Analysis
- user interaction
yes - max time kernel
37s - max time network
25s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 08:19
General
- Target FNLB-Setup.exe
- Size 93.7MB
- Sample261024-j74ptss1ht
- SHA256 19bdd3d73e27529b7282a98f20eb1524937df960dd55953e477da3e5b48fa64e
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FNLB-Setup.exe"C:\Users\Admin\AppData\Local\Temp\FNLB-Setup.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FNLB-Setup-nsis.exeC:\Users\Admin\AppData\Local\Temp\FNLB-Setup-nsis.exe /S --force-run2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ufbqhy4f.jal.psm1
StdUtils.dll
System.dll
nsExec.dll
memory/3268-138-0x0000027162458000-0x0000027162459000-memory.dmp
memory/3268-135-0x000002716245B000-0x000002716245C000-memory.dmp
memory/3268-8-0x0000027162414000-0x0000027162415000-memory.dmp
memory/3268-48-0x0000027162413000-0x0000027162414000-memory.dmp
memory/3268-47-0x0000027162415000-0x0000027162417000-memory.dmp
memory/3268-52-0x0000027162411000-0x0000027162412000-memory.dmp
memory/3268-57-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-58-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-136-0x0000027162456000-0x0000027162457000-memory.dmp
memory/3268-65-0x00000271A2409000-0x00000271A240B000-memory.dmp
memory/3268-64-0x00000271A240B000-0x00000271A240D000-memory.dmp
memory/3268-63-0x0000027162418000-0x000002716241C000-memory.dmp
memory/3268-62-0x00000271A240E000-0x00000271A240F000-memory.dmp
memory/3268-61-0x000002716241C000-0x000002716241D000-memory.dmp
memory/3268-68-0x0000027162412000-0x0000027162413000-memory.dmp
memory/3268-67-0x000002716241D000-0x000002716241E000-memory.dmp
memory/3268-66-0x000002716241E000-0x000002716241F000-memory.dmp
memory/3268-71-0x0000027162414000-0x0000027162415000-memory.dmp
memory/3268-70-0x0000027162420000-0x0000027162421000-memory.dmp
memory/3268-69-0x000002716241F000-0x0000027162420000-memory.dmp
memory/3268-73-0x0000027162421000-0x0000027162425000-memory.dmp
memory/3268-72-0x0000027162415000-0x0000027162417000-memory.dmp
memory/3268-74-0x0000027162425000-0x0000027162426000-memory.dmp
memory/3268-75-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-76-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-77-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-78-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-79-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-80-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-81-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-83-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-84-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-148-0x00000271A240D000-0x00000271A240E000-memory.dmp
memory/3268-86-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-87-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-88-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-89-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-142-0x000002716245E000-0x000002716245F000-memory.dmp
memory/3268-141-0x000002716245D000-0x000002716245E000-memory.dmp
memory/3268-140-0x000002716245A000-0x000002716245B000-memory.dmp
memory/3268-143-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-145-0x0000027162429000-0x000002716242A000-memory.dmp
memory/3268-146-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-144-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-139-0x0000027162459000-0x000002716245A000-memory.dmp
memory/3268-1-0x0000027162410000-0x0000027162411000-memory.dmp
memory/3268-85-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-0-0x0000027162412000-0x0000027162413000-memory.dmp
memory/3268-60-0x00000271A240D000-0x00000271A240E000-memory.dmp
memory/3268-137-0x0000027162457000-0x0000027162458000-memory.dmp
memory/3268-134-0x000002716245C000-0x000002716245D000-memory.dmp
memory/3268-133-0x0000027162455000-0x0000027162456000-memory.dmp
memory/3268-132-0x0000027162454000-0x0000027162455000-memory.dmp
memory/3268-131-0x0000027162453000-0x0000027162454000-memory.dmp
memory/3268-130-0x000002716244E000-0x000002716244F000-memory.dmp
memory/3268-129-0x000002716244A000-0x000002716244E000-memory.dmp
memory/3268-128-0x000002716244F000-0x0000027162450000-memory.dmp
memory/3268-127-0x0000027162452000-0x0000027162453000-memory.dmp
memory/3268-126-0x0000027162450000-0x0000027162451000-memory.dmp
memory/3268-125-0x0000027162451000-0x0000027162452000-memory.dmp
memory/3268-124-0x0000027162449000-0x000002716244A000-memory.dmp
memory/3268-123-0x0000027162448000-0x0000027162449000-memory.dmp
memory/3268-122-0x0000027162447000-0x0000027162448000-memory.dmp
memory/3268-121-0x0000027162446000-0x0000027162447000-memory.dmp
memory/3268-120-0x0000027162444000-0x0000027162446000-memory.dmp
memory/3268-119-0x0000027162443000-0x0000027162444000-memory.dmp
memory/3268-118-0x0000027162442000-0x0000027162443000-memory.dmp
memory/3268-117-0x0000027162441000-0x0000027162442000-memory.dmp
memory/3268-116-0x0000027162440000-0x0000027162441000-memory.dmp
memory/3268-115-0x000002716243F000-0x0000027162440000-memory.dmp
memory/3268-114-0x000002716243E000-0x000002716243F000-memory.dmp
memory/3268-113-0x000002716243D000-0x000002716243E000-memory.dmp
memory/3268-112-0x000002716243C000-0x000002716243D000-memory.dmp
memory/3268-111-0x000002716243B000-0x000002716243C000-memory.dmp
memory/3268-110-0x000002716243A000-0x000002716243B000-memory.dmp
memory/3268-109-0x0000027162439000-0x000002716243A000-memory.dmp
memory/3268-108-0x0000027162438000-0x0000027162439000-memory.dmp
memory/3268-107-0x0000027162435000-0x0000027162436000-memory.dmp
memory/3268-106-0x0000027162434000-0x0000027162435000-memory.dmp
memory/3268-105-0x0000027162437000-0x0000027162438000-memory.dmp
memory/3268-104-0x00000271A240F000-0x00000271A2410000-memory.dmp
memory/3268-103-0x0000027162436000-0x0000027162437000-memory.dmp
memory/3268-102-0x0000027162433000-0x0000027162434000-memory.dmp
memory/3268-101-0x0000027162432000-0x0000027162433000-memory.dmp
memory/3268-100-0x000002716242F000-0x0000027162432000-memory.dmp
memory/3268-99-0x000002716242E000-0x000002716242F000-memory.dmp
memory/3268-98-0x000002716242D000-0x000002716242E000-memory.dmp
memory/3268-97-0x000002716242C000-0x000002716242D000-memory.dmp
memory/3268-96-0x000002716242B000-0x000002716242C000-memory.dmp
memory/3268-95-0x00000271A240C000-0x00000271A240D000-memory.dmp
memory/3268-94-0x000002716242A000-0x000002716242B000-memory.dmp
memory/3268-93-0x0000027162427000-0x0000027162429000-memory.dmp
memory/3268-92-0x0000027162426000-0x0000027162427000-memory.dmp
memory/3268-91-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-90-0x0000027114000000-0x0000027115000000-memory.dmp
memory/3268-82-0x0000027114000000-0x0000027115000000-memory.dmp