Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 20:48
General
- Target CodexInitKit.exe
- Size 900KB
- Sample261102-zlrfdaft4k
- SHA256 82a955816f88ebf513791b62982e626e3044cdc206f12053d3705cda68e43986
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CodexInitKit.exe"C:\Users\Admin\AppData\Local\Temp\CodexInitKit.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CodexInitKit.exe"C:\Users\Admin\AppData\Local\Temp\CodexInitKit.exe" --worker status ac18b1c1bbed4dfaaf6ba21a6a742079 C 0 0 S-1-5-21-1704430598-3087477806-3297458608-1000 eyJmb2xkZXJNYW5hZ2VtZW50Ijp0cnVlLCJhbnRpT3ZlckRlZmVuc2UiOnRydWUsIm1lbW9yaWVzIjp0cnVlLCJnaXRodWJNaXJyb3JFbmFibGVkIjp0cnVlLCJjdXN0b21HaXRodWJNaXJyb3IiOiIiLCJzdWJhZ2VudHMiOmZhbHNlLCJjdWFSZXBhaXIiOnRydWUsImJyb3dzZXJSZXBhaXIiOnRydWUsIm9mZmljaWFsQ2xpVXBkYXRlIjp0cnVlLCJkZXNrdG9wVXBkYXRlIjp0cnVlLCJwYXJlbnRNb2RlbCI6ImdwdC02LjEtc29sIiwiY2hpbGRNb2RlbCI6ImdwdC02LjEtc29sIiwicGFyZW50RWZmb3J0IjoibWVkaXVtIiwiY2hpbGRFZmZvcnQiOiJtZWRpdW0iLCJwcm94eUhvc3QiOiIxMjcuMC4wLjEiLCJjbGlNb2RlIjoiZGVza3RvcC1uYXRpdmUifQ==2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\CodexInitKit\Desktop\Jobs\ac18b1c1bbed4dfaaf6ba21a6a742079\Backend.ps1" -Operation "status" -PayloadRoot "C:\Users\Admin\AppData\Local\CodexInitKit\Desktop\Jobs\ac18b1c1bbed4dfaaf6ba21a6a742079" -Drive "C" -ProxyPort 0 -OptionsBase64 "eyJmb2xkZXJNYW5hZ2VtZW50Ijp0cnVlLCJhbnRpT3ZlckRlZmVuc2UiOnRydWUsIm1lbW9yaWVzIjp0cnVlLCJnaXRodWJNaXJyb3JFbmFibGVkIjp0cnVlLCJjdXN0b21HaXRodWJNaXJyb3IiOiIiLCJzdWJhZ2VudHMiOmZhbHNlLCJjdWFSZXBhaXIiOnRydWUsImJyb3dzZXJSZXBhaXIiOnRydWUsIm9mZmljaWFsQ2xpVXBkYXRlIjp0cnVlLCJkZXNrdG9wVXBkYXRlIjp0cnVlLCJwYXJlbnRNb2RlbCI6ImdwdC02LjEtc29sIiwiY2hpbGRNb2RlbCI6ImdwdC02LjEtc29sIiwicGFyZW50RWZmb3J0IjoibWVkaXVtIiwiY2hpbGRFZmZvcnQiOiJtZWRpdW0iLCJwcm94eUhvc3QiOiIxMjcuMC4wLjEiLCJjbGlNb2RlIjoiZGVza3RvcC1uYXRpdmUifQ=="3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Backend.ps1
Backend220.ps1
DesktopCoreRecovery.ps1
ac18b1c1bbed4dfaaf6ba21a6a742079.log
__PSScriptPolicyTest_csas0kcs.1m5.psm1
memory/3396-57-0x000002682C830000-0x000002682C83A000-memory.dmp
memory/3396-56-0x000002682C820000-0x000002682C826000-memory.dmp
memory/3396-54-0x000002682CDF0000-0x000002682CE1A000-memory.dmp
memory/3396-52-0x000002682D600000-0x000002682D804000-memory.dmp
memory/3396-53-0x000002682C900000-0x000002682C91A000-memory.dmp
memory/3396-51-0x000002682C840000-0x000002682C8F2000-memory.dmp
memory/3396-50-0x000002682C820000-0x000002682C83E000-memory.dmp
memory/3396-55-0x000002682C810000-0x000002682C818000-memory.dmp
memory/3396-42-0x00000268143E0000-0x0000026814402000-memory.dmp
memory/3396-58-0x000002682C920000-0x000002682C928000-memory.dmp
memory/3396-59-0x000002682C960000-0x000002682C986000-memory.dmp
memory/3556-39-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3556-41-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3556-18-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3556-19-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3556-20-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3556-38-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3556-62-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3556-40-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-10-0x0000000002C00000-0x0000000002C3E000-memory.dmp
memory/3584-6-0x000000001D480000-0x000000001D9A8000-memory.dmp
memory/3584-15-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-14-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-13-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-12-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-9-0x00000000013D0000-0x00000000013D8000-memory.dmp
memory/3584-16-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-11-0x0000000002BC0000-0x0000000002BCE000-memory.dmp
memory/3584-8-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-7-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-17-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-5-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-4-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-3-0x000000001C380000-0x000000001C542000-memory.dmp
memory/3584-2-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-0-0x00007FFE609EF000-0x00007FFE609F0000-memory.dmp
memory/3584-1-0x00000000003F0000-0x00000000004D6000-memory.dmp
memory/3584-66-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-67-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-68-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/3584-69-0x00007FFE60860000-0x00007FFE61204000-memory.dmp