549a26874eb9a1ec254d989eb98039d3b86bc90fb66f6f78bb84a814afddafc7

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fo4translator.exe
Size 2.8MB
Sample260505-wy896sds91
SHA256 549a26874eb9a1ec254d989eb98039d3b86bc90fb66f6f78bb84a814afddafc7
MD5 5e7be9a2d398a7be76084b4d098e12a1
SHA1 3a891d4f832b5160bbaba6940930a598c8a5762b
SHA512 f7f9405787134f87d15e5db96d6e7c6fea6d036e109cac44eb6d0c300067e02c034e9b42618648062a966c159bec7ea1262bfb0ccbe33055659b85dc06907d48
SSDEEP 49152:KFxz4wLgW0B2MXHWeGLzCnx7Rt80JjIGr2yXEJmgS/VcEIuFZ:dpW0jWeGLzkx9KAjcyTxK+f
TLSH
T19DD59D0AE65349D5CC6BC0BC838A7131EB357C79CB282EDB17D18B613E55B806729F86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2016	powershell.exe
2016	powershell.exe
1872	powershell.exe
5260	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4200	executavel_temporario.exe
3308	executavel_temporario.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4828	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4828	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	executavel_temporario.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	executavel_temporario.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2016	powershell.exe
2016	powershell.exe
5260	powershell.exe
1872	powershell.exe
5260	powershell.exe
1872	powershell.exe
5260	powershell.exe
1872	powershell.exe
4704	chrome.exe
4704	chrome.exe
944	msedge.exe
944	msedge.exe
1820	chrome.exe
1820	chrome.exe
5436	msedge.exe
5436	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	5260	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4828	4348	fo4translator.exe	79
PID 4828 wrote to memory of 2016	4828	cmd.exe	81
PID 4348 wrote to memory of 4200	4348	fo4translator.exe	82
PID 4348 wrote to memory of 3308	4348	fo4translator.exe	83
PID 4200 wrote to memory of 1872	4200	executavel_temporario.exe	84
PID 3308 wrote to memory of 5260	3308	executavel_temporario.exe	85
PID 4200 wrote to memory of 4704	4200	executavel_temporario.exe	88
PID 4200 wrote to memory of 4704	4200	executavel_temporario.exe	88
PID 4200 wrote to memory of 944	4200	executavel_temporario.exe	89
PID 4200 wrote to memory of 944	4200	executavel_temporario.exe	89
PID 4200 wrote to memory of 728	4200	executavel_temporario.exe	90
PID 4200 wrote to memory of 728	4200	executavel_temporario.exe	90
PID 3308 wrote to memory of 1820	3308	executavel_temporario.exe	91
PID 3308 wrote to memory of 1820	3308	executavel_temporario.exe	91
PID 3308 wrote to memory of 5436	3308	executavel_temporario.exe	92
PID 3308 wrote to memory of 5436	3308	executavel_temporario.exe	92
PID 3308 wrote to memory of 5752	3308	executavel_temporario.exe	93
PID 3308 wrote to memory of 5752	3308	executavel_temporario.exe	93

C:\Users\Admin\AppData\Local\Temp\fo4translator.exe
"C:\Users\Admin\AppData\Local\Temp\fo4translator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\tlelKtZkcM\" ; Add-MpPreference -ExclusionPath \"C:\Users\""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\tlelKtZkcM\" ; Add-MpPreference -ExclusionPath \"C:\Users\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- C:\Users\Admin\AppData\Local\tlelKtZkcM\executavel_temporario.exe
  "C:\Users\Admin\AppData\Local\tlelKtZkcM\executavel_temporario.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "Get-Process | Select-Object Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
    3⤵
    PID:728
- C:\Users\Admin\AppData\Local\tlelKtZkcM\executavel_temporario.exe
  C:\Users\Admin\AppData\Local\tlelKtZkcM\executavel_temporario.exe
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "Get-Process | Select-Object Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
    3⤵
    PID:5752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6599e880fe3e074ceda8864fa78b5084cc05ef9785476e36e8133d0fd02abd8e
MD5 382dba05d77d152f124517ad29adbc0c
SHA1 545209ee4854d40cac9c24d9d1bc0965dc6c75b1
SHA512 9e5428f8d65b22bc77f3bc27dbcd75651e6994e011a0bd7a64f8013f21670a011a22adc64bb3804f99834e2b094dde74cc5b975b1a8398d427051ee58a16f2d1
TLSH
T1DE21A833B7ACC134C8D9017A208DAD01B2B1C3C7449ECECB7B84C508A57F99AEB642A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dgkup3gz.haw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dgkup3gz.haw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

