Resubmissions
16/05/2026, 17:42
260516-waafyaf17z716/05/2026, 17:39
260516-v8ac6abt2n716/05/2026, 17:35
260516-v6f3xsbs9n716/05/2026, 17:34
260516-v5gcasbs8p7Analysis
- user interaction
yes - max time kernel
46s - max time network
38s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
16/05/2026, 17:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MATCHACRACKED.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
18 signatures
150 seconds
General
- Target MATCHACRACKED.exe
- Size 256KB
- Sample260516-v5gcasbs8p
- SHA256 615d628970c467cb37b5b87fe91ca1dc970f5c56be695c83b2ecd339c4ca7257
- MD5 8d7d6282057ce4ddc490c579a2b5cfa2
- SHA1 4239104bd2b385c3dda8e48a14622164bbfeffce
- SHA512 ab2e6268141aa7c2144f73d6a6592f17f592119bed947df030e95dfc9cc45ffe78d5a02ca26d975c17c0a743e8a982f11ce586966de9a5524cccf5526bff082e
- SSDEEP 3072:URYyGJwDsUAoyV0CdWvH/SdoTSBEegmIWZu1V1XnWO8j9XQIvn5bfIQ7SairKDy:URYfaDsh7W3Sq2n9AoxgrKDK/X4v
- TLSH T1E64419443BF95619F3BF5F79A8B050504AB6F92BAD1AD34D1C8620EC2E31B51EE50B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MATCHACRACKED.exe Key opened \REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MATCHACRACKED.exe Key opened \REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MATCHACRACKED.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com 1 icanhazip.com - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 4660 netsh.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MATCHACRACKED.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MATCHACRACKED.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 perfmon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz perfmon.exe - Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 3848 MATCHACRACKED.exe 3848 MATCHACRACKED.exe 3848 MATCHACRACKED.exe 3848 MATCHACRACKED.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 1800 perfmon.exe 1800 perfmon.exe 2904 taskmgr.exe 2904 taskmgr.exe 1800 perfmon.exe 1800 perfmon.exe 2904 taskmgr.exe 1800 perfmon.exe 2904 taskmgr.exe 1800 perfmon.exe 2904 taskmgr.exe 1800 perfmon.exe 2904 taskmgr.exe 1800 perfmon.exe 2904 taskmgr.exe 1800 perfmon.exe 2904 taskmgr.exe 1800 perfmon.exe 2904 taskmgr.exe 1800 perfmon.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1800 perfmon.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3848 MATCHACRACKED.exe Token: SeDebugPrivilege 3848 MATCHACRACKED.exe Token: SeDebugPrivilege 3848 MATCHACRACKED.exe Token: SeDebugPrivilege 2904 taskmgr.exe Token: SeSystemProfilePrivilege 2904 taskmgr.exe Token: SeCreateGlobalPrivilege 2904 taskmgr.exe Token: SeDebugPrivilege 1800 perfmon.exe Token: SeSystemProfilePrivilege 1800 perfmon.exe Token: SeCreateGlobalPrivilege 1800 perfmon.exe Token: 33 1800 perfmon.exe Token: SeIncBasePriorityPrivilege 1800 perfmon.exe - Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe - Suspicious use of SendNotifyMessage 50 IoCs
pid Process 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3848 wrote to memory of 4316 3848 MATCHACRACKED.exe 81 PID 3848 wrote to memory of 4660 3848 MATCHACRACKED.exe 83 PID 2904 wrote to memory of 2436 2904 taskmgr.exe 87 PID 2436 wrote to memory of 1800 2436 resmon.exe 88 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MATCHACRACKED.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MATCHACRACKED.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MATCHACRACKED.exe"C:\Users\Admin\AppData\Local\Temp\MATCHACRACKED.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3848 -
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\UnixStealerWifiExport_29666fc393c547dd894819bd69ed13dd"2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4316
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4660
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\resmon.exe"C:\Windows\system32\resmon.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\System32\perfmon.exe"C:\Windows\System32\perfmon.exe" /res3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1