24336a3c69f863981df13cc9c2cc8fe002d642962fc1d12c87062a8e5d273889

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sub_24336a3c69f8.exe
Size 267KB
Sample260524-b59jashx2v
SHA256 24336a3c69f863981df13cc9c2cc8fe002d642962fc1d12c87062a8e5d273889
MD5 ce49df0ba4bddeb9ad1380a5b7e9331b
SHA1 36ccbc79c8bae4db35e280761a1d70aa56098295
SHA512 f3feba078a35b90405eef83771d68a11fce43e35446d97835ad0f0ddc5f7bb7a1dc9ca4364d1d9320c96606b86e646561eda637cf3c4f24c005d21b81011ff52
SSDEEP 6144:gWMjIwAafnNLPJWvVsybC2DTTvmp7gC4skNlu4MsKIwax:gWMjIwRfnNTJWvVs/2D/vmpwskNlu4Mo
TLSH
T177444C017990C131E77196322A799F7185FE7D389E7062CFA7800F39DA316D2A925F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sub_24336a3c69f8.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sub_24336a3c69f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sub_24336a3c69f8.exe

C:\Users\Admin\AppData\Local\Temp\sub_24336a3c69f8.exe
"C:\Users\Admin\AppData\Local\Temp\sub_24336a3c69f8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KIDdfyVBEFmPl.zip

Path C:\Users\Admin\AppData\Local\Temp\vIlicwVMfRWv\KIDdfyVBEFmPl.zip
Size 387KB
SHA256 ce404fef52236d409922d71d87d428b0f362c95d9ad72ca68e8428e3ada74842
MD5 6abdc256931ec3e9241aff1a44c578e1
SHA1 a7d5583ad953302ae01dbf7403032dc773a9b0b2
SHA512 dfbd84600f6fc373a62578b99485abe18de4b830f713b6073525fe9dcc99b13deca4c4c1b38b0984166fc6cbef8992c325b69cb176a6927cd71eacf4dda6f252
SSDEEP 12288:8C2dtyG8HIVr0GRfuSSO7/TE9aWlI/vEF:8C2tqHIVr0Yxj/YQWlKEF
TLSH
T141842347EAC7D1C3C739EF6A56470094BE8688DA0526A31A0807D5D63CD7FAA3187C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectResume.txt

Path C:\Users\Admin\AppData\Local\Temp\vIlicwVMfRWv\_Files\_Files\DisconnectResume.txt
Size 376KB
SHA256 29a5dc16195baf66c8f5f88238d2329d795f39982a57e9fe8bd2360721f5c33c
MD5 910d88649a5f39d23a2a6a21cfa4db61
SHA1 01963d96e1d8125d20b653aaa666972290398e82
SHA512 cbf6b36d19c54ff714ad826d47478fbadf6404b8a5bd81b92f40d7e752040f57911983f677208887fc7b5a3f82e9cec046455ffe3c1398ae9cf131320679b72c
SSDEEP 6144:EQbo3KsqHhxnYfCczSaRKVdndPQHrJpaDN1rhOfNWwozAfpunaabxfXN46wcDi9i:EQc6sASlzS0q6LJpaD/hO17Zulz46wCv
TLSH
T1478423955C97F4DD18284F8403E0376FEA6A0DEA7E6803B6D12E161F31CDEEA5CA9508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\vIlicwVMfRWv\_Files\_Information.txt
Size 4KB
SHA256 3d33c268543c1d51e01fe3e9b58a9efcdb8f530274cd9fb905d69606bc92b50d
MD5 42074470cb8d93d34f5e813ab9d632ad
SHA1 5ef7e9f20fa3465982343b4ae92ea154d8aefb4f
SHA512 896772eddaa9cad83d77553ecd2f37660dc6e30e9607fdd1645617ecf754378013d541ebeebdfbdbc60f8889751879014a6629cf55aba9a0b99c8bea6a118df1
SSDEEP 48:sxzXteXxBaMXehGYTwTCuDQeDe7iGqXpF88be7HHcBOmjmcn+jYyrJB4McdZAaNq:s1XteBRn3QyDDMHcVmcnmB4McqX
TLSH
T1129157191BE44705E5B2EB10ADF14823B67B7855EC74CB4D01EC620E87A7D22A864FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads