Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 15:46
General
- Target House of Isabella Seasonal Elegance Campaign.exe
- Size 1.8MB
- Sample260508-s7p14saw5x
- SHA256 1260eed47c7e8200b78673397274e859bd1a3a7abe6ec8c6880dbe5fdccfe068
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies registry class 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\House of Isabella Seasonal Elegance Campaign.exe"C:\Users\Admin\AppData\Local\Temp\House of Isabella Seasonal Elegance Campaign.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\House of Isabella Seasonal Elegance Campaign.docx" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -n 4 127.0.0.1 >nul & taskkill /f /pid 3664 & del /f /q "C:\Users\Admin\AppData\Local\Temp\House of Isabella Seasonal Elegance Campaign.exe" "C:\Users\Admin\AppData\Local\Temp\MSVCR100.dll" "C:\Users\Admin\AppData\Local\Temp\msvcr100_original.dll"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 4 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\taskkill.exetaskkill /f /pid 36643⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Winruntime\Microsoft 365 Business Hub.exe"C:\Users\Admin\AppData\Local\Winruntime\Microsoft 365 Business Hub.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
House of Isabella Seasonal Elegance Campaign.docx
gb.xsl
Microsoft 365 Business Hub.exe
msvcr100.dll
msvcr100_original.dll
CUSTOM.DIC
ExcludeDictionaryEN0409.lex
fb3b0dbfee58fac8.customDestinations-ms
memory/3664-0-0x00007FF773472000-0x00007FF773473000-memory.dmp
memory/4864-16-0x00007FFC81900000-0x00007FFC81B09000-memory.dmp
memory/4864-15-0x00007FFC81900000-0x00007FFC81B09000-memory.dmp
memory/4864-17-0x00007FFC81900000-0x00007FFC81B09000-memory.dmp
memory/4864-11-0x00007FFC819A4000-0x00007FFC819A5000-memory.dmp
memory/4864-21-0x00007FFC3F030000-0x00007FFC3F040000-memory.dmp
memory/4864-19-0x00007FFC81900000-0x00007FFC81B09000-memory.dmp
memory/4864-18-0x00007FFC81900000-0x00007FFC81B09000-memory.dmp
memory/4864-10-0x00007FFC41990000-0x00007FFC419A0000-memory.dmp
memory/4864-14-0x00007FFC81900000-0x00007FFC81B09000-memory.dmp
memory/4864-13-0x00007FFC41990000-0x00007FFC419A0000-memory.dmp
memory/4864-27-0x00007FFC3F030000-0x00007FFC3F040000-memory.dmp
memory/4864-6648-0x00007FFC81900000-0x00007FFC81B09000-memory.dmp
memory/4864-12-0x00007FFC41990000-0x00007FFC419A0000-memory.dmp
memory/4864-8-0x00007FFC41990000-0x00007FFC419A0000-memory.dmp
memory/4864-9-0x00007FFC41990000-0x00007FFC419A0000-memory.dmp
memory/4864-62-0x00007FFC81900000-0x00007FFC81B09000-memory.dmp
memory/5072-516-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-584-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-65-0x0000025788940000-0x00000257889E3000-memory.dmp
memory/5072-46-0x0000025788BE0000-0x0000025788BE6000-memory.dmp
memory/5072-36-0x00000257A1690000-0x00000257A175E000-memory.dmp
memory/5072-488-0x0000025788940000-0x00000257889E3000-memory.dmp
memory/5072-490-0x0000025788940000-0x00000257889E3000-memory.dmp
memory/5072-492-0x00000257A1E90000-0x00000257A1F60000-memory.dmp
memory/5072-494-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-493-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-496-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-498-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-500-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-502-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-504-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-508-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-512-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-35-0x00000257A1410000-0x00000257A146A000-memory.dmp
memory/5072-520-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-526-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-534-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-542-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-552-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-564-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-578-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-596-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-594-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-592-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-590-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-588-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-586-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-66-0x0000025788CE0000-0x0000025788CF2000-memory.dmp
memory/5072-582-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-580-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-576-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-574-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-572-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-570-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-568-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-566-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-562-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-560-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-558-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-556-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-554-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-550-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-548-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-546-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-544-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-540-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-538-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-536-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-532-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-530-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-528-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-524-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-522-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-518-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-514-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-510-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-506-0x00000257A1E90000-0x00000257A1F5A000-memory.dmp
memory/5072-28-0x0000025788C10000-0x0000025788C80000-memory.dmp