180f0fef99f3081fec78d07524052a07a975525f04c7b780687b763e2bacd393

Analysis

max time kernel
149s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/04/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload_2026-04-17_10-15-57-336736.exe
Size 3.0MB
Sample260418-yr9cpsew2w
SHA256 180f0fef99f3081fec78d07524052a07a975525f04c7b780687b763e2bacd393
MD5 893a4400d0ac1a50fcbb5eb2c18382b8
SHA1 8176000428800beb055f12ed690fb6e45a187ab8
SHA512 7283199446e7f7e95d4bac71e23a810b03d192eb0709ae2d189ce7ce1f0738847cfb05338d104ad531503eb7b31ff93d39aece8a241014edd241fe466f5accf8
SSDEEP 49152:U/5vgQsBZrRf8tGJ2wM9Hlne9tZBR2ooR99f7d5NatnXjueXQpkpnWkKoXT3:UsRfd2fne91K7co
TLSH
T14BE5BE5AD19360EECC2AC170634B6132FE3474599D387E6B7694CB393EB0D603A59F28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000\Control Panel\International\Geo\Nation	payload_2026-04-17_10-15-57-336736.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	payload_2026-04-17_10-15-57-336736.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	payload_2026-04-17_10-15-57-336736.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	payload_2026-04-17_10-15-57-336736.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
4840	msedge.exe
4840	msedge.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe
5468	payload_2026-04-17_10-15-57-336736.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5468 wrote to memory of 5732	5468	payload_2026-04-17_10-15-57-336736.exe	84
PID 5468 wrote to memory of 5732	5468	payload_2026-04-17_10-15-57-336736.exe	84
PID 5468 wrote to memory of 4840	5468	payload_2026-04-17_10-15-57-336736.exe	87
PID 5468 wrote to memory of 4840	5468	payload_2026-04-17_10-15-57-336736.exe	87

