Analysis
- max time kernel
299s - max time network
254s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 03:15
General
- Target SnowRunner_SharedFleet_v1_2U44.cmd
- Size 1.6MB
- Sample261023-dr5paszt5m
- SHA256 7664db71e49bfa54b0b879111ddbdc8e15d3a63585f91f5dc4320ffbfef5616a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SnowRunner_SharedFleet_v1_2U44.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -STA -Command "$ErrorActionPreference='Stop';try{$SelfText=[IO.File]::ReadAllText($env:SF_SELF,[Text.Encoding]::UTF8).Replace([string]([char]13)+[char]10,[string][char]10);$a='#'+'<SF-BOOT>';$z='#'+'</SF-BOOT>';$i=$SelfText.IndexOf($a);if($i -lt 0){throw 'Installer code missing'};$i+=$a.Length;$j=$SelfText.IndexOf($z,$i);if($j -lt $i){throw 'Installer code truncated'};& ([ScriptBlock]::Create($SelfText.Substring($i,$j-$i)))}catch{Write-Host $_.Exception.Message -ForegroundColor Red;exit 1}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ysubmxgg\ysubmxgg.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0D5.tmp" "c:\Users\Admin\AppData\Local\Temp\ysubmxgg\CSCDF06B106595240DFBD1232D8A6BA4FED.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESA0D5.tmp
__PSScriptPolicyTest_phk5yndl.bh2.psm1
ysubmxgg.dll
CSCDF06B106595240DFBD1232D8A6BA4FED.TMP
ysubmxgg.0.cs
ysubmxgg.cmdline
memory/3176-18-0x00000259B7F80000-0x00000259B8032000-memory.dmp
memory/3176-22-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-11-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-10-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-12-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-13-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-16-0x00000259B7F60000-0x00000259B7F7E000-memory.dmp
memory/3176-17-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-0-0x00007FFF8BA6F000-0x00007FFF8BA70000-memory.dmp
memory/3176-19-0x00000259B8040000-0x00000259B804A000-memory.dmp
memory/3176-8-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-20-0x00000259B84E0000-0x00000259B84FE000-memory.dmp
memory/3176-21-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-9-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-23-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-42-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-52-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-7-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-6-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-5-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-4-0x000002599FEC0000-0x000002599FEE2000-memory.dmp
memory/3176-64-0x000002599FF20000-0x000002599FF2E000-memory.dmp
memory/3176-3-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-66-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3176-67-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp