Resubmissions
24/10/2026, 21:28
261024-1bcd5scv4v324/10/2026, 21:21
261024-z7rchacv2t324/10/2026, 21:15
261024-z4awcaxsbx3Analysis
- user interaction
yes - max time kernel
171s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 21:28
General
- Target Buckshot-Roulette-Mod/BuckshotRouletteModMenu-TheHolyOneZ-Windows-v1.0.0.zip
- Size 5.6MB
- Sample261024-1bcd5scv4v
- SHA256 1884b23da290786d5a0bc53dd159d492aec5fad133d63041824f9816881ea361
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Buckshot-Roulette-Mod\BuckshotRouletteModMenu-TheHolyOneZ-Windows-v1.0.0.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_knfkh0rm.eke.ps1
memory/3868-21-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-15-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-11-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-12-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-14-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-13-0x000002592BA60000-0x000002592BAA8000-memory.dmp
memory/3868-3-0x00007FFD2CD6F000-0x00007FFD2CD70000-memory.dmp
memory/3868-16-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-17-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-18-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-9-0x000002592B630000-0x000002592B652000-memory.dmp
memory/3868-19-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-35-0x000002592BA50000-0x000002592BA5A000-memory.dmp
memory/3868-31-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-33-0x000002592BBD0000-0x000002592BBEE000-memory.dmp
memory/3868-34-0x000002592BBF0000-0x000002592BCA2000-memory.dmp
memory/3868-23-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-36-0x000002592BCB0000-0x000002592BCCE000-memory.dmp
memory/3868-37-0x00007FFD2CBE0000-0x00007FFD2D584000-memory.dmp
memory/3868-47-0x000002592BA50000-0x000002592BA5A000-memory.dmp
memory/3868-48-0x000002592BBD0000-0x000002592BBEC000-memory.dmp
memory/3868-49-0x000002592BBB0000-0x000002592BBB8000-memory.dmp
memory/3868-50-0x000002592BBC0000-0x000002592BBC6000-memory.dmp
memory/3868-51-0x000002592C0B0000-0x000002592C0BA000-memory.dmp