Analysis
- max time kernel
900s - max time network
904s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-fr - resource tags
- submitted
07/11/2026, 17:49
General
- Target Client.exe
- Size 9.0MB
- Sample261107-wd45qaex2r
- SHA256 6d7b6588e37c7a87bbddc2ab9d4997b13c71cadc5f6f39d3f8ec2aacbb086bff
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ipconfig /all2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4tumnm1h.31v.psm1
memory/5808-46-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-65-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-89-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-88-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-87-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-86-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-85-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-84-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-83-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-82-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-81-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-80-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-79-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-78-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-77-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-76-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-75-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-74-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-73-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-72-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-45-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-26-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-27-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-28-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-29-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-47-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-31-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-32-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-33-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-34-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-35-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-36-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-37-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-38-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-39-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-40-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-41-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-42-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-43-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-44-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-25-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-71-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-30-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-48-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-49-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-50-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-51-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-52-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-53-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-54-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-55-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-56-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-57-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-58-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-59-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-61-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-62-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-63-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-64-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-70-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-66-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-67-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-68-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5808-69-0x00007FF7EC650000-0x00007FF7ECF68000-memory.dmp
memory/5936-1-0x0000020DBF650000-0x0000020DBF6DA000-memory.dmp
memory/5936-2-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-24-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-23-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-21-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-20-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-19-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-18-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-0-0x00007FFAB733F000-0x00007FFAB7340000-memory.dmp
memory/5936-17-0x0000020DBF880000-0x0000020DBF8CC000-memory.dmp
memory/5936-14-0x0000020DBF720000-0x0000020DBF73E000-memory.dmp
memory/5936-16-0x0000020DBF740000-0x0000020DBF74A000-memory.dmp
memory/5936-15-0x0000020DBF7C0000-0x0000020DBF872000-memory.dmp
memory/5936-11-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-10-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-9-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-8-0x0000020DBF8D0000-0x0000020DBF9D2000-memory.dmp
memory/5936-7-0x00007FFAB71B0000-0x00007FFAB7B54000-memory.dmp
memory/5936-6-0x0000020DBF5F0000-0x0000020DBF600000-memory.dmp
memory/5936-5-0x0000020DBF5C0000-0x0000020DBF5E2000-memory.dmp