Analysis
- max time kernel
149s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 17:13
General
- Target $R0/Uninstall liner.exe
- Size 515KB
- Sample261020-vrlpvsty6q
- SHA256 b923c84309725733bac576fea655cfedf675b9c727d60a320749ac3b24dc8bde
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 13 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall liner.exe"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall liner.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\liner', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_rbmnmlzs.dah.psm1
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
Un_A.exe
memory/1068-29-0x0000000004EF0000-0x000000000553A000-memory.dmp
memory/1068-48-0x0000000007620000-0x0000000007C9C000-memory.dmp
memory/1068-32-0x0000000005670000-0x00000000056D6000-memory.dmp
memory/1068-33-0x00000000056E0000-0x0000000005746000-memory.dmp
memory/1068-36-0x0000000005750000-0x0000000005AAB000-memory.dmp
memory/1068-37-0x0000000005C30000-0x0000000005C4E000-memory.dmp
memory/1068-38-0x0000000005C70000-0x0000000005CBC000-memory.dmp
memory/1068-39-0x0000000006220000-0x0000000006256000-memory.dmp
memory/1068-43-0x0000000006C20000-0x0000000006C40000-memory.dmp
memory/1068-30-0x0000000073870000-0x000000007402C000-memory.dmp
memory/1068-40-0x0000000070230000-0x000000007027C000-memory.dmp
memory/1068-45-0x0000000006EF0000-0x0000000006F93000-memory.dmp
memory/1068-44-0x0000000073870000-0x000000007402C000-memory.dmp
memory/1068-46-0x0000000073870000-0x000000007402C000-memory.dmp
memory/1068-47-0x0000000073870000-0x000000007402C000-memory.dmp
memory/1068-31-0x0000000004E50000-0x0000000004E72000-memory.dmp
memory/1068-49-0x0000000006FA0000-0x0000000006FBA000-memory.dmp
memory/1068-50-0x0000000007010000-0x000000000701A000-memory.dmp
memory/1068-51-0x00000000071B0000-0x00000000071DA000-memory.dmp
memory/1068-52-0x0000000005F70000-0x0000000005F94000-memory.dmp
memory/1068-53-0x00000000703E0000-0x000000007073B000-memory.dmp
memory/1068-55-0x0000000073870000-0x000000007402C000-memory.dmp
memory/1068-26-0x0000000073882000-0x0000000073883000-memory.dmp
memory/1068-28-0x0000000073870000-0x000000007402C000-memory.dmp
memory/1068-27-0x0000000002790000-0x00000000027C6000-memory.dmp
memory/2756-74-0x00000000061F0000-0x000000000654B000-memory.dmp
memory/2756-76-0x0000000070230000-0x000000007027C000-memory.dmp
memory/2756-79-0x0000000070390000-0x00000000706EB000-memory.dmp
memory/5968-66-0x0000000007B30000-0x0000000007BC6000-memory.dmp
memory/5968-67-0x0000000007AB0000-0x0000000007AC1000-memory.dmp
memory/5968-63-0x0000000070230000-0x000000007027C000-memory.dmp
memory/5968-59-0x0000000005FA0000-0x00000000062FB000-memory.dmp