Analysis
- max time kernel
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
17/05/2026, 02:06
General
- Target Invision-UpdatedFn.exe
- Size 326KB
- Sample260517-cjnkdaft3p
- SHA256 110118fe0bb444a36d714cc27e795a0ebee688280332710abc5cfbfc3b337b9f
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invision-UpdatedFn.exe"C:\Users\Admin\AppData\Local\Temp\Invision-UpdatedFn.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Invision-UpdatedFn.exeC:\Users\Admin\AppData\Local\Temp\Invision-UpdatedFn.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Invision-UpdatedFn.exe
memory/2428-37-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/2428-33-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/2428-32-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/2428-31-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/2428-30-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/2428-29-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/2428-28-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/2428-27-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/2428-26-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-15-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-2-0x000000001B310000-0x000000001B352000-memory.dmp
memory/5180-14-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-0-0x00007FFCADF45000-0x00007FFCADF46000-memory.dmp
memory/5180-16-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-17-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-18-0x000000001E100000-0x000000001E410000-memory.dmp
memory/5180-19-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-20-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-21-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-22-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-23-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-24-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-12-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-11-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-9-0x0000000000D20000-0x0000000000D28000-memory.dmp
memory/5180-10-0x000000001C360000-0x000000001C3AC000-memory.dmp
memory/5180-8-0x000000001C100000-0x000000001C19C000-memory.dmp
memory/5180-6-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-7-0x000000001BB60000-0x000000001C02E000-memory.dmp
memory/5180-5-0x000000001B5E0000-0x000000001B686000-memory.dmp
memory/5180-13-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-34-0x000000001D4C0000-0x000000001D522000-memory.dmp
memory/5180-35-0x000000001F030000-0x000000001F054000-memory.dmp
memory/5180-1-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-38-0x00007FFCADF45000-0x00007FFCADF46000-memory.dmp
memory/5180-39-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-40-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-41-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-42-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-43-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-44-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-45-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-46-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-48-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-47-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-50-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-49-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-51-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-52-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-53-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-54-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-55-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp
memory/5180-56-0x00007FFCADC90000-0x00007FFCAE631000-memory.dmp