ee04c3c25cbee4fd131f65239b60c2c94db0428e86607c0685e7c610376b34c6

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/04/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 22KB
Sample260402-wpbbsacy5t
SHA256 ee04c3c25cbee4fd131f65239b60c2c94db0428e86607c0685e7c610376b34c6
MD5 b0449f002413531fcec8ee70a83837f8
SHA1 6131ac02e5d8a14f22046e7743cbeebd3142f32f
SHA512 45e386a4ebceefb184587ebef4dd00d8a134406efd5feb3472fc475c25989025673211c2c17101f0bc6c6b07498e5f6599e80a54f1cc13889adf639238033568
SSDEEP 384:Hu1OuPf4/S1fUrQFYhJ4JVB0WsNUnwnR:HNuPf4/IUrqY+xsN
TLSH
T108A20806AA56534AF4B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4320-0-0x0000000001080000-0x000000000115F000-memory.dmp

Download