Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/03/2026, 07:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe
Resource
win10v2004-20260129-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe
- Size 2.0MB
- Sample260316-hs6efag13p
- SHA256 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea
- MD5 c31ebc969030bb0651201abb6d2bd4e9
- SHA1 e67c90cdd012a7b50945c368e232366081b4f525
- SHA512 f5df0e24012da50d41c86610871ff8a6a98d7f73539637a7fbaf1d8d42ee6c349f1d8aa6fa882eb3714b6504bb8349439d9f6b829e7c6baa5f20213f63c40e19
- SSDEEP 49152:m4eyfUeBaXsv2fft50iG5LP/Klhl/l/5zpxzqI6bOq/E:m+fUmyC2fF5ZsLP/kl/lh9BqI6L
- TLSH T1B9A52377DAA971F9E09F8D3084955881EFA27C23AB11EEEB53544E392D166D0CF38B01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- BrowserSnatch
BrowserSnatch is an open-source hacktool designed to steal user-data from various web browsers.
- Browsersnatch family
- Detects BrowserSnatch tool 6 IoCs
resource yara_rule behavioral2/memory/2084-1-0x00007FF6ECB10000-0x00007FF6ECE5A000-memory.dmp family_browsersnatch behavioral2/memory/2084-22-0x00007FF6ECB10000-0x00007FF6ECE5A000-memory.dmp family_browsersnatch behavioral2/memory/5696-52-0x00007FF707280000-0x00007FF7075CA000-memory.dmp family_browsersnatch behavioral2/memory/5696-30-0x00007FF707280000-0x00007FF7075CA000-memory.dmp family_browsersnatch behavioral2/memory/2084-60-0x00007FF6ECB10000-0x00007FF6ECE5A000-memory.dmp family_browsersnatch behavioral2/memory/5696-61-0x00007FF707280000-0x00007FF7075CA000-memory.dmp family_browsersnatch - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v20svc.exe v20svc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v20svc.exe v20svc.exe - Executes dropped EXE 2 IoCs
pid Process 4268 v20svc.exe 5696 v20svc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3036 set thread context of 2084 3036 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 79 PID 4268 set thread context of 5696 4268 v20svc.exe 81 - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\v20svc.exe 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe File created C:\Program Files\Google\Chrome\Application\v20svc.exe 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 5696 v20svc.exe 5696 v20svc.exe 5696 v20svc.exe 5696 v20svc.exe 5696 v20svc.exe 5696 v20svc.exe 5696 v20svc.exe 5696 v20svc.exe 5696 v20svc.exe 5696 v20svc.exe 5696 v20svc.exe 5696 v20svc.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2084 3036 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 79 PID 3036 wrote to memory of 2084 3036 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 79 PID 3036 wrote to memory of 2084 3036 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 79 PID 2084 wrote to memory of 4268 2084 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe 80 PID 4268 wrote to memory of 5696 4268 v20svc.exe 81 PID 4268 wrote to memory of 5696 4268 v20svc.exe 81 PID 4268 wrote to memory of 5696 4268 v20svc.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe"C:\Users\Admin\AppData\Local\Temp\7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe"C:\Users\Admin\AppData\Local\Temp\7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files\Google\Chrome\Application\v20svc.exeC:\Program Files\Google\Chrome\Application\v20svc.exe --v20c3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Program Files\Google\Chrome\Application\v20svc.exe"C:\Program Files\Google\Chrome\Application\v20svc.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5696
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Google\Chrome\Application\v20svc.exe
- Size 2.0MB
- SHA256 7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea
- MD5 c31ebc969030bb0651201abb6d2bd4e9
- SHA1 e67c90cdd012a7b50945c368e232366081b4f525
- SHA512 f5df0e24012da50d41c86610871ff8a6a98d7f73539637a7fbaf1d8d42ee6c349f1d8aa6fa882eb3714b6504bb8349439d9f6b829e7c6baa5f20213f63c40e19
- SSDEEP 49152:m4eyfUeBaXsv2fft50iG5LP/Klhl/l/5zpxzqI6bOq/E:m+fUmyC2fF5ZsLP/kl/lh9BqI6L
- TLSH T1B9A52377DAA971F9E09F8D3084955881EFA27C23AB11EEEB53544E392D166D0CF38B01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\b38d540d\sess
- Size 278B
- SHA256 668c0adce1997e0902fb3a90453484dc9035e1912675f303d1f0c87833ac992b
- MD5 854aafe82ccbbe924198cb0d0a608d37
- SHA1 0deb13d02e2745cc4375a3213ea9a54c72cd58a0
- SHA512 77d7bfd64aeafca5f7ac0a3dc20650c7857521b185e200c9ffa3fd9542e19260976cd3fc658fca3c2c8941f43d1eb6460bd2856c63ed18edd0dd133c0f1d5347
- TLSH T1CAD02B475014D0FBCA7812786C47B68895E1909DA373CA548970646A72241988E25F43
- MD5 SHA1 SHA512 TLSH