hackbrowserdata | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

max time kernel
149s
max time network
155s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/04/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.exe
Size 10KB
Sample260417-dcaklsdy5n
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery hackbrowserdata infostealer persistence spyware stealer

Malware Config

Signatures

Family: HackBrowserData
An open source golang web browser extractor.
infostealer hackbrowserdata

An open source browser data exporter written in golang. 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000028515-7.dat	family_hackbrowserdata

Downloads MZ/PE file 4 IoCs

flow	pid	Process
12	4004	4363463463464363463463463.exe
18	4004	4363463463464363463463463.exe
25	4004	4363463463464363463463463.exe
53	4004	4363463463464363463463463.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\he.exe	he.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\he.exe	he.exe

Executes dropped EXE 6 IoCs

pid	Process
5660	opyhjdase.exe
5224	Guide2018.exe
1116	etermproxy.exe
4996	hey.exe
5500	he.exe
4388	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	he.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
12	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guide2018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	etermproxy.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Guide2018.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Guide2018.exe

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
5268	taskkill.exe
972	taskkill.exe
6108	taskkill.exe
5832	taskkill.exe
5844	taskkill.exe
2988	taskkill.exe
2620	taskkill.exe
4884	taskkill.exe
5980	taskkill.exe
5804	taskkill.exe
4236	taskkill.exe
1248	taskkill.exe
3012	taskkill.exe
5356	taskkill.exe
6008	taskkill.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	4363463463464363463463463.exe
Token: SeDebugPrivilege	1248	taskkill.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	4884	taskkill.exe
Token: SeDebugPrivilege	5980	taskkill.exe
Token: SeDebugPrivilege	5804	taskkill.exe
Token: SeDebugPrivilege	6108	taskkill.exe
Token: SeDebugPrivilege	5832	taskkill.exe
Token: SeDebugPrivilege	5356	taskkill.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeDebugPrivilege	5844	taskkill.exe
Token: SeDebugPrivilege	5268	taskkill.exe
Token: SeDebugPrivilege	2988	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	6008	taskkill.exe
Token: SeDebugPrivilege	4996	hey.exe
Token: SeDebugPrivilege	5500	he.exe
Token: SeDebugPrivilege	4388	svchost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 5660	4004	4363463463464363463463463.exe	84
PID 5660 wrote to memory of 1248	5660	opyhjdase.exe	86
PID 5660 wrote to memory of 3012	5660	opyhjdase.exe	88
PID 5660 wrote to memory of 4884	5660	opyhjdase.exe	89
PID 5660 wrote to memory of 5980	5660	opyhjdase.exe	90
PID 5660 wrote to memory of 5804	5660	opyhjdase.exe	91
PID 5660 wrote to memory of 6108	5660	opyhjdase.exe	92
PID 5660 wrote to memory of 5832	5660	opyhjdase.exe	93
PID 5660 wrote to memory of 5356	5660	opyhjdase.exe	94
PID 5660 wrote to memory of 4236	5660	opyhjdase.exe	97
PID 5660 wrote to memory of 5844	5660	opyhjdase.exe	98
PID 5660 wrote to memory of 5268	5660	opyhjdase.exe	99
PID 5660 wrote to memory of 2988	5660	opyhjdase.exe	100
PID 5660 wrote to memory of 2620	5660	opyhjdase.exe	101
PID 5660 wrote to memory of 972	5660	opyhjdase.exe	102
PID 5660 wrote to memory of 6008	5660	opyhjdase.exe	103
PID 4004 wrote to memory of 5224	4004	4363463463464363463463463.exe	108
PID 4004 wrote to memory of 1116	4004	4363463463464363463463463.exe	110
PID 4004 wrote to memory of 4996	4004	4363463463464363463463463.exe	111
PID 4004 wrote to memory of 5500	4004	4363463463464363463463463.exe	112

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\Files\opyhjdase.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\opyhjdase.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3012
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5980
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6108
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5832
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5356
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4236
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5268
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:972
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6008
- C:\Users\Admin\AppData\Local\Temp\Files\Guide2018.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Guide2018.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:5224
- C:\Users\Admin\AppData\Local\Temp\Files\etermproxy.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\etermproxy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1116
- C:\Users\Admin\AppData\Local\Temp\Files\hey.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\hey.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Users\Admin\AppData\Local\Temp\Files\he.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\he.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:5500

