.qrc
xmake.lua
xmake.lua
demo.cpp
xmake.lua
xmake.lua
mainwindow.cpp
mainwindow.h
mainwindow.ui
xmake.lua
xmake.lua
main.cpp
xmake.lua
foo.cpp
xmake.lua
xmake.lua
xmake.lua
add.c
sub.c
xmake.lua
xmake.lua
.gitignore
foo.c
main.c
xmake.lua
main.c
xmake.lua
main.lua
xmake.lua
xmake.lua
foo.cs
main.cs
xmake.lua
xmake.lua
xmake.lua
xmake.lua
xmake.lua
main.d
xmake.lua
xmake.lua
main.f90
test.f90
xmake.lua
xmake.lua
xmake.lua
foo.kt
main.c
xmake.lua
xmake.lua
main.nim
xmake.lua
xmake.lua
xmake.lua
test.mm
xmake.lua
main.m
xmake.lua
xmake.lua
xmake.lua
AppDelegate.h
Contents.json
LaunchScreen.storyboard
Main.storyboard
Info.plist
SceneDelegate.h
SceneDelegate.m
ViewController.h
ViewController.m
main.m
xmake.lua
test.m
xmake.lua
AppDelegate.h
Contents.json
Main.storyboard
Info.plist
ViewController.h
ViewController.m
main.m
test.entitlements
Contents.json
Info.plist
test.h
xmake.lua
xmake.lua
xmake.lua
foo.rs
main.rs
xmake.lua
xmake.lua
xmake.lua
main.vala
mymath.vala
xmake.lua
xmake.lua
xmake.lua
main.zig
test.zig
xmake.lua
xmake.lua
memory/4960-1-0x0000011EE2050000-0x0000011EE2060000-memory.dmp
memory/4960-25-0x00007FF445880000-0x00007FF445890000-memory.dmp
memory/4960-24-0x0000011EE2050000-0x0000011EE2060000-memory.dmp
memory/4960-22-0x0000011EE2050000-0x0000011EE2060000-memory.dmp
memory/4960-23-0x0000011EE2050000-0x0000011EE2060000-memory.dmp
memory/4960-9-0x0000011EE2010000-0x0000011EE2032000-memory.dmp
memory/4960-20-0x0000011EE35E0000-0x0000011EE35EA000-memory.dmp
memory/4960-12-0x00007FF445880000-0x00007FF445890000-memory.dmp
memory/4960-11-0x0000011EE3950000-0x0000011EE3B12000-memory.dmp
memory/4960-10-0x0000011EE2050000-0x0000011EE2060000-memory.dmp
memory/4960-0-0x0000011EE2050000-0x0000011EE2060000-memory.dmp