Analysis
- max time kernel
150s - max time network
112s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
29/04/2026, 16:52
General
- Target sunwukongs.exe
- Size 1.4MB
- Sample260429-vdlspsdx81
- SHA256 8bbd5525d11b0aeecd5d9bc385c080cf2fd1b4a6aba76caf62b16426a0840ba2
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sunwukongs.exe"C:\Users\Admin\AppData\Local\Temp\sunwukongs.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& { try { Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\TCDF1E3.tmp\2026-04-29 17.52.39\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\TCDF1E3.tmp\2026-04-29 17.52.39\result.zip' -Force -ErrorAction Stop; exit 0 } catch { exit 1 } }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\2026-04-29 17.53.06\2026-04-29 17.53.06.exe"C:\Users\Admin\AppData\Local\Comms\UnistoreDB\2026-04-29 17.53.06\2026-04-29 17.53.06.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\tu6up-px71c-fnp\0eWwfjJD.exeC:\Users\Admin\AppData\Roaming\tu6up-px71c-fnp\0eWwfjJD.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-04-29 17.53.06.exe
Cookies
History
Login Data
Top Sites
Web Data
Cookies
000003.log
CURRENT
LOG
LOG.old
MANIFEST-000001
History
Login Data
Top Sites
Web Data
cert9.db
cookies.sqlite
key4.db
SystemInfo.txt
V10.txt
V20.txt
monitor_0_1777481559286.png
result.zip
__PSScriptPolicyTest_cwzalzfw.ivw.ps1
memory/1064-24-0x000001DC86CB0000-0x000001DC86CB3000-memory.dmp
memory/3152-244-0x0000028442390000-0x00000284423B2000-memory.dmp
memory/3152-261-0x0000028442620000-0x000002844262A000-memory.dmp
memory/3152-260-0x0000028442700000-0x0000028442712000-memory.dmp
memory/3152-259-0x0000028442700000-0x000002844270A000-memory.dmp
memory/3152-258-0x0000028442640000-0x00000284426F3000-memory.dmp
memory/3152-257-0x0000028442620000-0x000002844263C000-memory.dmp
memory/4256-26-0x00000125285A0000-0x000001252873A000-memory.dmp
memory/4604-46-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-70-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-82-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-86-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-87-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-85-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-84-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-83-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-102-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-104-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-105-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-101-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-100-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-98-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-97-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-81-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-80-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-79-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-118-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-123-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-121-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-120-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-119-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-117-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-116-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-114-0x0000023565AD0000-0x0000023565C6A000-memory.dmp
memory/4604-115-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-132-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-135-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-134-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-133-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-62-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-74-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-75-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-76-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-72-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-71-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-40-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-42-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-44-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-45-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-10-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-49-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-47-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-43-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-37-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-27-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-0-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-9-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-11-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-12-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-14-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-15-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-16-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-17-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-18-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-19-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-20-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-21-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-13-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/4604-22-0x0000000140000000-0x00000001400FD000-memory.dmp
memory/6072-25-0x000001DAC17C0000-0x000001DAC195A000-memory.dmp