executavel_temporario.exe

Path C:\Users\Admin\AppData\Local\tlelKtZkcM\executavel_temporario.exe
Size 2.5MB
SHA256 d9e831226e13377e3811c0c5ee02ec7ccf0b3a8e6e23e39be39273549a3dd910
MD5 bb7a3a5834abc5f208710bc9f87860d5
SHA1 2127a9574f29a3585367e80ab02c3c2a4fb45781
SHA512 d7d7f686cd54d0c6d69eac1a953113ee7560980cd2f2585451614b771c9a8c6062f774fcc28fd34350b0273b1097798d24bba02c302855ab262855f826a126fd
SSDEEP 49152:BwLgW0B2MXHWeGLzCnx7Rt80JjIGr2yXEJmgS/VcEIuFZ:BpW0jWeGLzkx9KAjcyTxK+f
TLSH
T129C59E0AE15349D5CC5BC0BC838F7131EB357D79CA283D9B17D28B613A95B806729F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1872-59-0x000001B7E1AC0000-0x000001B7E1AD2000-memory.dmp

Download

memory/1872-60-0x000001B7E1AF0000-0x000001B7E1BDA000-memory.dmp

Download

memory/1872-58-0x000001B7E19A0000-0x000001B7E19AC000-memory.dmp

Download

memory/2016-29-0x0000022833670000-0x000002283375A000-memory.dmp

Download

memory/2016-19-0x0000022833DD0000-0x0000022833DEC000-memory.dmp

Download

memory/2016-21-0x0000022833E10000-0x0000022833E2A000-memory.dmp

Download

memory/2016-22-0x0000022833DC0000-0x0000022833DC8000-memory.dmp

Download

memory/2016-23-0x0000022833DF0000-0x0000022833DF6000-memory.dmp

Download

memory/2016-24-0x0000022833E00000-0x0000022833E0A000-memory.dmp

Download

memory/2016-25-0x000002281B5F0000-0x000002281B600000-memory.dmp

Download

memory/2016-28-0x0000022819810000-0x000002281981C000-memory.dmp

Download

memory/2016-0-0x000002281B5F0000-0x000002281B600000-memory.dmp

Download

memory/2016-30-0x000002281B600000-0x000002281B612000-memory.dmp

Download

memory/2016-1-0x0000022833800000-0x0000022833822000-memory.dmp

Download

memory/2016-20-0x0000022833DB0000-0x0000022833DBA000-memory.dmp

Download

memory/2016-18-0x0000022833A80000-0x0000022833A8A000-memory.dmp

Download

memory/2016-17-0x0000022833AA0000-0x0000022833B53000-memory.dmp

Download

memory/2016-9-0x00007FF4C7F00000-0x00007FF4C7F10000-memory.dmp

Download

memory/2016-16-0x0000022833A60000-0x0000022833A7C000-memory.dmp

Download

memory/2016-8-0x000002281B5F0000-0x000002281B600000-memory.dmp

Download

memory/3308-68-0x000002385C770000-0x000002385C85A000-memory.dmp

Download

memory/4200-67-0x0000025E309C0000-0x0000025E30AAA000-memory.dmp

Download

memory/4348-31-0x0000024BF6910000-0x0000024BF69FA000-memory.dmp

Download

memory/4348-66-0x0000024BF6910000-0x0000024BF69FA000-memory.dmp

Download

memory/5260-65-0x000001F195E70000-0x000001F195E82000-memory.dmp

Download

memory/5260-64-0x000001F1ADEA0000-0x000001F1ADF8A000-memory.dmp

Download

memory/5260-63-0x000001F195D60000-0x000001F195D6C000-memory.dmp

Download