fd06ae3e73f328efef8e2589a126443f7ab5ef6fee8334cd938005f2b5c907b9

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cred64.dll
Size 1.2MB
Sample260416-aqc14sft21
SHA256 fd06ae3e73f328efef8e2589a126443f7ab5ef6fee8334cd938005f2b5c907b9
MD5 b69d4ee762700b4a3f2189a2d46a1921
SHA1 948d51fdacdd1ce78b27e4f7332e09f99c98607f
SHA512 3d6aecc88080ac2fd832b0037262aa8574f15c853644b35abde23727d73a7356fc6061100dcd2198c10bde8d4b246ba2a1b9103cfe5bff88cb2dba614b1d9442
SSDEEP 24576:drR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRZDOnW:dkHmiyCkhh2Bamituw+UXB
TLSH
T1C9557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1524	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
840	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4072	netsh.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
840	powershell.exe
840	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4072	1524	rundll32.exe	79
PID 1524 wrote to memory of 840	1524	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred64.dll,#1
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\001230602148_Desktop.zip' -CompressionLevel Optimal
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

001230602148_Desktop.zip

Path C:\Users\Admin\AppData\Local\Temp\001230602148_Desktop.zip
Size 48KB
SHA256 28e1a741eaecd56161bf84ec7f6f7c7196e8831eca0fcbe4bb002dfe43da31ca
MD5 340599b1bddd96fb0ce4ad0a240b9a61
SHA1 735ff891a9276e8295a953020dda973a81d8c8be
SHA512 8dc86f127c2925a89f630cb7586c62a5b1707bb89f3cc8eb0543358f0ecda21f42f6e15972769c9531c872b55f873f589807d09e718d4caeea67b7b2c0bf8bc1
SSDEEP 1536:Hm30D0UD3LNU7m1leXcmNZtb1l/E5HOboK8C:HI0D02LCa1lg1bsNOb9p
TLSH
T15C23F16E76292760E32AD3B463825422777FC373DE6B645E80FD89B98FF0084563A452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteInstall.xlsx

Path C:\Users\Admin\AppData\Local\Temp\_Files_\CompleteInstall.xlsx
Size 10KB
SHA256 37e995c7fce756ac8748c8fc2e7cf4dace7d4e9efa558e73cde6bba605a603dd
MD5 88bd4dacdc9a50e5b8430c2e9b062b32
SHA1 d61b0ea83d37e149b893af6124de84cab0f1f56f
SHA512 d14e85353335f6f7a943854ce993c4b89838cced69ee8092020388209956b0a03d89337ae72a49389f3b505ec4258c0284ceb4b848ae4bd68912aab90d89a243
SSDEEP 192:wc8mVSpahtGb3UQ/3VGaFUlbVvevUqzQXpS0NVthPXP/Faoy87:wc38kS3V39UlM9z6plV7Plaoy87
TLSH
T15B227EAAE1605D38C767C87EC0CA04F2B6CD52825B853DD63C74F26B25852FB224F2E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeTrace.docx

Path C:\Users\Admin\AppData\Local\Temp\_Files_\OptimizeTrace.docx
Size 15KB
SHA256 96f17c8910ad43a33ce065f06c4d71f5c0ed42c5bdb7682e92ca99c35c6bf84f
MD5 46f96eb9c80e34c5a0f393e9f9ec741a
SHA1 607e09a9e2142a098969e55da31b658ca4273d29
SHA512 bd74fe1cd5941c0529a8556ff64c988baf882239f53fbb734a01e1fa2df24f9242735165c0ae778862d6b668da81f68fabf0efd8f02b8c8e0c233b9a992dc4fb
SSDEEP 384:a8LtJy1kfcClD1tlNodNxt/ZtNNUjxGfIFHbOMu:LukplD1tfUxllNUiItiL
TLSH
T17162AF39D2036820F953CA7CE00810F2E59D6003B785A887349A7BDEB767ED7575BA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreBlock.docx

Path C:\Users\Admin\AppData\Local\Temp\_Files_\RestoreBlock.docx
Size 12KB
SHA256 c895f1765831fce584e829fdb45629f91905b1d4be8b017cfd99800d455ecfa4
MD5 c444c430d7d516a4b94dbd41365d0524
SHA1 0424993fdcc4d2bee12d4883ff791bedefa95670
SHA512 839f1b8ebc8400d1358d7f1a0f4f4e4d471b0cc7a13f2a0636f13397d63ba4592e2cc2fe47a7f8cdc145d1b336e2a07fb1395d8891a9bdabd82fb39a5a3e57e6
SSDEEP 192:Ctxz4qsfR/RCCNxtpgoZ22NNEopWzmeeTWNGFHBESXT/TkD3:axtidNxt/ZtNNEopWrIFHrTbkD3
TLSH
T13952AF3CD54BDC10F9A34A3CD01936FAF5195003BA439487245FFA9F466269B3723AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeGroup.docx

Path C:\Users\Admin\AppData\Local\Temp\_Files_\ResumeGroup.docx
Size 19KB
SHA256 2de66aa4cf3b9e67dd32e89c32ddbbc003dc0bd256f155841b02101adfa60b28
MD5 9f5ac8d503e21e4125881f7d6ebc57d7
SHA1 e1e57538b1e23851123526ff1f330762d328afcd
SHA512 9571708a1fffc4f5acf0d15176fb5a430f008a89c31ba83439fd822b14caf5be5c49211859674159fb6ac7f3ab906a435e9da98746b1080cb2aaaedb52f73d6c
SSDEEP 384:a+CYuH+sZCz8efJN2ovuHyIXvVlSJTdNxt/ZtNNegMIFHPlZ9Yf6:jCYStZCo2N2kwdluxllNelItTOS
TLSH
T12292D178C3046802E6734779D0A912F3E4296A4676C3D4EB60CDFF4F8242D92276F9D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_lgxoy04n.0l1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lgxoy04n.0l1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/840-19-0x000002114DD80000-0x000002114DD9C000-memory.dmp

Download

memory/840-22-0x000002114DE60000-0x000002114DE72000-memory.dmp

Download

memory/840-23-0x000002114DD80000-0x000002114DD8A000-memory.dmp

Download

memory/840-21-0x000002114DE60000-0x000002114DE6A000-memory.dmp

Download

memory/840-20-0x000002114DDA0000-0x000002114DE53000-memory.dmp

Download

memory/840-5-0x00000211358E0000-0x00000211358F0000-memory.dmp

Download

memory/840-6-0x000002114DAC0000-0x000002114DAE2000-memory.dmp

Download

memory/840-32-0x000002114DA70000-0x000002114DA82000-memory.dmp

Download

memory/840-31-0x000002114D910000-0x000002114D9FA000-memory.dmp

Download

memory/840-4-0x00000211358E0000-0x00000211358F0000-memory.dmp

Download

memory/1524-34-0x000001FFCECD0000-0x000001FFCED4B000-memory.dmp

Download