37ad26437bb260ee96284eec82cc58f4489adf5178841c0585ea953c93353e85

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
roma.exe
Size 16KB
Sample260503-edndjaez2n
SHA256 37ad26437bb260ee96284eec82cc58f4489adf5178841c0585ea953c93353e85
MD5 168d4e89f3a487ce3c18a95aa950b69a
SHA1 8445d133d916fef9b90d62bf1d8854199a8aa367
SHA512 1a3bc17e0521e0e2486255a0e25bf59b7afcedef8e1a005bc651696a795652fae2abcd0b5e7b560cc31ed647063ed131c5858638da2e1d852a23a32e9e34574b
SSDEEP 192:ZK9syb7v5V/TJyi3sauf0Ua/1OnjdajbvOuSJdrMtw3pDs3yO:k9hzP4i3sDfb/c3gdrhpQiO
TLSH
T17572F9063A4308DDED3AC1BA99265935F531F62107756AFB0362A2711EE4FF02F3A4C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Renames multiple (535) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

C:\Users\Admin\AppData\Local\Temp\roma.exe
"C:\Users\Admin\AppData\Local\Temp\roma.exe"
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3561288849sdhlie.sqlite.00CD0430

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.00CD0430
Size 48KB
SHA256 f40b2af17ad549a3a649c97a26bb40390020bfb5f8960f6a32d28cf222d0bd13
MD5 69f239239df321569fa92a05af23c536
SHA1 2cb6fcb648d6b774bc4a809d4e02ef5177fc0e4f
SHA512 82e8c0f7c8c8f0182dc6a24f09f6693286cb57e8c3a52ae19999926f50c4a46f413ec2c200ccbb8bd114b9632f431093906411ea780250df52a2c84d0047bdf6
SSDEEP 48:Pl5iaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEbAy:dUa16S6CKnqlizbxV+2xVeU7X2B0bAy
TLSH
T10223608E3F07A511C53AF0B1B8A08D51FC5E311D07222AD669D0DAE4C9F211AED5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-537-0x00000155B23C0000-0x00000155B23CC000-memory.dmp

Download