Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/02/2026, 16:13
General
- Target NullXFIVEM.exe
- Size 11.4MB
- Sample260204-tpkjcaew2e
- SHA256 68d99f454aa359732aeab903997391820fc0245c126d86ec6117c7d444e2ae16
Malware Config
Signatures
- An open source browser data exporter written in golang. 1 IoCs
- HackBrowserData
An open source golang web browser extractor.
- Hackbrowserdata family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NullXFIVEM.exe"C:\Users\Admin\AppData\Local\Temp\NullXFIVEM.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\adafsf.exe"C:\Users\Admin\AppData\Local\Temp\adafsf.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winccaee.exe"C:\Users\Admin\AppData\Local\Temp\winccaee.exe" --cfg 4f9XlsDR9xq2ztF83MoXtrKSgY5coUxOe/qYHEGLyL5owf0DBrAz3qzAeOWZNJPPszx11nZiXwHq14/OiDT/KYXnVNrGQTkY6MwiZAjr17+jzLdsOmoWURxv+g25Pg4TgeiOtFsngFosT1Q2ywJDuGvOMUZadGVGtXGoYN0oaeIl8URq2y8TUd5qLKVNXMB0YYV6m0wjtlHKjp54TfEOWnAGti4sfjBHOnCLAh38Hf9qzn0hwLULBUdR0m1Dby4Om+OjpxfndEgUJDX/eY9YGAA4ZXwHyw3rLWAXl3swBD+zryc7Uc8JbESxiTTpQjMWEwIDu1CbzoJS8JLThRaWpoGGPvcSD4qhsTBEFH/XUSHQ/7iaIRRNJdPySJ1HXrSZ8S+EF69txq9I9RZ95Q64kMFoAhuFeUTu1rDaodgVgz8rNv4DIFpR1hMWdX9Y2FhJygyNOd1ZdQE6fUcHALDwmRrjOfD1ww2eTPaMYOKxI/w85FxHeZEyLXpHRmVqHucXndSqS7TEzP/hga5G32fZJbDTi/Dpz+k6c9WnuejF32KnYdJRyiDrqQFHIenP3BWA2Hpabc5eu7QZoStNxFeCdQzfweoh60aFslG7sMg93ul/hoaiyUoetjP3xSQAiUzBKzs7mCJSfhKohJ+EO2N341mY8XxpK6FXvgG3vzsulvOROe7JPMeMDI1oLCVExRiv5oaMA4KMbHgYCTqc8//cT3cIMOziA+cnSidyCysche6fFoi1N0DHGOZcYbdjEfe53unKkBt8mPavnndOEztoI8nza5NE+C7rYCodjthGtjN9eZYFL76yuFfwxPt56vXwwrPc61Fzp/mvNKaPQeY5ltnHuITLrXcqZlZzqoVQ8DeQkf9aSO93kQSO9So2m8akNmb37OD1LxgFQIJkojRwONcHytCI1zc1N2TV9s9eZN/WMCk+NKrPjw8GXvQa/BRbo0ROKH6EkUht8jBAaEuLmWVZpSyirocIvY/bh+Z4aQ4VJ0oaq7lnbVuJ5PwKbF3UCtIbEEpbFUzCPuoGj4KqMXJ/bPI1nc2VFz/ZBSA9BMbtsuBJ3mj83RhQ2PrfvgvwVebLkyy+ZReBUgqRnOuUWElVB/eiLzJieG9u4qKiGWIJ2Br8RHh01lv2x5fNkOGkYR+zD6GDcZ2QcTR43Tz+IyJEV/TuC0hkwWyZkuvAa1MObJv4kSn+cFEorV15GFtiWcI5j5m19TwiCkqfgD1j5pYHV55wIIiRiRvLpcFMAknnW4ltxP9F9hcIbKOyglAoWbQFI5GIIPSpt0wdWf9NfgGn4ZJivgcb6FQILGo4RztB1wmnhzYG/Vtruy7ZOBb+1iQx8wsXi2iOXTz7OcVLOOWhZBt3GLDGSncU4lpWmB5+cakQbwXqlslp5AzPZexeH8DaJ1/jY2BZgiw1HhrDYE0e0qWuoqoQ4sZy4rHP60ORZJtIHsnFMpMuXRmAcD9wNwOgLuwXEu7hTU0gVkZe59BW7QGHb08KUd7g8x5Vso4WDWlh7GErJPTDZnzVlvEKZUJ2hsAiz6+GkSGHb7DagIlppK6/lfNFbMyuCO+MPJvqNcrG9OrDdeY5CflHn3SVWxp5xTo2BFkSRA/9VtxxeACLhPqN2r1AfMonr0wr6vi4aJvnwW8T5XP/6s6aUTIOZZu8GNaGH42rPbGsjKTumjQqydDiBGKhkGuolu23QAJbI9k3Q01gKw28nqYAlHVEzIl1WFW9jX74v5d+ARnxzW9HBMWkHarRbicucf5jgNIfnmpE7VRGbULnYReq5ZmmGR8BgKKF+B/CucNWlBAEj75A0UoTeZAdJ2HsvwMMmC+ZrevvbhRZhEjcRTwxULkYoNVy7/YCRV4U2wPjxfifCOtH74uGtPzT3mWZHjLDy7KUadd26LK4waiGpVXFVs5R6+Nn1CdDTzq/DZwW/xC03Z4z/jbbktIzEg7cGOvhP2ptH6DGRvyBNAbhwpi5w3NhLyUjGX4HcO0uz+1bLBPxLiBdJA9+iEbIhk77RF7clVWiiKyiEBNDZxAl5PNPepO3rxSMDIGZaS0VPDk0VKmtbiBMe7p12y+9OSfUMFzh3h3QXIo4hBy75IzgByoqqOye0ZzaAyT92vyLcv+DqYWb3GworVYUWzvXnLkH0Fch6gm1NoB8rJ5xM8Z1ZOnnpQtdjIHEK1bQpGV3lQROvsW6P89nOx66f95SssNXjyOAGbyViPHQq4qQQMyUlU9xePMmxT7X7scGUok7/mt6+MuACEnX0bKeZAHJw92lmsDD6ZyEWnk+Z+qXEjoJHBG8Wdp/JtmjhEPbxdhRfIFWlANuGUY9dlLY6pYoh27tf0AXgAs1xIBBOUtRZKMSQns663dCrjpVVFIR4ivpjQgPggCPSnzGb6A4A52VzF1icWFRR2wz87CtjxlA8jzE3GcRo4jUO7/X5ve7a4hA0xV4tu/MuNl2TtPNvnwbTYHeOjocNxMmGNpS/0yqwNm/ME9Xh6amdqTEfGX3j0bpsWg7gNT5F9bPg5XadfzYMgi3uAjYeM9B3CGfzl1hW6q9wpD13pUhy6f0I6cxS7MGOSm+hSacWrm3zEWSV6KwSJG095vxXfw2TbjMcYNdv7x/wbIkdx1RjnViYHq0mqsP/OTNWBrwklYZ9oBQdFvNPDqtdWCds/vEuXeC2muQTF4cJzRxpgbXS5BACzoParFTrO7Qr+1qqhGhRpYJvFMUedhKADTJRovM1LXnzTvpx6ur80SoKU28XdqLO+oj6tIyLcyTEHhT4jl/40rqfs5ot8Nx6e2wAeEgnHIdTzZIvhQpbhNm+oBldmtwiwdxqWiG/i/jaNsNrSs2FHfydv9mqLsFJY/x0SxWmWNgYjh9zrz9OQOHo5pca+tLg8JzjI6ghBRpy6SWVjQp0XzerCVp0jnjbZGXrcYBbdRCHO9K+Dx1e0ze+8v/jblQaW5qL9ejDXVG5LhSW8j79HPzYw4B0v6tWOB4keiQYaLzYtRPflReEz0rboq4+AnLeUbuV99vTVrfYuKYsllPmuTIKI3AD/G5l8KlFApI7F4K9SWO2nBpThcD4RZSzeogmrOef736DnObLsJQgztzzdrVJX8F5ttpPzBvrJ2Q/cE/XG3690VVrGox7FjtDYQXUHqPm/dR7CGgROSoGazT+KufXWFq2/O4wyB5Kvut6q0IxnICTpz/0hxxfRdx12XoCsxQILJrd3fPqf5qGI3d55rzksFQHcpKG5+x4NmyGLpz5uEnAJuiQlHLaOMa43kUe9HjUrPNBLFrUHIRkAroaAUfKL0YBFbIHzzDUOUVtU3Juzt5LncxTlnBg+gJW1s2kSzOs8RHN0OZeGT7Fxu0tuXBGWEwlqaH7/j54EX+gUP9LuGAEnzC80MA9zmhpcSTN2o33+ISeA1fOqEfFHyH+NKatEj4Np3cUTUQN/OCC9kZoHAsfGVQuwa8CSnsPyoZmOZq9Ik1C6NTztzA0i30osdvZZ55/M/m20V0tmaTlYQ+TRo00Fls8ABIO5Ek3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a5biwwnt.ilm.exe"C:\Users\Admin\AppData\Local\Temp\a5biwwnt.ilm.exe"4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 >nul && netsh wlan show profile | findstr All4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\findstr.exefindstr All5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ko pvp.exe"C:\Users\Admin\AppData\Local\Temp\ko pvp.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
