Analysis
- user interaction
yes - max time kernel
300s - max time network
204s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 11:46
General
- Target Cheat (Russian Fishing 4).exe
- Size 4.7MB
- Sample260511-nxeeeabz8k
- SHA256 906d822ab1f014f7b3cfa7a35564a524fb02149a1f692b245cf9c7f1b7882a2b
Malware Config
Signatures
- Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 3 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cheat (Russian Fishing 4).exe"C:\Users\Admin\AppData\Local\Temp\Cheat (Russian Fishing 4).exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ObesLock.exe"C:\Users\Admin\AppData\Local\Temp\ObesLock.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\C+.exe"C:\Users\Admin\AppData\Local\Temp\C+.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\UnixStealerWifiExport_60b6387150ff4e8d86da5b211230b458"3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\ObesLock.exeC:\Users\Admin\AppData\Local\Temp\ObesLock.exe1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
C+.exe
ObesLock.exe
obesity_music.mp3
wallpaper_temp.bmp
ObesityLocker.bat
t.me_euxaodev_240659359_4.txt
memory/536-440-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-7489-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-9821-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-9419-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-9027-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-10615-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-4363-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-5157-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-80-0x00000135ACE50000-0x00000135ACE60000-memory.dmp
memory/536-93-0x00000135ACE50000-0x00000135ACE60000-memory.dmp
memory/536-92-0x00000135ACE50000-0x00000135ACE60000-memory.dmp
memory/536-91-0x00000135ACE50000-0x00000135ACE60000-memory.dmp
memory/536-104-0x00000135ACE50000-0x00000135ACE60000-memory.dmp
memory/536-8635-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-4765-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-8273-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-832-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-7881-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-1224-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-10213-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-1616-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-3971-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-5509-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-7087-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-2041-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-6695-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-2393-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-6303-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-2785-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-3579-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-3177-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/536-5911-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/1508-0-0x0000000000070000-0x0000000000520000-memory.dmp
memory/1508-1-0x000000001B310000-0x000000001B320000-memory.dmp
memory/2696-1788-0x0000027BE8AC0000-0x0000027BE8AD2000-memory.dmp
memory/2696-1667-0x0000027BEA9E0000-0x0000027BEAA30000-memory.dmp
memory/2696-22-0x0000027BCE340000-0x0000027BCE384000-memory.dmp
memory/4400-3106-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-4644-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-5036-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-4252-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-5428-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-3850-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-5830-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-3498-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-6222-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-2714-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-6614-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-2312-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-6976-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-1920-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-7368-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-1495-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-7760-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-1143-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-8152-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-751-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-8554-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-359-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-8946-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-40-0x0000010D02CC0000-0x0000010D02CD0000-memory.dmp
memory/4400-9308-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-38-0x0000010D02CC0000-0x0000010D02CD0000-memory.dmp
memory/4400-9700-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-37-0x0000010D02CC0000-0x0000010D02CD0000-memory.dmp
memory/4400-10092-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-39-0x0000010D02CC0000-0x0000010D02CD0000-memory.dmp
memory/4400-10494-0x00007FF7C6FA0000-0x00007FF7C74EF000-memory.dmp
memory/4400-36-0x0000010D02CC0000-0x0000010D02CD0000-memory.dmp