Dropper
3048.ps1
- Author
- Moise Medici
- Updated
- 13 Sept 2026 · Completed
- Difficulty
- Easy
- Platform
- Languages
- MITRE
MITRE ATT&CK
Execution
Command and Scripting Interpreter: PowerShell
3048.ps1 starts a new powershell.exe (the 64-bit one through sysnative when run from 32-bit) with -nop -w hidden -c, which runs the decoded stage2.ps1 as a script block.Native API
stage2.ps1 calls VirtualAlloc, CreateThread and WaitForSingleObject to run the shellcode, and the shellcode calls the wininet functions directly to reach its server.Stealth
Obfuscated Files or Information: Dynamic API Resolution
stage2.ps1 declares no imports: hRl gets GetProcAddress by reflection on Microsoft.Win32.UnsafeNativeMethods, and iI builds delegate types at runtime to call the returned function pointers.Obfuscated Files or Information: Encrypted/Encoded File
Both payloads are stored base64-encoded:
stage2.ps1 inside the 3048.ps1 one-liner, and the stage3.bin shellcode inside stage2.ps1.Obfuscated Files or Information: Compression
stage2.ps1 is gzip-compressed before being base64-encoded, so the one-liner carries no readable script.Deobfuscate/Decode Files or Information
The one-liner rebuilds
stage2.ps1 at runtime with FromBase64String and GzipStream in Decompress mode, and stage2.ps1 decodes the shellcode with FromBase64String before copying it into memory.Hide Artifacts: Hidden Window
The child PowerShell is started with
-w hidden, WindowStyle='Hidden' and CreateNoWindow=$true, so no console window appears.Reflective Code Loading
The shellcode is copied into
PAGE_EXECUTE_READWRITE memory from VirtualAlloc and run on a new thread inside powershell.exe, then reads the next stage into another RWX buffer, with nothing written to disk.Command and Control
Application Layer Protocol: Web Protocols
The shellcode talks to
185.243.115.227 over HTTPS through wininet: InternetConnectA on port 443 and HttpOpenRequestA with INTERNET_FLAG_SECURE, ignoring invalid certificate names and dates.