Analysis
- max time kernel
298s - max time network
203s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
07/03/2026, 13:59
General
- Target Ocher.exe
- Size 423KB
- Sample260307-rap46sew8s
- SHA256 dfdd4cdf6dd89b4c50a2ad96be9f2aa4c6e1c08ae50eb1de8169827555b0ef89
Malware Config
Signatures
- CHStealer
CHStealer is a stealer written in C#.
- Chstealer family
- Detects CHStealer payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ocher.exe"C:\Users\Admin\AppData\Local\Temp\Ocher.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5101c23c-67a9-4eb8-af93-a5e683766b86.exe"C:\Users\Admin\AppData\Local\Temp\5101c23c-67a9-4eb8-af93-a5e683766b86.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
5101c23c-67a9-4eb8-af93-a5e683766b86.exe
memory/4396-0-0x0000000000C80000-0x0000000000CEE000-memory.dmp
memory/4396-17-0x0000000001780000-0x00000000017FB000-memory.dmp
memory/5308-15-0x0000000000430000-0x0000000000472000-memory.dmp
memory/5308-18-0x0000000004CB0000-0x0000000004CC0000-memory.dmp
memory/5308-20-0x0000000005930000-0x0000000005996000-memory.dmp
memory/5308-21-0x0000000000C10000-0x0000000000C8B000-memory.dmp
memory/5308-22-0x0000000004CB0000-0x0000000004CC0000-memory.dmp