Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
06/01/2026, 11:56
General
- Target 196.251.107_1.23.exe
- Size 743KB
- Sample260106-n4faaa1pew
- SHA256 465da9a3f2f36ba40fdf1d7bc998171f470c43bfccb51aab6425dae0ae5c443e
Malware Config
Signatures
- Detects SvcStealer Payload 1 IoCs
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Svcstealer family
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 21 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 64 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\196.251.107_1.23.exe"C:\Users\Admin\AppData\Local\Temp\196.251.107_1.23.exe"2⤵
- Downloads MZ/PE file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\wiqJeuzaWFO5.exe"C:\Users\Admin\AppData\Local\wiqJeuzaWFO5.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QBPYA9OKZA.tmp\wiqJeuzaWFO5.tmp"C:\Users\Admin\AppData\Local\Temp\is-QBPYA9OKZA.tmp\wiqJeuzaWFO5.tmp" /SL5="$D022E,3851360,893440,C:\Users\Admin\AppData\Local\wiqJeuzaWFO5.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\wiqJeuzaWFO5.exe"C:\Users\Admin\AppData\Local\wiqJeuzaWFO5.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80985⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NGLWUJXRJ7.tmp\wiqJeuzaWFO5.tmp"C:\Users\Admin\AppData\Local\Temp\is-NGLWUJXRJ7.tmp\wiqJeuzaWFO5.tmp" /SL5="$E022E,3851360,893440,C:\Users\Admin\AppData\Local\wiqJeuzaWFO5.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80986⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe"C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe" -Embedding7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\GpwKn8l6Upp1.exe"C:\Users\Admin\AppData\Local\GpwKn8l6Upp1.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\tW7OX1QlC207.exe"C:\Users\Admin\AppData\Local\tW7OX1QlC207.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\Pictures\svchost.exeC:\Users\Admin\Pictures\svchost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exeC:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exeC:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
FnHotkeyUtility.exe
VCRUNTIME140.dll
ludp.dll
msvcp140.dll
spkvol.dll
vcruntime140_1.dll
C49E25D0-9A9F-6C84-5B98-370C33E04F14.txt
C49E25D0-9A9F-6C84-5B98-370C33E04F14.txt
GpwKn8l6Upp1.exe
History
_isdecmp.dll
wiqJeuzaWFO5.tmp
tW7OX1QlC207.exe
wiqJeuzaWFO5.exe
memory/2172-73-0x0000000000850000-0x0000000000939000-memory.dmp
memory/2172-33-0x0000000000850000-0x0000000000939000-memory.dmp
memory/2424-192-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-194-0x00007FFDC64A0000-0x00007FFDC6706000-memory.dmp
memory/2424-186-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-181-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-187-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-188-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-189-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-190-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-191-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-182-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-185-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-195-0x0000025D440E0000-0x0000025D4421B000-memory.dmp
memory/2424-193-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-196-0x00007FFDC64A0000-0x00007FFDC6706000-memory.dmp
memory/2424-173-0x00007FFDC64A0000-0x00007FFDC6706000-memory.dmp
memory/2424-169-0x00007FFDC64A0000-0x00007FFDC6706000-memory.dmp
memory/2424-184-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-174-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-197-0x00007FFDC64A0000-0x00007FFDC6706000-memory.dmp
memory/2424-183-0x0000000140000000-0x0000000140045000-memory.dmp
memory/2424-172-0x00007FF665890000-0x00007FF6659E4000-memory.dmp
memory/3084-132-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-131-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-127-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-129-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-136-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-126-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-128-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-125-0x0000000003490000-0x00000000034D1000-memory.dmp
memory/3084-130-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-139-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-133-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-134-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-135-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-137-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3084-138-0x0000000004F00000-0x0000000004F46000-memory.dmp
memory/3340-170-0x0000000000280000-0x0000000000625000-memory.dmp
memory/4736-72-0x00000000000D0000-0x0000000000475000-memory.dmp
memory/5648-237-0x00007FF665890000-0x00007FF6659E4000-memory.dmp
memory/5752-200-0x00007FFDD76A0000-0x00007FFDD7906000-memory.dmp
memory/5752-226-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-205-0x00007FF665890000-0x00007FF6659E4000-memory.dmp
memory/5752-206-0x00007FFDD76A0000-0x00007FFDD7906000-memory.dmp
memory/5752-207-0x00007FFDD76A0000-0x00007FFDD7906000-memory.dmp
memory/5752-216-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-217-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-218-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-220-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-222-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-227-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-230-0x00007FFDD76A0000-0x00007FFDD7906000-memory.dmp
memory/5752-225-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-224-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-223-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-221-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-219-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-215-0x0000000140000000-0x0000000140045000-memory.dmp
memory/5752-229-0x0000023AB0210000-0x0000023AB034B000-memory.dmp
memory/5788-171-0x0000000000850000-0x0000000000939000-memory.dmp
memory/5788-70-0x0000000000850000-0x0000000000939000-memory.dmp