CURRENT.bak
MANIFEST-000001
a5biwwnt.ilm.exe
adafsf.exe
hist_44530e0e-12f9-483e-b38f-f6ae454c52c0.db
hist_d57bfc1c-f8a4-4610-80e7-2f5540ce5fcb.db
ko pvp.exe
SQLite.Interop.dll
chrome_default_cookie.csv
chrome_default_extension.csv
chrome_default_sessionstorage.csv
firefox_semwmfoz_default_release_bookmark.csv
firefox_semwmfoz_default_release_history.csv
microsoft_edge_default_sessionstorage.csv
winccaee.exe
memory/1716-65-0x000001F522920000-0x000001F522932000-memory.dmp
memory/1716-75-0x000001F5229E0000-0x000001F5229F8000-memory.dmp
memory/1716-39-0x000001F522720000-0x000001F52272A000-memory.dmp
memory/1716-36-0x000001F5226E0000-0x000001F5226EA000-memory.dmp
memory/1716-35-0x000001F5226B0000-0x000001F5226D6000-memory.dmp
memory/1716-40-0x000001F522730000-0x000001F52274E000-memory.dmp
memory/1716-41-0x000001F522780000-0x000001F5227A2000-memory.dmp
memory/1716-37-0x000001F5226F0000-0x000001F5226F8000-memory.dmp
memory/1716-49-0x000001F522760000-0x000001F522776000-memory.dmp
memory/1716-51-0x000001F522800000-0x000001F52280C000-memory.dmp
memory/1716-50-0x000001F5227E0000-0x000001F5227FC000-memory.dmp
memory/1716-48-0x000001F5227B0000-0x000001F5227DE000-memory.dmp
memory/1716-54-0x000001F522830000-0x000001F522864000-memory.dmp
memory/1716-53-0x000001F522820000-0x000001F522832000-memory.dmp
memory/1716-52-0x000001F522810000-0x000001F52281E000-memory.dmp
memory/1716-57-0x000001F522890000-0x000001F5228A0000-memory.dmp
memory/1716-56-0x000001F522870000-0x000001F52287A000-memory.dmp
memory/1716-55-0x000001F522880000-0x000001F522888000-memory.dmp
memory/1716-58-0x000001F5228A0000-0x000001F5228AA000-memory.dmp
memory/1716-59-0x000001F5228B0000-0x000001F5228BA000-memory.dmp
memory/1716-60-0x000001F5228C0000-0x000001F5228CC000-memory.dmp
memory/1716-61-0x000001F5228D0000-0x000001F5228DA000-memory.dmp
memory/1716-62-0x000001F5228E0000-0x000001F5228F0000-memory.dmp
memory/1716-63-0x000001F5228F0000-0x000001F522900000-memory.dmp
memory/1716-64-0x000001F522900000-0x000001F522914000-memory.dmp
memory/1716-30-0x000001F508630000-0x000001F508640000-memory.dmp
memory/1716-66-0x000001F522930000-0x000001F52293E000-memory.dmp
memory/1716-67-0x000001F522940000-0x000001F522954000-memory.dmp
memory/1716-68-0x000001F522960000-0x000001F52296C000-memory.dmp
memory/1716-69-0x000001F522970000-0x000001F52297C000-memory.dmp
