Analysis
- max time kernel
37s - max time network
37s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 23:52
General
- Target 96f7d97b54a2831d82bf6d0bed7bf8085dcfd22de94dc45a60a1a4dd52826b1e.ps1
- Size 2KB
- Sample261026-3ww1dscc47
- SHA256 96f7d97b54a2831d82bf6d0bed7bf8085dcfd22de94dc45a60a1a4dd52826b1e
Malware Config
Extracted
-
ps1
-
exe.dropper
https://estyportl.com/g.php
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\96f7d97b54a2831d82bf6d0bed7bf8085dcfd22de94dc45a60a1a4dd52826b1e.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn OneShotwiv6pw /tr "powershell -nop -w hidden -ep bypass -f C:\Users\Admin\AppData\Local\Temp\NetOpt_ug3tue.ps1" /sc once /st 23:59 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn OneShotwiv6pw2⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /delete /tn OneShotwiv6pw /f2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -nop -w hidden -ep bypass -f C:\Users\Admin\AppData\Local\Temp\NetOpt_ug3tue.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\dycwb2hoignv\Outline.exe"C:\Users\Admin\dycwb2hoignv\Outline.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
NetOpt_ug3tue.ps1
__PSScriptPolicyTest_gznlemo0.3td.psm1
ffmpeg.dll
icudtl.dat
v8_context_snapshot.bin
memory/1748-17-0x0000017FE12F0000-0x0000017FE1338000-memory.dmp
memory/3668-30-0x000001F57D290000-0x000001F57D29A000-memory.dmp
memory/3668-177-0x000001F57D7C0000-0x000001F57D872000-memory.dmp
memory/3668-179-0x000001F57D330000-0x000001F57D34E000-memory.dmp
memory/3668-178-0x000001F57D300000-0x000001F57D30A000-memory.dmp
memory/3668-176-0x000001F57D2E0000-0x000001F57D2FE000-memory.dmp
memory/3668-18-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/3668-31-0x000001F57D2C0000-0x000001F57D2D2000-memory.dmp
memory/3668-20-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/3668-28-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/3668-22-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/3668-27-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/5288-6-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/5288-23-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/5288-7-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/5288-0-0x00007FFD43F9F000-0x00007FFD43FA0000-memory.dmp
memory/5288-9-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/5288-11-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/5288-14-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/5288-10-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/5288-5-0x000001BE2A5D0000-0x000001BE2A5F2000-memory.dmp
memory/5288-4-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp
memory/5288-1-0x00007FFD43E10000-0x00007FFD447B4000-memory.dmp