Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
12/05/2026, 06:29
General
- Target OxeD96lcH.exe
- Size 3.2MB
- Sample260512-g85bmsb13r
- SHA256 f07089eba8e1dedf0e8a3edc0b66d55e418a389c299ea9d94307372684790813
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OxeD96lcH.exe"C:\Users\Admin\AppData\Local\Temp\OxeD96lcH.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exe3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/460-2-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-6-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-4-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-7-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-8-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-9-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-10-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-12-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-125-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-123-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-121-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-119-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-117-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-115-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-113-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-111-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-109-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-107-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-105-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-103-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-101-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-99-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-97-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-95-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-93-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-91-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-89-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-87-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-85-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-83-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-81-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-79-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-77-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-75-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-73-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-71-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-69-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-67-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-65-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-63-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-61-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-59-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-57-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-55-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-53-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-51-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-49-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-47-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-45-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-43-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-41-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-39-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-37-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-35-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-33-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-31-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-29-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-27-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-25-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-23-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-21-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-19-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-17-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-15-0x0000000000400000-0x0000000000451000-memory.dmp
memory/460-13-0x0000000000400000-0x0000000000451000-memory.dmp
memory/2456-1-0x0000000062D40000-0x0000000062E1F000-memory.dmp
memory/2456-5-0x0000000073890000-0x0000000073B4A000-memory.dmp