Analysis
- max time kernel
148s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
08/05/2026, 15:46
General
- Target House of Isabella Seasonal Elegance Campaign.exe
- Size 1.8MB
- Sample260508-s7p14saw5x
- SHA256 1260eed47c7e8200b78673397274e859bd1a3a7abe6ec8c6880dbe5fdccfe068
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies registry class 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\House of Isabella Seasonal Elegance Campaign.exe"C:\Users\Admin\AppData\Local\Temp\House of Isabella Seasonal Elegance Campaign.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\House of Isabella Seasonal Elegance Campaign.docx" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -n 4 127.0.0.1 >nul & taskkill /f /pid 3948 & del /f /q "C:\Users\Admin\AppData\Local\Temp\House of Isabella Seasonal Elegance Campaign.exe" "C:\Users\Admin\AppData\Local\Temp\MSVCR100.dll" "C:\Users\Admin\AppData\Local\Temp\msvcr100_original.dll"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 4 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\taskkill.exetaskkill /f /pid 39483⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Winruntime\Microsoft 365 Business Hub.exe"C:\Users\Admin\AppData\Local\Winruntime\Microsoft 365 Business Hub.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
House of Isabella Seasonal Elegance Campaign.docx
sist02.xsl
Microsoft 365 Business Hub.exe
msvcr100.dll
msvcr100_original.DLL
CUSTOM.DIC
fb3b0dbfee58fac8.customDestinations-ms
memory/2496-18-0x00007FFD3BD30000-0x00007FFD3BD40000-memory.dmp
memory/2496-24-0x00007FFD3BD30000-0x00007FFD3BD40000-memory.dmp
memory/2496-56-0x00007FFD7DD70000-0x00007FFD7DF65000-memory.dmp
memory/2496-59-0x0000018036A70000-0x0000018036B1D000-memory.dmp
memory/2496-10-0x00007FFD3DDF0000-0x00007FFD3DE00000-memory.dmp
memory/2496-13-0x00007FFD7DD70000-0x00007FFD7DF65000-memory.dmp
memory/2496-14-0x00007FFD7DD70000-0x00007FFD7DF65000-memory.dmp
memory/2496-15-0x00007FFD3DDF0000-0x00007FFD3DE00000-memory.dmp
memory/2496-8-0x00007FFD3DDF0000-0x00007FFD3DE00000-memory.dmp
memory/2496-6937-0x00007FFD7DD70000-0x00007FFD7DF65000-memory.dmp
memory/2496-11-0x00007FFD7DE0D000-0x00007FFD7DE0E000-memory.dmp
memory/2496-12-0x00007FFD3DDF0000-0x00007FFD3DE00000-memory.dmp
memory/2496-9-0x00007FFD3DDF0000-0x00007FFD3DE00000-memory.dmp
memory/3948-0-0x00007FF6AA062000-0x00007FF6AA063000-memory.dmp
memory/3948-16-0x00000235F20C0000-0x00000235F216D000-memory.dmp
memory/4252-180-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-152-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-60-0x000001C2FB670000-0x000001C2FB71D000-memory.dmp
memory/4252-40-0x000001C2FAB30000-0x000001C2FAB36000-memory.dmp
memory/4252-76-0x000001C2FBEB0000-0x000001C2FBF86000-memory.dmp
memory/4252-78-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-77-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-80-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-82-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-86-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-88-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-92-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-96-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-104-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-112-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-124-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-142-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-164-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-39-0x000001C2FB720000-0x000001C2FB7EE000-memory.dmp
memory/4252-178-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-176-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-174-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-172-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-170-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-168-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-166-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-162-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-160-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-158-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-156-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-154-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-61-0x000001C2FAAD0000-0x000001C2FAADC000-memory.dmp
memory/4252-150-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-148-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-146-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-144-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-140-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-138-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-136-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-134-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-132-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-130-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-128-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-126-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-122-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-120-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-118-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-116-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-114-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-110-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-108-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-106-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-102-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-100-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-98-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-94-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-90-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-84-0x000001C2FBEB0000-0x000001C2FBF81000-memory.dmp
memory/4252-3228-0x000001C2FBF90000-0x000001C2FC060000-memory.dmp
memory/4252-38-0x000001C2FB610000-0x000001C2FB66A000-memory.dmp
memory/4252-31-0x000001C2FB1A0000-0x000001C2FB210000-memory.dmp