Analysis
- max time kernel
150s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system - submitted
06/01/2026, 07:33
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target file.exe
- Size 1.6MB
- Sample260106-jdy79adr41
- SHA256 7b2620cf008268fa8eff18c136ca020fa948634e646f7301ab48a5dd936033fd
- MD5 2df6951b9ef238bfb1c879e18221db30
- SHA1 c019d8c7cb1760958f44c7e3dcdd5b040ddf517e
- SHA512 5399577cd5a9d704a0c3328cdb9fbc3bf0b5095ce7d9db8d3c52c1e0e920bf06536467e95b333a24252adb779bac102e5a61cf57827341d437c8dadd7c33c0fa
- SSDEEP 24576:402+h4Q8qAjv6qfjq1nJAfPVHDClF7rDheENnlBtSqlOqrXtd0RlgbCpS:+Q8FDjWJAfPVHCpheENnd75r03gb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe 1944 file.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3076 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1944 wrote to memory of 3076 1944 file.exe 51 PID 1944 wrote to memory of 3076 1944 file.exe 51
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\{1ae4576c-e6ee-11f0-9951-806e6f6e6963}\Browsers\Chrome_History
- Size 160KB
- SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
- MD5 ea2f1147ca310fa5d8e3dc3cca218f60
- SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
- SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
- SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1ae4576c-e6ee-11f0-9951-806e6f6e6963}\Browsers\Edge_History
- Size 204KB
- SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
- MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
- SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
- SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
- SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
- MD5 SHA1 SHA512 SSDEEP