Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 16:03
General
- Target _b853fbacafd465e1d80acc0c5c43c2b3ab8fef3ec5e3c34ef7802a3616aec23f.exe
- Size 4.8MB
- Sample260506-thdr8aas6r
- SHA256 b853fbacafd465e1d80acc0c5c43c2b3ab8fef3ec5e3c34ef7802a3616aec23f
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_b853fbacafd465e1d80acc0c5c43c2b3ab8fef3ec5e3c34ef7802a3616aec23f.exe"C:\Users\Admin\AppData\Local\Temp\_b853fbacafd465e1d80acc0c5c43c2b3ab8fef3ec5e3c34ef7802a3616aec23f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\54250a0c9c74449184e07df126822583\EdgeComponent.exe"C:\Users\Admin\AppData\Local\Temp\54250a0c9c74449184e07df126822583\EdgeComponent.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Edge\Update\GoogleUpdate.exeC:\Users\Admin\AppData\Roaming\Microsoft\Edge\Update\GoogleUpdate.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
EdgeComponent.exe
memory/1600-36-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-46-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-47-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-48-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-35-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-37-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-38-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-39-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-40-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-41-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-42-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-43-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-44-0x0000000140000000-0x0000000140065000-memory.dmp
memory/1600-45-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-52-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-53-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-54-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-51-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-55-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-56-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-57-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-58-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-59-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-61-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-62-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-60-0x0000000140000000-0x0000000140065000-memory.dmp
memory/3560-63-0x0000000140000000-0x0000000140065000-memory.dmp
memory/4812-15-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-14-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-11-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-10-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-8-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-9-0x00000000000D0000-0x00000000000E9000-memory.dmp
memory/4812-7-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-6-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-0-0x0000000140000000-0x000000014002D000-memory.dmp
memory/4812-5-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-4-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-12-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-13-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-2-0x0000021C7D2C0000-0x0000021C7D2EC000-memory.dmp
memory/4812-16-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-3-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-31-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-1-0x00007FF87A7D5000-0x00007FF87A7D6000-memory.dmp
memory/4812-21-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-20-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-19-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-18-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp
memory/4812-17-0x00007FF87A520000-0x00007FF87AEC1000-memory.dmp