c2a4212573d7566acf5b610b4ce3598237acd37459670daa1b6950f107d50e03

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/02/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
updateV3.23.exe
Size 783KB
Sample260227-nf8a6aev8b
SHA256 c2a4212573d7566acf5b610b4ce3598237acd37459670daa1b6950f107d50e03
MD5 b6480aa6c364715a21ba28c4d26a5b6e
SHA1 ba7ea733843809388a8b0e3039ed2ed3a5d1ce3b
SHA512 e499fdc40472190c81c259e26d0dfb06cbde79ffc01568477f51abca45f4da14daf96916fb7c7b65bb5fea8e48c6689cd107aaeff8197a7a0b6a0de23973ec6c
SSDEEP 12288:db8OM8KIcHN90RoyS7tsyQ//HtrBE+h4aj2N:F8j8HcHNSobGr//NlES4n
TLSH
T100058D07F3A980ECD46AC274C7569627FBB2F84A2230B65B97E04E562F53E706B1D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1700	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2584	updateV3.23.exe
2584	updateV3.23.exe
2584	updateV3.23.exe
2584	updateV3.23.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1700	2584	updateV3.23.exe	89

C:\Users\Admin\AppData\Local\Temp\updateV3.23.exe
"C:\Users\Admin\AppData\Local\Temp\updateV3.23.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\system32\systeminfo.exe
  C:\Windows\system32\systeminfo.exe
  2⤵
  - Gathers system information
  PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-0-0x0000028A9AAB0000-0x0000028A9AB4B000-memory.dmp

Download

memory/2584-1-0x0000028A9AAB0000-0x0000028A9AB4B000-memory.dmp

Download