memory/1716-70-0x000001F522980000-0x000001F522998000-memory.dmp
memory/1716-72-0x000001F5229B0000-0x000001F5229BE000-memory.dmp
memory/1716-71-0x000001F5229A0000-0x000001F5229AA000-memory.dmp
memory/1716-38-0x000001F522700000-0x000001F522718000-memory.dmp
memory/1716-74-0x000001F5229D0000-0x000001F5229DA000-memory.dmp
memory/1716-73-0x000001F5229C0000-0x000001F5229CC000-memory.dmp
memory/1716-76-0x000001F522A00000-0x000001F522A0A000-memory.dmp
memory/1716-77-0x000001F522A30000-0x000001F522A48000-memory.dmp
memory/1716-78-0x000001F522A60000-0x000001F522A72000-memory.dmp
memory/1716-79-0x000001F522A10000-0x000001F522A20000-memory.dmp
memory/1716-80-0x000001F522A20000-0x000001F522A2E000-memory.dmp
memory/1716-81-0x000001F522A50000-0x000001F522A5A000-memory.dmp
memory/1716-82-0x000001F522B90000-0x000001F522C06000-memory.dmp
memory/1716-31-0x000001F508780000-0x000001F50878C000-memory.dmp
memory/1716-218-0x000001F523E80000-0x000001F523E92000-memory.dmp
memory/1716-88-0x000001F522B40000-0x000001F522B90000-memory.dmp
memory/1716-34-0x000001F5224F0000-0x000001F5225A4000-memory.dmp
memory/1716-32-0x000001F520FA0000-0x000001F520FAC000-memory.dmp
memory/1716-193-0x000001F522F50000-0x000001F522FBE000-memory.dmp
memory/1716-217-0x000001F523C70000-0x000001F523C7A000-memory.dmp
memory/1716-33-0x000001F5224E0000-0x000001F5224F0000-memory.dmp
memory/1716-198-0x000001F523BA0000-0x000001F523BC6000-memory.dmp
memory/1716-197-0x000001F523BE0000-0x000001F523C1A000-memory.dmp
memory/1716-28-0x000001F508640000-0x000001F508652000-memory.dmp
memory/1716-29-0x000001F508650000-0x000001F508664000-memory.dmp
memory/1716-27-0x000001F520ED0000-0x000001F520F82000-memory.dmp
memory/1716-26-0x000001F520FC0000-0x000001F521A5E000-memory.dmp
memory/1716-25-0x000001F506150000-0x000001F506AC6000-memory.dmp
memory/1716-208-0x000001F523C60000-0x000001F523C6A000-memory.dmp
memory/1716-209-0x000001F523CA0000-0x000001F523CBA000-memory.dmp
memory/1716-210-0x000001F523CC0000-0x000001F523CD2000-memory.dmp
memory/1716-211-0x000001F523D20000-0x000001F523D5C000-memory.dmp
memory/2584-196-0x0000000000340000-0x0000000000D35000-memory.dmp
memory/2584-87-0x0000000000340000-0x0000000000D35000-memory.dmp
memory/4832-212-0x000002C94E240000-0x000002C94E250000-memory.dmp
memory/4832-20-0x000002C94E240000-0x000002C94E250000-memory.dmp
memory/4832-19-0x000002C94BC20000-0x000002C94C5A8000-memory.dmp