e0b4d51facc012fd92627617b52795a6d0e57275582f00d42fc9cee1e6585ebf

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Docs3990h7188729pdf.exe
Size 5.6MB
Sample260417-phpr9sdw4n
SHA256 e0b4d51facc012fd92627617b52795a6d0e57275582f00d42fc9cee1e6585ebf
MD5 6c95ded95c6ec67282bea34145819d9b
SHA1 d0fbad3c2331cd15b91e1e7f00cc7415149f28ae
SHA512 ea140b9537d740054e09059d55d4dc3cac8970cbf5fb4258050120f1b69f9ca02eb488460c95e92fee4e3e216d185575ba7cc9df400722aacbd51cb9d3ce8fc1
SSDEEP 98304:A2e4H4444Cu6RPNLkJMSB1nBjU0+xS1kxSJFnP24kk1ajFHT2b0L/U7qH:Z8UBjU2rO4RajFz2b0L/UmH
TLSH
T1C2462309DBE400B8E4A2BD74CB438B72EBB7BC451320A7DF175466621F376D0AA3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.garcoconstruction.com
Port
587
Username
[email protected]
Password
Ps@sword_2019

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	Docs3990h7188729pdf.exe

Executes dropped EXE 1 IoCs

pid	Process
4140	Docs399097122ws66h7188729pdf.exe

Loads dropped DLL 1 IoCs

pid	Process
4140	Docs399097122ws66h7188729pdf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.ipify.org
10	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3376	4140	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Docs399097122ws66h7188729pdf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 4140	756	Docs3990h7188729pdf.exe	84

C:\Users\Admin\AppData\Local\Temp\Docs3990h7188729pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Docs3990h7188729pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\Docs399097122ws66h7188729pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Docs399097122ws66h7188729pdf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 2000
    3⤵
    - Program crash
    PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4140 -ip 4140
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Docs399097122ws66h7188729pdf.exe

Path C:\Users\Admin\AppData\Local\Temp\Docs399097122ws66h7188729pdf.exe
Size 13.3MB
SHA256 df8058cf9eac1620374c9a99b552d17531c705e80c72478596f6cbe8a0d996ef
MD5 5aea8947540a4f523e7cdc72acfae9fb
SHA1 61b558c549ed5062ec246294ff69e057a8cbbb77
SHA512 7ce0255146228837205b764fb2a3a9a754e637e4779cf806df0bcd4be42bb9d7e243dfacdbd3394f1b73d16f833981dd54002dc6a43d7a20533b0ccfc45a1d7c
SSDEEP 196608:6cHegEUi3txcHbVPyuqtf+G98OY6G0toMldgjt5XN8Uo7BNCE4CG1Oiv:5NOtxcZv0B4mLBNC7J
TLSH
T1BBE6AE20B7C9CE36D99F06708879A72D517DBE761B21D1CF71C438AD18727C22A36A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e_sqlite3.DLL

Path C:\Users\Admin\AppData\Local\Temp\e_sqlite3.DLL
Size 1.4MB
SHA256 5ea34b0e209d5115b19ff56bc456ec9f9fa8b05ee373387b1f620d30c11bf1b2
MD5 a09b798e16e22ab9d58262eadfc0c53f
SHA1 a4809bc5cb5ddec091df23e473ebb65bd4a189c8
SHA512 d1395d44f8d432809e416884ac49af8ab07bb774910c5a43f01f2389d9a93ad8de8cc67cfbe31eb463d4a640e09a57688321ba45e9149c174f42996b9a24204f
SSDEEP 24576:qe1nwSN1RsmPK/gc4YXJ5y7V+L3F9H2KXH4IxotWYt1OHbBlBcWwzi8B:HRN1RsOKZXD2qHboYYtSqZi8B
TLSH
T155658C13B4428025F5D541F2E7EE2EF69D3D6618132A45E786AC28D4D9306E3B73EB0E
MD5 SHA1 SHA512 SSDEEP TLSH