Analysis
- max time kernel
149s - max time network
118s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/02/2026, 16:13
General
- Target NullXFIVEM.exe
- Size 11.4MB
- Sample260204-tpkjcaew2e
- SHA256 68d99f454aa359732aeab903997391820fc0245c126d86ec6117c7d444e2ae16
Malware Config
Signatures
- An open source browser data exporter written in golang. 1 IoCs
- HackBrowserData
An open source golang web browser extractor.
- Hackbrowserdata family
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NullXFIVEM.exe"C:\Users\Admin\AppData\Local\Temp\NullXFIVEM.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\adafsf.exe"C:\Users\Admin\AppData\Local\Temp\adafsf.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winccaee.exe"C:\Users\Admin\AppData\Local\Temp\winccaee.exe" --cfg 4f9XlsDR9xq2ztF83MoXtrKSgY5coUxOe/qYHEGLyL5owf0DBrAz3qzAeOWZNJPPszx11nZiXwHq14/OiDT/KYXnVNrGQTkY6MwiZAjr17+jzLdsOmoWURxv+g25Pg4TgeiOtFsngFosT1Q2ywJDuGvOMUZadGVGtXGoYN0oaeIl8URq2y8TUd5qLKVNXMB0YYV6m0wjtlHKjp54TfEOWnAGti4sfjBHOnCLAh38Hf9qzn0hwLULBUdR0m1Dby4Om+OjpxfndEgUJDX/eY9YGAA4ZXwHyw3rLWAXl3swBD+zryc7Uc8JbESxiTTpQjMWEwIDu1CbzoJS8JLThRaWpoGGPvcSD4qhsTBEFH/XUSHQ/7iaIRRNJdPySJ1HXrSZ8S+EF69txq9I9RZ95Q64kMFoAhuFeUTu1rDaodgVgz8rNv4DIFpR1hMWdX9Y2FhJygyNOd1ZdQE6fUcHALDwmRrjOfD1ww2eTPaMYOKxI/w85FxHeZEyLXpHRmVqHucXndSqS7TEzP/hga5G32fZJbDTi/Dpz+k6c9WnuejF32KnYdJRyiDrqQFHIenP3BWA2Hpabc5eu7QZoStNxFeCdQzfweoh60aFslG7sMg93ul/hoaiyUoetjP3xSQAiUzBKzs7mCJSfhKohJ+EO2N341mY8XxpK6FXvgG3vzsulvOROe7JPMeMDI1oLCVExRiv5oaMA4KMbHgYCTqc8//cT3cIMOziA+cnSidyCysche6fFoi1N0DHGOZcYbdjEfe53unKkBt8mPavnndOEztoI8nza5NE+C7rYCodjthGtjN9eZYFL76yuFfwxPt56vXwwrPc61Fzp/mvNKaPQeY5ltnHuITLrXcqZlZzqoVQ8DeQkf9aSO93kQSO9So2m8akNmb37OD1LxgFQIJkojRwONcHytCI1zc1N2TV9s9eZN/WMCk+NKrPjw8GXvQa/BRbo0ROKH6EkUht8jBAaEuLmWVZpSyirocIvY/bh+Z4aQ4VJ0oaq7lnbVuJ5PwKbF3UCtIbEEpbFUzCPuoGj4KqMXJ/bPI1nc2VFz/ZBSA9BMbtsuBJ3mj83RhQ2PrfvgvwVebLkyy+ZReBUgqRnOuUWElVB/eiLzJieG9u4qKiGWIJ2Br8RHh01lv2x5fNkOGkYR+zD6GDcZ2QcTR43Tz+IyJEV/TuC0hkwWyZkuvAa1MObJv4kSn+cFEorV15GFtiWcI5j5m19TwiCkqfgD1j5pYHV55wIIiRiRvLpcFMAknnW4ltxP9F9hcIbKOyglAoWbQFI5GIIPSpt0wdWf9NfgGn4ZJivgcb6FQILGo4RztB1wmnhzYG/Vtruy7ZOBb+1iQx8wsXi2iOXTz7OcVLOOWhZBt3GLDGSncU4lpWmB5+cakQbwXqlslp5AzPZexeH8DaJ1/jY2BZgiw1HhrDYE0e0qWuoqoQ4sZy4rHP60ORZJtIHsnFMpMuXRmAcD9wNwOgLuwXEu7hTU0gVkZe59BW7QGHb08KUd7g8x5Vso4WDWlh7GErJPTDZnzVlvEKZUJ2hsAiz6+GkSGHb7DagIlppK6/lfNFbMyuCO+MPJvqNcrG9OrDdeY5CflHn3SVWxp5xTo2BFkSRA/9VtxxeACLhPqN2r1AfMonr0wr6vi4aJvnwW8T5XP/6s6aUTIOZZu8GNaGH42rPbGsjKTumjQqydDiBGKhkGuolu23QAJbI9k3Q01gKw28nqYAlHVEzIl1WFW9jX74v5d+ARnxzW9HBMWkHarRbicucf5jgNIfnmpE7VRGbULnYReq5ZmmGR8BgKKF+B/CucNWlBAEj75A0UoTeZAdJ2HsvwMMmC+ZrevvbhRZhEjcRTwxULkYoNVy7/YCRV4U2wPjxfifCOtH74uGtPzT3mWZHjLDy7KUadd26LK4waiGpVXFVs5R6+Nn1CdDTzq/DZwW/xC03Z4z/jbbktIzEg7cGOvhP2ptH6DGRvyBNAbhwpi5w3NhLyUjGX4HcO0uz+1bLBPxLiBdJA9+iEbIhk77RF7clVWiiKyiEBNDZxAl5PNPepO3rxSMDIGZaS0VPDk0VKmtbiBMe7p12y+9OSfUMFzh3h3QXIo4hBy75IzgByoqqOye0ZzaAyT92vyLcv+DqYWb3GworVYUWzvXnLkH0Fch6gm1NoB8rJ5xM8Z1ZOnnpQtdjIHEK1bQpGV3lQROvsW6P89nOx66f95SssNXjyOAGbyViPHQq4qQQMyUlU9xePMmxT7X7scGUok7/mt6+MuACEnX0bKeZAHJw92lmsDD6ZyEWnk+Z+qXEjoJHBG8Wdp/JtmjhEPbxdhRfIFWlANuGUY9dlLY6pYoh27tf0AXgAs1xIBBOUtRZKMSQns663dCrjpVVFIR4ivpjQgPggCPSnzGb6A4A52VzF1icWFRR2wz87CtjxlA8jzE3GcRo4jUO7/X5ve7a4hA0xV4tu/MuNl2TtPNvnwbTYHeOjocNxMmGNpS/0yqwNm/ME9Xh6amdqTEfGX3j0bpsWg7gNT5F9bPg5XadfzYMgi3uAjYeM9B3CGfzl1hW6q9wpD13pUhy6f0I6cxS7MGOSm+hSacWrm3zEWSV6KwSJG095vxXfw2TbjMcYNdv7x/wbIkdx1RjnViYHq0mqsP/OTNWBrwklYZ9oBQdFvNPDqtdWCds/vEuXeC2muQTF4cJzRxpgbXS5BACzoParFTrO7Qr+1qqhGhRpYJvFMUedhKADTJRovM1LXnzTvpx6ur80SoKU28XdqLO+oj6tIyLcyTEHhT4jl/40rqfs5ot8Nx6e2wAeEgnHIdTzZIvhQpbhNm+oBldmtwiwdxqWiG/i/jaNsNrSs2FHfydv9mqLsFJY/x0SxWmWNgYjh9zrz9OQOHo5pca+tLg8JzjI6ghBRpy6SWVjQp0XzerCVp0jnjbZGXrcYBbdRCHO9K+Dx1e0ze+8v/jblQaW5qL9ejDXVG5LhSW8j79HPzYw4B0v6tWOB4keiQYaLzYtRPflReEz0rboq4+AnLeUbuV99vTVrfYuKYsllPmuTIKI3AD/G5l8KlFApI7F4K9SWO2nBpThcD4RZSzeogmrOef736DnObLsJQgztzzdrVJX8F5ttpPzBvrJ2Q/cE/XG3690VVrGox7FjtDYQXUHqPm/dR7CGgROSoGazT+KufXWFq2/O4wyB5Kvut6q0IxnICTpz/0hxxfRdx12XoCsxQILJrd3fPqf5qGI3d55rzksFQHcpKG5+x4NmyGLpz5uEnAJuiQlHLaOMa43kUe9HjUrPNBLFrUHIRkAroaAUfKL0YBFbIHzzDUOUVtU3Juzt5LncxTlnBg+gJW1s2kSzOs8RHN0OZeGT7Fxu0tuXBGWEwlqaH7/j54EX+gUP9LuGAEnzC80MA9zmhpcSTN2o33+ISeA1fOqEfFHyH+NKatEj4Np3cUTUQN/OCC9kZoHAsfGVQuwa8CSnsPyoZmOZq9Ik1C6NTztzA0i30osdvZZ55/M/m20V0tmaTlYQ+TRo00Fls8ABIO5Ek3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5okodwxf.1nk.exe"C:\Users\Admin\AppData\Local\Temp\5okodwxf.1nk.exe"4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 >nul && netsh wlan show profile | findstr All4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\findstr.exefindstr All5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ko pvp.exe"C:\Users\Admin\AppData\Local\Temp\ko pvp.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
