Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/03/2026, 08:00
Behavioral task
behavioral1
Sample
6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c.exe
Resource
win10v2004-20260130-en
5 signatures
150 seconds
General
- Target 6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c.exe
- Size 1.4MB
- Sample260303-jv45tshs2c
- SHA256 6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c
- MD5 e53b317dc1aac1e113be7f89ab4c431d
- SHA1 ea708ef5ad9bd5e0c35f0cbe15d011a397466063
- SHA512 9b88b675ffb4d522b1ced608e4505b3c21722641d4e6c1d07c0024b78240cd6ef90c6b15dcd162ad0c8ee03ffd37ee637e951b0b29babfc86aeabb184c046cf9
- SSDEEP 24576:Pxu/UPTv4iGd5FprVueuqSTzLEAONA+WxCpZlE0S0ppgZ63nIn/II6YG0x2222v+:8/CQiGkeubLp+A+WxCpZlEoy63nIn/Id
- TLSH T127658D61B197C032D19642F0A928EFB6526CEC344BB684DBB3D03E3FBA715C1A634957
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Acreed family
- Detects Acreed Stealer 3 IoCs
resource yara_rule behavioral2/memory/572-0-0x0000000000230000-0x00000000003A3000-memory.dmp family_acreed behavioral2/memory/572-27-0x0000000000230000-0x00000000003A3000-memory.dmp family_acreed behavioral2/memory/572-31-0x0000000000230000-0x00000000003A3000-memory.dmp family_acreed - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6d9d9ed4ddbf63aa133bd1616942ae2d984baaca1550933ee84e70d3b33d302c.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\AppState.json
- Size 612B
- SHA256 d22e33d806b0cda914a89c2ab57bd0166e4bac7e70896f5b5782e63881e09063
- MD5 0c5756acc918a8fd1b4ecc46b32e9f7f
- SHA1 938a07e3e13d80e3a3511e4f8e9910877180843d
- SHA512 5d4d78c836c177fa6e6c61ea12a775479ed8653a65260e4e2fe88d88c0482846c0c6a0102e23de4bf7ea4a0aea276fb6feff709a77de78a44d93d7a681aa0c5c
- TLSH T191F00D94C9082EFD55B0164EE5A5E68AD60903E7351A0E83F6FD650D7F72CB83640C8A
- MD5 SHA1 SHA512 TLSH