180f0fef99f3081fec78d07524052a07a975525f04c7b780687b763e2bacd393

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload_2026-04-17_10-15-57-336736.exe
Size 3.0MB
Sample260418-yr9cpsew2w
SHA256 180f0fef99f3081fec78d07524052a07a975525f04c7b780687b763e2bacd393
MD5 893a4400d0ac1a50fcbb5eb2c18382b8
SHA1 8176000428800beb055f12ed690fb6e45a187ab8
SHA512 7283199446e7f7e95d4bac71e23a810b03d192eb0709ae2d189ce7ce1f0738847cfb05338d104ad531503eb7b31ff93d39aece8a241014edd241fe466f5accf8
SSDEEP 49152:U/5vgQsBZrRf8tGJ2wM9Hlne9tZBR2ooR99f7d5NatnXjueXQpkpnWkKoXT3:UsRfd2fne91K7co
TLSH
T14BE5BE5AD19360EECC2AC170634B6132FE3474599D387E6B7694CB393EB0D603A59F28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	payload_2026-04-17_10-15-57-336736.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	payload_2026-04-17_10-15-57-336736.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	payload_2026-04-17_10-15-57-336736.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
4336	msedge.exe
4336	msedge.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe
3024	payload_2026-04-17_10-15-57-336736.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2032	3024	payload_2026-04-17_10-15-57-336736.exe	80
PID 3024 wrote to memory of 2032	3024	payload_2026-04-17_10-15-57-336736.exe	80
PID 3024 wrote to memory of 4336	3024	payload_2026-04-17_10-15-57-336736.exe	83
PID 3024 wrote to memory of 4336	3024	payload_2026-04-17_10-15-57-336736.exe	83