5okodwxf.1nk.exe
History_5.temp
CURRENT.bak
MANIFEST-000001
adafsf.exe
hist_9b66d63c-9ee3-4d76-9c7e-9f54f8e3e4af.db
ko pvp.exe
SQLite.Interop.dll
chrome_default_cookie.csv
chrome_default_extension.csv
chrome_default_sessionstorage.csv
firefox_769walom_default_release_bookmark.csv
firefox_769walom_default_release_history.csv
microsoft_edge_default_sessionstorage.csv
winccaee.exe
memory/1284-200-0x0000000000320000-0x0000000000D15000-memory.dmp
memory/1284-87-0x0000000000320000-0x0000000000D15000-memory.dmp
memory/2452-67-0x00000266F1080000-0x00000266F1094000-memory.dmp
memory/2452-75-0x00000266F1120000-0x00000266F1138000-memory.dmp
memory/2452-38-0x00000266D6DD0000-0x00000266D6DE8000-memory.dmp
memory/2452-39-0x00000266D6DF0000-0x00000266D6DFA000-memory.dmp
memory/2452-40-0x00000266EF650000-0x00000266EF66E000-memory.dmp
memory/2452-41-0x00000266F0EF0000-0x00000266F0F12000-memory.dmp
memory/2452-48-0x00000266EF670000-0x00000266EF69E000-memory.dmp
memory/2452-55-0x00000266F0FC0000-0x00000266F0FC8000-memory.dmp
memory/2452-57-0x00000266F0FD0000-0x00000266F0FE0000-memory.dmp
memory/2452-56-0x00000266F0FB0000-0x00000266F0FBA000-memory.dmp
memory/2452-58-0x00000266F0FE0000-0x00000266F0FEA000-memory.dmp
memory/2452-59-0x00000266F0FF0000-0x00000266F0FFA000-memory.dmp
memory/2452-54-0x00000266F0F70000-0x00000266F0FA4000-memory.dmp
memory/2452-62-0x00000266F1020000-0x00000266F1030000-memory.dmp
memory/2452-61-0x00000266F1010000-0x00000266F101A000-memory.dmp
memory/2452-60-0x00000266F1000000-0x00000266F100C000-memory.dmp
memory/2452-53-0x00000266F0F60000-0x00000266F0F72000-memory.dmp
memory/2452-52-0x00000266F0F50000-0x00000266F0F5E000-memory.dmp
memory/2452-63-0x00000266F1030000-0x00000266F1040000-memory.dmp
memory/2452-51-0x00000266F0F40000-0x00000266F0F4C000-memory.dmp
memory/2452-50-0x00000266F0F20000-0x00000266F0F3C000-memory.dmp
memory/2452-49-0x00000266EF6A0000-0x00000266EF6B6000-memory.dmp
memory/2452-66-0x00000266F1070000-0x00000266F107E000-memory.dmp
memory/2452-35-0x00000266D6D80000-0x00000266D6DA6000-memory.dmp
memory/2452-68-0x00000266F10A0000-0x00000266F10AC000-memory.dmp
memory/2452-69-0x00000266F10B0000-0x00000266F10BC000-memory.dmp
memory/2452-65-0x00000266F1060000-0x00000266F1072000-memory.dmp
memory/2452-64-0x00000266F1040000-0x00000266F1054000-memory.dmp
