Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
17/05/2026, 01:54
General
- Target Invision-UpdatedFn.exe
- Size 326KB
- Sample260517-cbnkeabw91
- SHA256 110118fe0bb444a36d714cc27e795a0ebee688280332710abc5cfbfc3b337b9f
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invision-UpdatedFn.exe"C:\Users\Admin\AppData\Local\Temp\Invision-UpdatedFn.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Invision-UpdatedFn.exeC:\Users\Admin\AppData\Local\Temp\Invision-UpdatedFn.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Invision-UpdatedFn.exe
memory/1004-42-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-51-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-5-0x000000001BFC0000-0x000000001C066000-memory.dmp
memory/1004-6-0x000000001C540000-0x000000001CA0E000-memory.dmp
memory/1004-7-0x000000001CB20000-0x000000001CBBC000-memory.dmp
memory/1004-9-0x0000000000E00000-0x0000000000E08000-memory.dmp
memory/1004-8-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-10-0x000000001CD80000-0x000000001CDCC000-memory.dmp
memory/1004-11-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-12-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-13-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-14-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-15-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-16-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-17-0x000000001EA60000-0x000000001ED70000-memory.dmp
memory/1004-18-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-19-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-20-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-21-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-1-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-56-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-55-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-54-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-53-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-52-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-50-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-2-0x000000001BD40000-0x000000001BD82000-memory.dmp
memory/1004-49-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-48-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-47-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-33-0x000000001E0B0000-0x000000001E112000-memory.dmp
memory/1004-46-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-35-0x000000001D570000-0x000000001D594000-memory.dmp
memory/1004-45-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-38-0x00007FF95B0D5000-0x00007FF95B0D6000-memory.dmp
memory/1004-39-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-40-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-41-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-0-0x00007FF95B0D5000-0x00007FF95B0D6000-memory.dmp
memory/1004-43-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/1004-44-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-37-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-34-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-32-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-24-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-29-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-28-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-30-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-26-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-27-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-25-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-31-0x00007FF95AE20000-0x00007FF95B7C1000-memory.dmp
memory/4528-23-0x000000001BD30000-0x000000001BD72000-memory.dmp