Analysis
- max time kernel
103s - max time network
105s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
05/09/2025, 12:19
General
- Target 9ecc8f27bafbc29819f09ba664ffbcfede6f25afb3449d53d41ce9ecfc29641a.exe
- Size 765KB
- Sample250905-phpghay1gv
- SHA256 9ecc8f27bafbc29819f09ba664ffbcfede6f25afb3449d53d41ce9ecfc29641a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ecc8f27bafbc29819f09ba664ffbcfede6f25afb3449d53d41ce9ecfc29641a.exe"C:\Users\Admin\AppData\Local\Temp\9ecc8f27bafbc29819f09ba664ffbcfede6f25afb3449d53d41ce9ecfc29641a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9ecc8f27bafbc29819f09ba664ffbcfede6f25afb3449d53d41ce9ecfc29641a.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XXpsDAOvoXjb.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XXpsDAOvoXjb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB258.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\9ecc8f27bafbc29819f09ba664ffbcfede6f25afb3449d53d41ce9ecfc29641a.exe"C:\Users\Admin\AppData\Local\Temp\9ecc8f27bafbc29819f09ba664ffbcfede6f25afb3449d53d41ce9ecfc29641a.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
9ecc8f27bafbc29819f09ba664ffbcfede6f25afb3449d53d41ce9ecfc29641a.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_kgsqm0re.1ce.ps1
tmpB258.tmp
memory/1080-18-0x0000000003030000-0x0000000003040000-memory.dmp
memory/1080-17-0x0000000003030000-0x0000000003040000-memory.dmp
memory/1080-854-0x0000000070D90000-0x0000000070DDC000-memory.dmp
memory/1080-865-0x0000000007F00000-0x000000000857A000-memory.dmp
memory/1080-866-0x00000000078C0000-0x00000000078DA000-memory.dmp
memory/1080-870-0x0000000007B00000-0x0000000007B0E000-memory.dmp
memory/2388-2-0x0000000005A40000-0x0000000005AD2000-memory.dmp
memory/2388-8-0x0000000009770000-0x000000000980C000-memory.dmp
memory/2388-7-0x0000000007110000-0x00000000071B6000-memory.dmp
memory/2388-6-0x0000000005C00000-0x0000000005C10000-memory.dmp
memory/2388-5-0x0000000005E00000-0x0000000005E0E000-memory.dmp
memory/2388-4-0x0000000005A10000-0x0000000005A1A000-memory.dmp
memory/2388-3-0x0000000005C00000-0x0000000005C10000-memory.dmp
memory/2388-1-0x00000000060F0000-0x0000000006696000-memory.dmp
memory/2388-0-0x0000000000E90000-0x0000000000F56000-memory.dmp
memory/2396-125-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-101-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-40-0x0000000005130000-0x0000000005186000-memory.dmp
memory/2396-23-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2396-45-0x00000000051E0000-0x0000000005236000-memory.dmp
memory/2396-24-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2396-149-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-133-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-107-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-91-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-67-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-57-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-53-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-167-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-165-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-163-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-161-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-159-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-157-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-155-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-153-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-151-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-147-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-145-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-143-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-141-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-139-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-137-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-135-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-131-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-129-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-127-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-876-0x0000000006920000-0x0000000006970000-memory.dmp
memory/2396-124-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-121-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-119-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-117-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-115-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-113-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-111-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-109-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-105-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-103-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-46-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-99-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-97-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-95-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-93-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-89-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-87-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-85-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-83-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-82-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-79-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-77-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-75-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-73-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-71-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-69-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-65-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-63-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-61-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-59-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-55-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-51-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-49-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2396-47-0x00000000051E0000-0x000000000522F000-memory.dmp
memory/2884-867-0x0000000007630000-0x000000000763A000-memory.dmp
memory/2884-842-0x0000000006260000-0x000000000627E000-memory.dmp
memory/2884-843-0x0000000006290000-0x00000000062DC000-memory.dmp
memory/2884-845-0x0000000070D90000-0x0000000070DDC000-memory.dmp
memory/2884-844-0x0000000007200000-0x0000000007234000-memory.dmp
memory/2884-16-0x00000000054C0000-0x0000000005AEA000-memory.dmp
memory/2884-863-0x0000000006810000-0x000000000682E000-memory.dmp
memory/2884-864-0x0000000007450000-0x00000000074F4000-memory.dmp
memory/2884-14-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/2884-15-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/2884-869-0x00000000077C0000-0x00000000077D1000-memory.dmp
memory/2884-868-0x0000000007840000-0x00000000078D6000-memory.dmp
memory/2884-31-0x0000000005DA0000-0x00000000060F7000-memory.dmp
memory/2884-13-0x0000000004DC0000-0x0000000004DF6000-memory.dmp
memory/2884-871-0x0000000007800000-0x0000000007815000-memory.dmp
memory/2884-872-0x0000000007900000-0x000000000791A000-memory.dmp
memory/2884-873-0x00000000078F0000-0x00000000078F8000-memory.dmp
memory/2884-22-0x0000000005D30000-0x0000000005D96000-memory.dmp
memory/2884-20-0x0000000005AF0000-0x0000000005B12000-memory.dmp
memory/2884-21-0x0000000005C10000-0x0000000005C76000-memory.dmp