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02.08.2022.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
Size 234KB
SHA256 b565cea0200de0c7e65ce76a00899c548704e77b95aee9c7db0b7de044f9b578
MD5 a1a5102e42fe259698cf24122d2ad23a
SHA1 e3e9fd474b128faad4fa17c1ce5642cff14de725
SHA512 093310ddcd824efde9654b17fb267011873d87abef4d18adb480e755db6510e3d10cddde6a2a6937d11e6159f4f45e1bcee38079ea39a403394e49258ad8f735
SSDEEP 6144:/Mh1Jd2K/aCottwzDP+PJAjdQfHCtUIZNh:0ddrNotizKRGSHCtUMNh
TLSH
T16F34BD6AC5537DB6E1C02E3AB9FFE34A35712A73DA3A9B23C43B71E079E90904175214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Guide2018.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Guide2018.exe
Size 11.8MB
SHA256 f2f007107f2d2fffe5328114661c79535b991e6f25fe8cc8e1157dd0b6a2723b
MD5 35d0a7832aad0c50eaccdba337def8cc
SHA1 8bd73783e808ddfd50e29aff1b8395ea39853552
SHA512 f77055a833ba6171088ee551439a7686208f46ccb7377be3f4ed3d8c03304ca61b867e82db4241ea11763f5dfbdda0b9a589de65d1629b1ea6c100b515f29ff0
SSDEEP 196608:7x9/+1/muLzGKNqrsgiZBYPxU26zhQc5WdAJsYOnJeSoiIrbIFM2hH7oUcOFrgr:7x9/+ZqK+iZCPxUxanhcF2Ecty
TLSH
T171C6F112FAD280B6D06351B0463B772FA5F8A734433599C767C0699AAA313D297363CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etermproxy.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\etermproxy.exe
Size 2.7MB
SHA256 657512d4cbe3e4c08cc79e5e4f296788a39551b8f58ceddb95e22e7df8544cb5
MD5 6df82098890cb719cddfc25fcd07b8ac
SHA1 ba051e912f53b06a72f14cadbfd04124f3cb5188
SHA512 b6368b9c3bf6c11c097a6916e10bced28c6ea15ee528223becb090077234d94857d7ef7a041a31a3b763931fca0d01f0b78ca396d8a31ed93b82d8980ae8475c
SSDEEP 49152:rJszhShQr1TpidqmygsVzSUiGHGPuPnVyPiDbi:UVFgsVzS5GHGPuZD
TLSH
T1C1D59E42B7864052CB4A5874546EB777ECB4AEC567289FC36378FD68343B281783B21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\he.exe
Size 64KB
SHA256 84e03eb7665a140b8769ba72fd95fa497190682e61eef78d6f6ebcacca3867ff
MD5 1759675620537ad9d2f477ce78704a48
SHA1 7716a3eecb203ff9bc9022d166f073c0eed367b7
SHA512 ff9cf615926872f3447fc86e8334db86f5ce6aaaf89e883919190baf3198462e9eb9ffbb4f3cabe27a8b677dfb1e78f38d582d4b1b8bd40c6c22787e83648fc4
SSDEEP 768:gQJdeAd+qFj618aTpCZzSdpUtS1N9Orc9bjyiQpxXdrMQ6rwS+:gwdLsqF61TTpCZmdpUtuj9beimdwI
TLSH
T19C53B9943673CC32D17EAE76E6C3624F9DB15173AC05D5860CD666E23F02E86C90A8F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hey.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\hey.exe
Size 62KB
SHA256 a961ce0314f78900f26aec189234ac71e497487b35c1a4a604bf384e911f3e00
MD5 6f7e59caac24659e23967807586dbce5
SHA1 bc9717606f87e0f1cf35f214b92ca0e1fbdacd06
SHA512 2921977a253c174154f9e5683c58be8c311470a41c06e40ed95271c23813aa3e24e661bd46d017cfde0cecd6e44a46386c6e6240c2ef23d295f3e0bd4b88dba8
SSDEEP 768:yhQXs5Bx2EOwnynaPRqQYE9fxD9bx22kyxmmzKFPrsk:Q+sR2ELnynoBx9f99bx2269jZ
TLSH
T1A953B6C536778872D27FAE7AE6C7624B6DB54073A901D5850CD277D32A02F82C90ACF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

opyhjdase.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\opyhjdase.exe
Size 14.6MB
SHA256 d336273cee697dec1b8f9e1643005a2cd8b80305e9f8dc257ab69d2322f38927
MD5 0d53256905411410fcfbbbcda13abdbb
SHA1 cdea834f452864559cf7471614948cbc575e0fcb
SHA512 d6d2f8973cfda896edd0869a76773d14dc9a866be31fd1629c8cc9139ff18f1c7d84a6321cac1369d254eb64edb6bc7f7ba3d905c0622a6e5dc84faa813122f9
SSDEEP 98304:3FM5G8lhjLZgAZV+zSnlRh+4k54AjnK0NW9cDF0F3gpLDv0hsi2J//ZczCJR7NW+:346ze+BjjMELDRim//ZcuJR7NWjMZ
TLSH
T18CF68D47E8B606D9C0A99236C66796537B347C884B31A3D76BA0B7382F73BD05B79700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\update.exe
Size 86B
SHA256 a376489b08200d30d37e9e4a432a901299d9ff2eb2439ca18e4eb233b9414b19
MD5 ea55a958f0170f009eebaaf0d3411f35
SHA1 0b6e9f80cc7efba1815039ff55f6d6c5d71a1ccb
SHA512 ee110a255f100e0c843b512a984b2eef1da7e0968207baab45eeb08cda1a066fdf4c8551964c6959c6d416050c703f1ce7550a311c1df1b035a8a553b70054d4
TLSH
T119A012080C812D460B49C81471403D30158D014304552FA040CCF51493D01645901944
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT.6

Path C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\CURRENT.6
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

CURRENT.bak

Path C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\CURRENT.bak
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

memory/4004-154-0x00000000057C0000-0x00000000058A3000-memory.dmp

Download

memory/4004-155-0x0000000005940000-0x0000000005950000-memory.dmp

Download

memory/4004-1-0x00000000059E0000-0x0000000005A7C000-memory.dmp

Download

memory/4004-0-0x0000000000F30000-0x0000000000F38000-memory.dmp

Download

memory/4004-2-0x0000000005940000-0x0000000005950000-memory.dmp

Download

memory/4996-250-0x0000000000FE0000-0x0000000000FF4000-memory.dmp

Download

memory/4996-269-0x0000000001DB0000-0x0000000001DBC000-memory.dmp

Download

memory/5500-265-0x0000000000CC0000-0x0000000000CD4000-memory.dmp

Download

memory/5500-270-0x0000000003240000-0x000000000324C000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads