Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/02/2026, 00:04
General
- Target Cia2O5x.exe
- Size 2.5MB
- Sample260211-acn68act4b
- SHA256 038da7941cb395df589983f3b09346694fe2a3a9e458a295ebfd5bd7c9fdb434
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cia2O5x.exe"C:\Users\Admin\AppData\Local\Temp\Cia2O5x.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3328-0-0x0000000000850000-0x0000000000AD4000-memory.dmp
memory/3328-1-0x00000000054E0000-0x00000000054F0000-memory.dmp
memory/3328-2-0x00000000056C0000-0x0000000005882000-memory.dmp
memory/3328-3-0x0000000005640000-0x0000000005690000-memory.dmp
memory/3328-4-0x0000000005910000-0x0000000005986000-memory.dmp
memory/3328-5-0x0000000005EC0000-0x00000000063EC000-memory.dmp
memory/3328-6-0x0000000005A50000-0x0000000005A6E000-memory.dmp
memory/3328-7-0x00000000063F0000-0x000000000686E000-memory.dmp
memory/3328-34-0x0000000007AB0000-0x0000000007B16000-memory.dmp
memory/3328-38-0x0000000007BC0000-0x0000000007C52000-memory.dmp
memory/3328-49-0x0000000007AA0000-0x0000000007AAA000-memory.dmp
memory/3328-50-0x0000000007B50000-0x0000000007B62000-memory.dmp
memory/3328-68-0x00000000054B0000-0x00000000054B6000-memory.dmp
memory/3328-67-0x0000000001030000-0x000000000104A000-memory.dmp