C:\Users\Admin\AppData\Local\Temp\payload_2026-04-17_10-15-57-336736.exe
"C:\Users\Admin\AppData\Local\Temp\payload_2026-04-17_10-15-57-336736.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 3356943cc6816b1193c9324a88b5beb5b4cb4280b4e7a961956fe3716ed70287
MD5 b1911b7d9a8b9855bfa881cb75c7eafe
SHA1 05fa339fd54088b51a661cc43a3527036e3c7e92
SHA512 3f8ad48aa67c84e243543dfa1604978794b1f9683846e2f5ba22ec5e7dcac86f31e39c8b4960e017b16a94dfba5f7a8e377f9e0d525b6e3772418a55bf6364ed
SSDEEP 96:i/1dB5/q/6G/eG/t/YImn9dj5mvmpGmqmIWe9jd9dmzBfifYfGfNfNfZdfsdfCfK:Cv5TnlzNJ70hFdvOL
TLSH
T10891FF519DD6DA1E2640E8E39772E26CC9F049483F8D3B319B65C88C39C690EF6C6387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 593B
SHA256 91d967f0bfaf2a6963b19cd4564d96043ef6128082283202279e3918fed8b797
MD5 8fe3e91547abb12dcc9b4fcfceb9a309
SHA1 8b4301a73cda0bfdcc4ba810ab03a147fa73d45f
SHA512 efff932ee22cbcc6d5bffa514524fd8649fa07643b8e56de6a3a752a0240ea15022d10f857ac9d6878309df0ba9fc6926798b893b65a2390937e5580052f68be
TLSH
T184F04C43FCC6981E1510DCE79392766C9CE940089B9A27479B44C48C75C591DF9CA3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1018B
SHA256 30a51dc02d08856acf478cb7942e4278c496679bc4939b3bcccb38b40c20a6df
MD5 2e081210ac923cc1598b1c9f0efa95f0
SHA1 89976cef71706e2ce419f0a297a159034f79b517
SHA512 82cd7196d0757ace0ef8ff14a248350af7d341f6bdb940f0003a8df0c90bfdc5332da7b7730f21f2c2f236d2ef7c631885de74f93837eacc70ebc821fd0b40fc
TLSH
T177117B02FCC5D82E1040ECE39361B66C9CE484049BCE2B429B84E94C75C582EF6CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 97b7773def08eccc4ada03d0fdec9966d30d0fc236bbd7c34d96a6aa73438951
MD5 4b0bff6ff5bd27ec45990fd9bdad8d73
SHA1 8a6ad23b8e9cd6cacc6bdeb73facde9ca58ebf9c
SHA512 7bfa05efc96fe7f03800ec734a87cd572bee5d929c7d9ee7000ac6ade89ef52b5eb894c3a20a9c67e101a4a5670ace100aa030fcb5e7d3e250681380a6f82f0f
TLSH
T1DC11AD02FCC5D81E1140ECE39351B62C9CF484089BCE2B429784D94C75C581EF6CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 e44c4ee0936f01e35c761ac6d8006c22a9dfb08ccfc7e21a4088e0523e25216d
MD5 31d12a06382348d8b500ff721387ebba
SHA1 edafb83da1b8a8a3abda313c709a902cca5d5489
SHA512 32a4391b048d6a9e5f0b61b17b7eb4e5c4803d5024effd4c803a75e0cdcac4e2d2ff3907c145defa59dea2190eef665743e4c845944f2a6dfe5fd231d958e5eb
TLSH
T198315A03F9C6D81E2100ECD39361AA6C98E94408ABDE2B465B84D84C74C595EB5CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 9cda00736809b9f949c91442b73045c35eb926f96f579d4e9f4cafe85a4b33dd
MD5 0db74101b5b2f6631574393759c1f260
SHA1 eb16c41b85197733d3c623a98986e47ddca12057
SHA512 9d53afa1c201710d1901875de65c23db30a0ea5b8b4b9ba232addc10818214c22b2efe9f0be29b13be6d62648bd923fb7516a8507b9dc5ed631cf3709bbb23f5
TLSH
T1A3317B02F9C6D82E2100BCD39365BA6C98E484489BCE3B569B44DC4CB98685EF6DF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 7c7cea6debfdd5d14adb7e67c3f98007810538ca6313edebb2d152538fb81ff5
MD5 3307573d425707476f5b23c3238c1e68
SHA1 d35d643cd204c84a22aaf4ca8690e79cce485917
SHA512 cf76b68b3ca6bbdad7742f5e512404b95b2590477584bda9e97368341615f0d62db45796172f2db146505f0df91c9145723393f2644f5ee03dc2a04249cdebb0
TLSH
T17E41CE42FDC5D81E1100BCD39355AA6C98F484589BCE3B425B48D88C78CA86BF6CF397
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 7b67fee999d76555c5682fd083e80001211ba3eb9e3371bd24b79d92bfd132a7
MD5 5b39ee390979bc601a692150c2579fc7
SHA1 d4ba7ac1b1ae0e4fce1a14ce94073197b1341b12
SHA512 e909bfe565aa7ad80198944a0e94a5d908c34e542e4c66691f152bc8befdab71af2cfe9706dc8525afb06c27bce6efec18fc9eabd670125ecdc4187f3e612b46
TLSH
T1E741F143EDC5D81E1210BCD3E352AA1C99F454589BCE3B425B49D88C78CA42BB7CE3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 255B
SHA256 b3c95d6e8901c9677f16f8dc9d8eae91f9de01358a0492c287148d384f6d5c12
MD5 b27c00ebd84f130900fd5011fa4222dd
SHA1 681d559064c43323fa9b8fc42cbb3ddae071719e
SHA512 b3b61262292df46c4396e914b61505ec7102110a4062580f7556a9ee6fbd8e528a678b09a3850e78b8393cca3b1de06c5e4c3661c0a5ffd9419ae6c1dbe6e203
TLSH
T128D09712EC82C08C2822E8B78302296CDCFB4018AB5903037B85804E18C0B0C9DCB3E6
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 b8326217783d2f5316d1cec63d0676276a79566fa15bfbd352d914b6269d13cb
MD5 b8e1429806de6a66b3778b5e85549a72
SHA1 94c504616449cd197ee1bab99787bad4246f2c33
SHA512 a1988ba6ce04dbc8472c0542e14e1a3ebe01e11754ceefbb50bcd7ad4d4d7892bbc1f16bff73e4713bb0f957693e382947eb89ce9af686c8f40cab39d28db4ba
TLSH
T11251DE47E8C6D81E2310BCD3E361E62C8DE484586BCD3B125B48D88C74CA56BB6CE797
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 92c6759fc7fadf1433f9ea220a1d2a10bdb6ea69b051bac1b2dab7e2c3cd0707
MD5 07b0b54f239554e610d73770d25f5205
SHA1 2341a9f569388da7146ebff444e82c593de644f4
SHA512 9c32d01a75b3fc24718820ad51b18170608b09807147ef5c6940f506cf1aaf38a2a7305b71e0318b3bd5ff6cb3bda4c0873708b0f9c50a7d91f998dc2da7e791
TLSH
T1A461E2529DD6D90E2210E8D3A371E25CCAF088447F8D37329B59D88D34C591AF6CA797
MD5 SHA1 SHA512 TLSH

Submit Download

pwd_1860.db

Path C:\Users\Admin\AppData\Local\Temp\pwd_1860.db
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwd_328.db

Path C:\Users\Admin\AppData\Local\Temp\pwd_328.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-9-0x000002844E3D0000-0x000002844E47F000-memory.dmp

Download

memory/3024-168-0x00007FF776760000-0x00007FF778411000-memory.dmp

Download

memory/3024-172-0x00007FF776760000-0x00007FF778411000-memory.dmp

Download

memory/3024-180-0x00007FF776760000-0x00007FF778411000-memory.dmp

Download

memory/3024-192-0x00007FF776760000-0x00007FF778411000-memory.dmp

Download

memory/3024-206-0x00007FF776760000-0x00007FF778411000-memory.dmp

Download

memory/3024-219-0x00007FF776760000-0x00007FF778411000-memory.dmp

Download

memory/3024-221-0x00007FF776760000-0x00007FF778411000-memory.dmp

Download

memory/5076-11-0x000002669A0F0000-0x000002669A19F000-memory.dmp

Download