eb213336162535fe63cd8870d11cf0341b6c9b365cc2e50e7267596e30c6e8c6

Analysis

max time kernel
149s
max time network
118s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PROGRAMFILES/Toggle Downloader/Toggle Downloader Zuma Deluxe/$PROGRAMFILES/Toggle Downloader/Toggle.exe
Size 863KB
Sample260421-mcap2sfx6v
SHA256 eb213336162535fe63cd8870d11cf0341b6c9b365cc2e50e7267596e30c6e8c6
MD5 27ecbaf65445d559b5fe36fc9db2fb4f
SHA1 3a121e2f920406c91d5293e090ba63b49d81cf55
SHA512 1ac383eb6b77f489d329928388974cab5c5376860fcb48e6ed0a09d08e7cc2a2663b961e66165b397763a3127e67716a04bcb8bbd69e0318403b9caa2e098264
SSDEEP 12288:hCzd7N7otPKnsvAH6x0GbQP3XoIq5tLgVHkCAQlvtrN:hCzFvnsm6iGbQ/oIKikelvj
TLSH
T17F158D07D50740F2CC6705B81347E37F8E3096215834CB4AE788AE6DA9FB99AA72D357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery installer spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1304	Au_.exe

Loads dropped DLL 15 IoCs

pid	Process
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Toggle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral22/files/0x001f00000002b162-3.dat	nsis_installer_1
behavioral22/files/0x001f00000002b162-3.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope	Au_.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\SearchScopes	Au_.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\SearchScopes	Au_.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe
1304	Au_.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1304	Au_.exe
1304	Au_.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1304	2388	Toggle.exe	80

C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Zuma Deluxe\$PROGRAMFILES\Toggle Downloader\Toggle.exe
"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Zuma Deluxe\$PROGRAMFILES\Toggle Downloader\Toggle.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Zuma Deluxe\$PROGRAMFILES\Toggle Downloader\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Web Data

Path C:\Users\Admin\AppData\Local\Temp\Web Data
Size 138KB
SHA256 a58c4279f5c1f3166e39b966446f0336ecf1de7e0ba1a711429b5fe8415111f6
MD5 cc9ce531c902cbcaf88e32742ae4a3fa
SHA1 07227dedeb8fc07315b7b61aae8f38069a00a891
SHA512 b6c930358b9942a3d3ff0aa63b5f1cff3cf17c94b53a74e5eefb5fe5b26d07fb85b2a840c062adddffd4b13d6a16639b7f9b2a35ac710840c4b6ba01bfac819d
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OzDfjVumJnSjG:FnbZeMrv/hGtz7ZnSy
TLSH
T17CD3854B3A747002EDE59A7258E050BB4E3CB16D8F15A5D5387620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nss1847.tmp\FindProcDLL.dll
Size 31KB
SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
MD5 83cd62eab980e3d64c131799608c8371
SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
TLSH
T140E25A2128D144F7C68F4134A4E44F178A7E69752AE614D3DF65A9CA2E229F2F23B307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nss1847.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nss1847.tmp\NSISdl.dll
Size 14KB
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
TLSH
T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nss1847.tmp\ioSpecial.ini
Size 572B
SHA256 f659ca0886a6760e0be6b29ccdb79112c504245049e117d94f42b41de4847fd2
MD5 7eebd21712d98e0a49bf738a5c7df3b5
SHA1 592208f5f42593ae96fa497c3f3a2ad306a839a0
SHA512 6bc90a9711d7a36ebec98f774d6c67ed16525bc290ff65332e4320427b181670439644f7e9f198f46f2818626d36bb7c6cbdb32c1bc55ceb05d196db90b33011
TLSH
T13BF08BC9941A426B082491A669FA3A9123D00D248B0636B5F5728C4BD78DDD1D9ED593
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nss1847.tmp\ioSpecial.ini
Size 610B
SHA256 97c69527cc3fed0709a6b8e202c9bb36b8b6d3523ad33f871e94d842b607cfd8
MD5 d8db7bc05f7fc2899c3a14f724303cea
SHA1 b4f5a33f76d8bf787cd02741c2ce5cca5f7e19d0
SHA512 8dc44cd18b1c43db684a369b75bca5d09f8640e69acb132af310fae835a8b651d15a15329a88aee6c635b130ddba4e787e296350148a9e3a3add768fd0d82448
TLSH
T12AF0A2CAD41AC3350C10457A54EE3B9523D01D244B1239F5F8724C4797CDCE2DADE9A3
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nss1847.tmp\ioSpecial.ini
Size 572B
SHA256 7a0ec6cd8bc39a07d8f3bc01da58a083f8facf6c5256e553aebd07bf7eda3358
MD5 e7093731262fd1c67a645acba0f75512
SHA1 ef52fe46071c7074afa19dee4ddee01d6669c972
SHA512 417617dfa363965459280d3c2f33ef8b40f5da19efe980f4af13c05cff29fb72f93fade290b462d7599efa4955ce6f2caec6b8cfec4210aa87afd6ff8684640a
TLSH
T19BF08BC9951E426A4828859669FA3A9113C00E348B0526B4F5724C4BD78DDD1D9ED5A3
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nss1847.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
TLSH
T19BD1E73D75C33DB3C54ACA762C65292B0FB8C9261B5402119B6716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 863KB
SHA256 eb213336162535fe63cd8870d11cf0341b6c9b365cc2e50e7267596e30c6e8c6
MD5 27ecbaf65445d559b5fe36fc9db2fb4f
SHA1 3a121e2f920406c91d5293e090ba63b49d81cf55
SHA512 1ac383eb6b77f489d329928388974cab5c5376860fcb48e6ed0a09d08e7cc2a2663b961e66165b397763a3127e67716a04bcb8bbd69e0318403b9caa2e098264
SSDEEP 12288:hCzd7N7otPKnsvAH6x0GbQP3XoIq5tLgVHkCAQlvtrN:hCzFvnsm6iGbQ/oIKikelvj
TLSH
T17F158D07D50740F2CC6705B81347E37F8E3096215834CB4AE788AE6DA9FB99AA72D357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1304-84-0x00000000009D0000-0x0000000000B1D000-memory.dmp

Download

memory/1304-118-0x0000000006470000-0x000000000647B000-memory.dmp

Download

memory/1304-131-0x0000000004670000-0x000000000467B000-memory.dmp

Download

memory/1304-206-0x00000000009D0000-0x0000000000B1D000-memory.dmp

Download

memory/1304-215-0x00000000009D0000-0x0000000000B1D000-memory.dmp

Download

memory/2388-5-0x0000000000890000-0x00000000009DD000-memory.dmp

Download