C:\Users\Admin\AppData\Local\Temp\payload_2026-04-17_10-15-57-336736.exe
"C:\Users\Admin\AppData\Local\Temp\payload_2026-04-17_10-15-57-336736.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 7b2e1244f5f2995c925e6dc542057898076923519b126cd764a03bf1c69352e9
MD5 18cac7389d1a4ff9227cabc0af3b83ef
SHA1 5210edaeb4d6273543069186d80a31cb22f071b6
SHA512 256e600d5dd65098618da07796539783ab59260ec394ee84ce0c1e0fa35ea273592961d1d933b9361c2f1738e1237d157a93f4dc9e946618ada9df51c8837826
SSDEEP 96:i/DdB5/q/6G/eG/t/YImfmgdmpGmqmWfGfSwWfOdfodMfjfKNedVdvdfNtdfPpdr:Yv5T72cXHoxF8IXJ
TLSH
T1D991EF0699D5CA1F2280E8E39371E16C95F04C447F893B219B65C8CD39D580EFAC63DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 593B
SHA256 e448bd6792df6ed5d120ce957e97963785ec954d1356c2c6ec1507d5dccf8cc1
MD5 2300f21ad7a10eecf7694c69c3765ad4
SHA1 962254accc6f371854ce04f6ec76ce4a8002a86f
SHA512 d3a8b5337738ed1509bf6c21e691d74a703d5ef63f0cdb31a83352c7a0a04c8ff67f38a16cdeb5ad2b5af25cff326e06a6e981ace51fe407aa607cd30a1f825a
TLSH
T1B4F0AC03BCC2980E1100DCE383A2B76C9CE940089B9A27479B40C48C74C591DF8CA3A3
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1000B
SHA256 8957ad47eb2ebbe35ecdf64f78563b491ea1d6e3a55f56007df3703e017535aa
MD5 57c41cdc8470464cb81b12ab59106033
SHA1 8eb5e59545b762771144664d858860a66c175e2f
SHA512 36026ada9fe5c81aafd93d0bef85f709e093ac57f0e8fb56a629fe2f4a6c6e300793ef38f0f00fdc81b8c508948b2dfccfe60f8d44f8d01af93c93d5ba52e10a
TLSH
T12C117B02BCC5E82E1000DCE39361B76C9CE484049BCE2B428B44E94C75C582EF5CE366
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 a5b87aae4c4cde8e60843060305066ff5e3b9653aa3446a93d821b99edbc37d8
MD5 f32aade38dc8a04cde0637f044493036
SHA1 f54bca3c8798d75b3ac00d6a9c9ee10edc3370bb
SHA512 32b86f69464f1ef6f91ba1242e9dfc0da53a6cfd517cfd11a35baa14982da7bd8371cac3874ee36585448c3b9076de5369b516eef574976ebb3dbc7f979bc471
TLSH
T136115702BDC5D85E1140E8E3A361B66C9CE484089BCE2B429784E98C75C582EF6CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 255B
SHA256 b6ffb31b4827a00f5a1f3048d8baed7e3f2a71a48e966dfbcb6514ff22fda33c
MD5 03aedfa1b43cd267e065cba77a387a6a
SHA1 d13c69466aa63798cd916ded0c6f7b499494412e
SHA512 cf99cb37a78119abcb827cd4d44d1da13c5996a2381ccd9ae8fa2d68b342b4fd726f7389942e14082eaef22dfdbf2af0ef9f069c74315473966602292875e264
TLSH
T1A2D09716EC82C08C2462E8B783152A5CDCFB4018AB5903037B85804E14C0F0C9CCB3E6
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 3b92786214c1ce573a98fff8c0888041895297d15c52d13ab172430b4f63abe9
MD5 104ba5dc28f6b4e4606b7fe0607fd1ea
SHA1 c0e01d338e2e890c494b0a326602dfc916affdb5
SHA512 43d6a4a266a05b3ae21ba66309b2220260f6e0557ad683d6ff924dba141f60d3f2d852983b318363a859c4498cba71c535a4a67e6895a1551200e8c229a946e9
TLSH
T1FE318B02F8C6D81E1100ECD39355BA6C98F98448ABCE3B425B84D84CB5C695EF6CF397
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 04181b069c0001a7f00766e57467e7cf3886cbee319b1a7dd54591bc0a4e3ca3
MD5 df605bcbf661bdf42aeeafd5da7b3e22
SHA1 590a3d8e22f5856dd5f22d65d0e3214b89bf42ef
SHA512 062be5222131cc60fc7e1b75e6efd547fab11da5392d7a72c3204686ac3040e839c01f3752851f0ca0285e65d6736ecc51b86c7a7cc10287f9b309aebd1654df
TLSH
T18B317902F8C6D82E2100BCD39354BA6C98E48449ABCE3B425B84DC4CB58695EF6CF397
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 a9e6ce7287813533f99c0b8b2da37fb0fc1c31a87862e2ee33cb0881aa24e87b
MD5 4fc7326ad24283f94d032f337d33ec8e
SHA1 05bed0f88d3b967b7b430421dc0c068307c605b1
SHA512 f9c85c638c69168dff6b4d76bf350c8bb6e2bab3ca0257f233f7f8f031267608a9dda87d8ce887c62bf6b085dfaeed12a60addc8d0ef7d4067fe3b887f0df6a5
TLSH
T1D9419B02F8C5D81E1100B8D3D355AA6C98F494599BCE3B425B88D88CB9C696BF6CF397
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 da2018ee6e34d6acfa06bc46f440cbedbb4fe86747fabea77d566903db662e06
MD5 b5083526bc40524331031664f202e0f1
SHA1 9766c2ce57453d5d48fa2bfff4f2cccb7ecb1d75
SHA512 3b76c55f4916b107c92f08c49319146a44bb2bc2b04ea4927e71f23163088c2f9d4866439fb02374b1299ac5a88ac3d470d05bebb93089ffb13f72a66d26e494
TLSH
T1AD41E042F8C5D41E1210BCD3E341A61C88F4545997CD3B025B89D88C78CA56BB7CF3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 539205979dc3a9f9867f300e7559cc6e1e2aa53510b3114c31116f3377cddee0
MD5 3a2a13fcbcff3b65bb264153a120ce8a
SHA1 4570547658a92e71c6db4f7308364ebbe00f2095
SHA512 08d0b1a4947adf5e7206d7e0fcae5c0ddc74b4c9d7ee6bb7d44ac329c72eab92889f2bb2a1907bc908bcbd3443fece0b4ded317db5c0c3d642ea85144607f562
TLSH
T15061110398D5C81E2280E8D39371E65C99F08C447FC93B219B59C88C78C684AF6CA7D7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5468-162-0x000001F3AC990000-0x000001F3ACA5D000-memory.dmp

Download

memory/5468-161-0x00007FF79C870000-0x00007FF79E521000-memory.dmp

Download

memory/5468-167-0x00007FF79C870000-0x00007FF79E521000-memory.dmp

Download

memory/5468-170-0x00007FF79C870000-0x00007FF79E521000-memory.dmp

Download

memory/5468-173-0x000001F3AC990000-0x000001F3ACA5D000-memory.dmp

Download

memory/5468-172-0x00007FF79C870000-0x00007FF79E521000-memory.dmp

Download