memory/2452-70-0x00000266F10C0000-0x00000266F10D8000-memory.dmp
memory/2452-71-0x00000266F10E0000-0x00000266F10EA000-memory.dmp
memory/2452-72-0x00000266F10F0000-0x00000266F10FE000-memory.dmp
memory/2452-73-0x00000266F1100000-0x00000266F110C000-memory.dmp
memory/2452-74-0x00000266F1110000-0x00000266F111A000-memory.dmp
memory/2452-34-0x00000266EF590000-0x00000266EF644000-memory.dmp
memory/2452-76-0x00000266F1140000-0x00000266F114A000-memory.dmp
memory/2452-77-0x00000266F1170000-0x00000266F1188000-memory.dmp
memory/2452-78-0x00000266F11A0000-0x00000266F11B2000-memory.dmp
memory/2452-79-0x00000266F1150000-0x00000266F1160000-memory.dmp
memory/2452-80-0x00000266F1160000-0x00000266F116E000-memory.dmp
memory/2452-81-0x00000266F1190000-0x00000266F119A000-memory.dmp
memory/2452-82-0x00000266F2370000-0x00000266F23E6000-memory.dmp
memory/2452-88-0x00000266F2540000-0x00000266F2590000-memory.dmp
memory/2452-103-0x00000266F2790000-0x00000266F27FE000-memory.dmp
memory/2452-37-0x00000266D6DC0000-0x00000266D6DC8000-memory.dmp
memory/2452-36-0x00000266D6DB0000-0x00000266D6DBA000-memory.dmp
memory/2452-31-0x00000266D5440000-0x00000266D544C000-memory.dmp
memory/2452-180-0x00000266F2800000-0x00000266F283A000-memory.dmp
memory/2452-181-0x00000266F2330000-0x00000266F2356000-memory.dmp
memory/2452-33-0x00000266D54B0000-0x00000266D54C0000-memory.dmp
memory/2452-32-0x00000266D54A0000-0x00000266D54AC000-memory.dmp
memory/2452-25-0x00000266D4620000-0x00000266D4F96000-memory.dmp
memory/2452-26-0x00000266EF6D0000-0x00000266F016E000-memory.dmp
memory/2452-217-0x00000266F3680000-0x00000266F3692000-memory.dmp
memory/2452-30-0x00000266D53C0000-0x00000266D53D0000-memory.dmp
memory/2452-29-0x00000266D5470000-0x00000266D5484000-memory.dmp
memory/2452-28-0x00000266D5460000-0x00000266D5472000-memory.dmp
memory/2452-27-0x00000266EF4E0000-0x00000266EF592000-memory.dmp
memory/2452-208-0x00000266F3460000-0x00000266F346A000-memory.dmp
memory/2452-209-0x00000266F3490000-0x00000266F34AA000-memory.dmp
memory/2452-210-0x00000266F34C0000-0x00000266F34D2000-memory.dmp
memory/2452-211-0x00000266F3520000-0x00000266F355C000-memory.dmp
memory/2452-216-0x00000266F3480000-0x00000266F348A000-memory.dmp
memory/3680-201-0x00000242B8050000-0x00000242B8060000-memory.dmp
memory/3680-20-0x00000242B8050000-0x00000242B8060000-memory.dmp
memory/3680-19-0x000002429C4B0000-0x000002429CE38000-memory.dmp