0c4a9d3579485eaf8801e5ac479cd322ee1e7161b54cc24689b891fa82ba0f1e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
audioeq.exe
Size 2.1MB
Sample260502-e3b2sscz5j
SHA256 0c4a9d3579485eaf8801e5ac479cd322ee1e7161b54cc24689b891fa82ba0f1e
MD5 6c98b26c585eb06e969c52dad708a227
SHA1 016616281fbdd9f712cf41323b9df9b803904cdc
SHA512 0f8a154c047a2b239f59badb44563c6bcd74372e1819e0565b3d6fa1fb07e896f6f939e92a366ce6db7ceda2ebf13d5e1dba6aab67263a779bf9a18864123b00
SSDEEP 24576:ZRBeLnWQgsTqsXJzOjwgJs/gsLFtodR+/qFHlFUgewGSkTfeBlRZV:ZRBeDnTq6kwkebc+SxzuwGSZx
TLSH
T1C1A57C39B71082F2E64B81346A05A7C383BB7C7A375170FAA17E12D41E55A7A137E6F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	audioeq.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	audioeq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	audioeq.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	audioeq.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5488	audioeq.exe
5488	audioeq.exe
5488	audioeq.exe
5488	audioeq.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5488 wrote to memory of 1992	5488	audioeq.exe	89
PID 5488 wrote to memory of 4960	5488	audioeq.exe	92

C:\Users\Admin\AppData\Local\Temp\audioeq.exe
"C:\Users\Admin\AppData\Local\Temp\audioeq.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless
  2⤵
  PID:4960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3jUj4tvSx7saW9xT9AOslOLwFTFmY9qn

Path C:\Users\Admin\AppData\Local\Temp\3jUj4tvSx7saW9xT9AOslOLwFTFmY9qn
Size 32B
SHA256 0a987bd9c0979749601d3effa2c4b874f53b8c3becec6e013add3017a4223d49
MD5 cad238516d1e4e01c367d4363ce42e13
SHA1 dd9f13db3be84a59ffe541064a7923ce7d700e14
SHA512 20f00815b98271ea2bc451eb51873cdf9d5e8d0b59ca349978fddb9913d4745550d671f64ccc316cd0fe0ce26e4f9d0e9d6436696015180d43618ee40bd91834
MD5 SHA1 SHA512

Submit Download

XI8gkAKHWJqC6MGo

Path C:\Users\Admin\AppData\Local\Temp\XI8gkAKHWJqC6MGo
Size 578B
SHA256 2fda6833af862c545f946ddbb3a7b60fe7a993a31b0de0d2c71c945234fbde38
MD5 61074775c24b4843ba912fd2611f17e2
SHA1 ea4deb0ae8f432e06725610323e61492331efbf0
SHA512 99f36e02481d8c02db64232fe3f1477d7fbcc3a3568a480285273de616b18ea8d5d5c309dd137855ed095e016537a89f1618d82daa62b8fff811d8dbf4ad5b0e
TLSH
T1DEF041DB42F8823CD4430A341A13CE3A1DD00C64332B2CA26C5619A8D1E638879BCA87
MD5 SHA1 SHA512 TLSH

Submit Download

n8eGzzpjfcaBN3uXi3KWjuZ

Path C:\Users\Admin\AppData\Local\Temp\n8eGzzpjfcaBN3uXi3KWjuZ
Size 640B
SHA256 22e7b63da0cb01a8be2b1c3a303c176132cfe3a6c6c7639650d294a3f21b40ef
MD5 65d34a6568331dd4a59fc549030ecf6b
SHA1 be2b1a8f91776c18515ed8b1d78f62a63b45bf9f
SHA512 434d769414b6d9cf292c55f0e0a43948d6563dc4b20a510439328f9c10bcb3a9cf91ee58b79d5ee3fb6b51a94c6a931a798559122abcc025bd0c89e64d18d93a
TLSH
T14BF0029951699BD8C8260E30608E59BC18E2EC3DD364740CCC0726C5ABB7E43287DB37
MD5 SHA1 SHA512 TLSH

Submit Download

r0yvnqG2k0kQ57cnLGZ2jXnqTOs8

Path C:\Users\Admin\AppData\Local\Temp\r0yvnqG2k0kQ57cnLGZ2jXnqTOs8
Size 32B
SHA256 c47821c43ca734c5e64eaeb1dfda40942d8312430f2ebff394d9f1eda71a710e
MD5 0b07276882be287abfe4a72ef7562246
SHA1 a294628b4b726f24b94937662f6dbe334f46c452
SHA512 11db8db0cc913df24ba92f0c388b98c49c6d05363a3fff1806b0d8c7f8e2239ed871de48221bd88e634fef5d7cd55617b09eb606b28ae749cfa62ac1f70ce1a5
MD5 SHA1 SHA512

Submit Download

memory/4072-11-0x00000185FB730000-0x00000185FB7D9000-memory.dmp

Download

memory/5096-19-0x0000026244AB0000-0x0000026244B59000-memory.dmp

Download

memory/5464-17-0x0000023767660000-0x0000023767709000-memory.dmp

Download

memory/5488-0-0x0000000140000000-0x00000001400C0000-memory.dmp

Download

memory/5488-7-0x00000209780C0000-0x000002097816C000-memory.dmp

Download

memory/5488-26-0x00000209780C0000-0x000002097816C000-memory.dmp

Download

memory/5712-13-0x0000015C80720000-0x0000015C807C9000-memory.dmp

Download