4bf27b95dc8d45c83f5b0a2ae17e915ebc9203d0e34671300b4c8d1f8c13aee8

Analysis

max time kernel
149s
max time network
101s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
prykol.exe
Size 213KB
Sample260517-kee2fad13x
SHA256 4bf27b95dc8d45c83f5b0a2ae17e915ebc9203d0e34671300b4c8d1f8c13aee8
MD5 49f3d07ad8fb6c87ff25f84ca152fbc1
SHA1 67c3004e9c1a42d2ee82355b5b0fcc4dd38a42de
SHA512 d98281d09ffdad77f02c525e111bccfa80073110a2d7616b7518a1f058da30d6877b023d7926c76e392a7d45f704164314b762b8eccc64f443c6df6d445b7e80
SSDEEP 3072:Jf0GOPWMo7WMon+KEExnL3yKnPgkFcrWL2q+DyEb2+A1R5XA1dp7mZBv6ozENuCY:Z0GOjFL3yKIkpUtbFJCZzwNSl
TLSH
T1AB245C283AC99D11EABF8DBAE4D460658A7CF1677883F30B51A2C5A61F113D0DD42CB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prykol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2856	netsh.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3836	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1264	prykol.exe
1264	prykol.exe
1264	prykol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	prykol.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2232	1264	prykol.exe	81
PID 2232 wrote to memory of 3836	2232	cmd.exe	83
PID 1264 wrote to memory of 2856	1264	prykol.exe	84

C:\Users\Admin\AppData\Local\Temp\prykol.exe
"C:\Users\Admin\AppData\Local\Temp\prykol.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\0608154208f54e63a1da31928f372eab.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3836
- C:\Windows\SysWOW64\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0608154208f54e63a1da31928f372eab.bat

Path C:\Users\Admin\AppData\Local\Temp\0608154208f54e63a1da31928f372eab.bat
Size 114B
SHA256 22129d4a9538c8d662c0eecfe0b352890e02c985f32b66d2d67732e350aad38c
MD5 54fb035178b9a08b7027cc33ee4c2a68
SHA1 a6fc33e4bfdedb2392c8f02cd6a2e2fa9ec254a6
SHA512 507a34bec4525105f5d1434981ecc6d941663038d30bfafbf8d634899324024a99c88c2f12f59f64aa8a67dc2e07f2427b302d6f464fae1e9225dc612892d346
TLSH
T1CDB01207716B47E5040024F649EF718A51AD54DE6E04E6930292C07F868B03BA95BFC5
MD5 SHA1 SHA512 TLSH

Submit Download

f288885f40d347fcbb9986c7a7c68ddb_gecko

Path C:\Users\Admin\AppData\Local\Temp\f288885f40d347fcbb9986c7a7c68ddb_gecko
Size 288KB
SHA256 57099bae0d034e12a16b781c0e84919c412e1a379f5d248ec69a9b1fc3e047da
MD5 387624ba3c6749e39b4c1f3a3f0312ca
SHA1 c509b8438fc6822be1f02cdd708f35f8abe87a9b
SHA512 2acde7d89aeba9ba8e24330935e6079342556d15a6a86f23939ad11369ef549cb5bcd91f88df4a03240ba5ec9ac580271ebb3555a8b3f7730895b956fabfaf39
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vkTJ9+CR0:f1zkVmvQhyn+Zoz67HTJ9TR0
TLSH
T11B54EB47EE85B50AD70A2830C6454DF37900AB0543815E2BDBFC1E7E1EB264DBAAD6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpF2BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF2BA.tmp
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpF2CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF2CA.tmp
Size 5.0MB
SHA256 93e4193fd8894eb8984cd8b10954cfcbc7a1fe79e4c807980614be9602ebc614
MD5 14455e79ad68ec0c429fabdc53516d7d
SHA1 58815546bbe84c0423b0bb0ad6e26b3d1b873074
SHA512 06f5afa5ac4437c8d153c5faaa3c1444e664a23f606e2f06af70f185512c8f5e8207c1edb998b359f65e6649f574b2c15bf9c819fcc6218314bb00abc6b075f5
SSDEEP 192:M8rJQaXoMXp0VW9FxWH2nsTiSQ229pMZE:M8r54w0VW3xWWzL
TLSH
T16E36211F7A205151C4EAA232BDE35F19183F7116863736933AA4296D4DD0723B9BCCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1264-3-0x0000000004FF0000-0x0000000005002000-memory.dmp

Download

memory/1264-2-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

Download

memory/1264-5-0x0000000005050000-0x0000000005060000-memory.dmp

Download

memory/1264-6-0x0000000005880000-0x00000000058D0000-memory.dmp

Download

memory/1264-0-0x0000000000590000-0x00000000005C8000-memory.dmp

Download

memory/1264-58-0x0000000005C10000-0x0000000005CA2000-memory.dmp

Download

memory/1264-59-0x0000000006260000-0x0000000006806000-memory.dmp

Download

memory/1264-61-0x0000000006810000-0x0000000006876000-memory.dmp

Download

memory/1264-62-0x0000000005050000-0x0000000005060000-memory.dmp

Download