observer | 9ac629ed8e07b6c99b05edd46b86e1795e5f96908ab1fe85a06282b0a982cd1b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sub_9ac629ed8e07.exe
Size 1.1MB
Sample260524-ccvecaey7l
SHA256 9ac629ed8e07b6c99b05edd46b86e1795e5f96908ab1fe85a06282b0a982cd1b
MD5 20017810fba85ef8ac6e4230d0e67a07
SHA1 d7b6530a4c7d685e9ee6765231bab14fecdadeba
SHA512 87e59608b4c13d17279c9d39098564caa4b19419d02c952d754dec02c234f3614c7ab8d5d3153bf7feaea4d42b0b22f2deacc33845a991cdb4e37923c7e99706
SSDEEP 24576:Tus8z4ChDlxLRa9LCdaj3zv6joREW7+3Is6oW:CsOZI5Cd2somQ2IsA
TLSH
T1E1351261BDA0807BD27746305CECBA7156FDEA2213B2820BBB4C26551F706E2D76C367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery observer stealer

Malware Config

Signatures

Family: Observer
Observer is an infostealer written in C++.
stealer observer

Executes dropped EXE 1 IoCs

pid	Process
3744	Rebecca.pif

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2972	tasklist.exe
4532	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rebecca.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sub_9ac629ed8e07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4668	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4668	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3744	Rebecca.pif
3744	Rebecca.pif
3744	Rebecca.pif
3744	Rebecca.pif
3744	Rebecca.pif
3744	Rebecca.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	tasklist.exe
Token: SeDebugPrivilege	4532	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3744	Rebecca.pif
3744	Rebecca.pif
3744	Rebecca.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3744	Rebecca.pif
3744	Rebecca.pif
3744	Rebecca.pif

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4752	4308	sub_9ac629ed8e07.exe	81
PID 4752 wrote to memory of 2972	4752	cmd.exe	83
PID 4752 wrote to memory of 4944	4752	cmd.exe	84
PID 4752 wrote to memory of 4532	4752	cmd.exe	86
PID 4752 wrote to memory of 3896	4752	cmd.exe	87
PID 4752 wrote to memory of 3192	4752	cmd.exe	88
PID 4752 wrote to memory of 3944	4752	cmd.exe	89
PID 4752 wrote to memory of 4580	4752	cmd.exe	90
PID 4752 wrote to memory of 3744	4752	cmd.exe	91
PID 4752 wrote to memory of 4668	4752	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\sub_9ac629ed8e07.exe
"C:\Users\Admin\AppData\Local\Temp\sub_9ac629ed8e07.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k move Bathrooms Bathrooms.bat & Bathrooms.bat & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4944
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3896
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 13263
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Compound + Injection + Emotions + Worm 13263\Rebecca.pif
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Slut + Venice + Venezuela 13263\m
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13263\Rebecca.pif
    13263\Rebecca.pif 13263\m
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3744
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rebecca.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13263\Rebecca.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
TLSH
T109158C0333918062FE97A5335F5FE7265B7C6D2A0323B52F13981E79BA701B1162E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13263\m
Size 967KB
SHA256 93318ad8df70e9e6200d0e1c069108f16574d4a820d1090030fbedf87c273a2d
MD5 43ac4388bafbdabd013d8ed26e09d750
SHA1 33b30a74a06ab4fa1e58fb54c4e02537dfcccb25
SHA512 7668a6c8e306699fb87005ba9dde472affd6c4ddc3a602536d9c1ec692a5fa56206116588b37188b35c3782072ccd150976218d9abef7d3b8a6dc21d05e5e847
SSDEEP 12288:gY55WhL54HhICbICCOIKrkLpDnfiDp2x8OyeGgD/F2SqfImkr/a2Su3dFwg:F55W9m2RyybFIfIprC1u3fR
TLSH
T142259ED4726685D64F8F6BF23C64C9C33A1047A9873F05581EBB0A850D37AADCA6CCD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bathrooms

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bathrooms
Size 12KB
SHA256 9bc77c757b4cf7bef137de7f683d617f0167e96e28af69243a6cb09de3430316
MD5 a2bbeaa09b707732d1be7e79e5d1e2c8
SHA1 7961d61792f64c90a1f57897f4fa05bc6ee87ad0
SHA512 1e0524924f7ba600f716dd7fc6c17f07a5fb900a3536381f5275b0a79a280ef104f0ee368f5e3062de0cd0cbf356d44162d0b6f29d16d0a7cc81f28958f7ab06
SSDEEP 384:zaL/dtbJFmK6nu/8gZt8i3I5+srok3I5sQRv:zaLurLF4
TLSH
T10242D54272658844409F961DB68D2817F334F3EEA868395D3D18AD2ED3DF0F999B2D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Compound

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Compound
Size 237KB
SHA256 077d21634f2796a75d6c9b005032033ab5eabd44337ded7235428d4d6f832972
MD5 d3bd9960496e7a4a6eb93b84c164df89
SHA1 387c79e0739491633e8b61e5bcabba5cf2220cd5
SHA512 df1b15ec0094e8e696fd7a1e928929df005a82d8bdecbd4add730dee880bd21842b3170413d6aa46eb67e8e28f2adc6c0dd47ca3a658a73efe6a0af5ad916d48
SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4mqE:LO0z8e0lvSr0Wyw20K4mqE
TLSH
T1EB349E11B881F1B1C51E1C300F65EA629E7CAE76032969CBA7E81D364F748C36736F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Emotions

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Emotions
Size 255KB
SHA256 3a9166f529aa8cb97e4645188e2240b6e8118c7556579513cdc29512aa069162
MD5 e3f2e5889ccb3b3e3aba305867d6de57
SHA1 c7798641a2cfebb8f2eabfcf581ef3ca27499732
SHA512 8a0e659a09ef0e4518c811ce1843053d6003fcc99b91050de207869dd642d784fb68ea0718ae4f29dda5b958b4c1689f1768d8c7ca09c5916a9c9629661228f9
SSDEEP 6144:psvqJX4xNAB+xHFq9O0lHPOGUWLhxjRYmFqZvEAOz04pD:SvqJWNAB+X0lHPOGNnlMZce4R
TLSH
T1A8447C1376D340A3DD7323B18EACF626E36E6A260122FB3F139D0999BED05115D661B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Injection

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Injection
Size 209KB
SHA256 b7c5141621f3ae32e86185aaa58b1ec8faf4b71a961b4355519fc4544deb1797
MD5 32a250b658b196b1918fc7a467a779c7
SHA1 2a89ffdfe842a8cdfe91903001872a58097a2f5b
SHA512 a05f9f335549d7a0597a8066f25e6e3507b8c8331a12b7adff58c9e1b3db2470b12e23b4c2773d7dfcb7b0c20d705249ea14795c43d7acdf2d01539b22ab6c8a
SSDEEP 6144:U12lqlEAehuqN8zwNzlmhPL1b5nZ2tZ6lfA6Gfm608J:LlqlEZuB1b5Z2tZ6XKmS
TLSH
T18624BEA374424097C96301B05E2FFA95BEBDE9360138FE5687E82C26FB90491536F393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Slut

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Slut
Size 468KB
SHA256 c63b0f2a9cc4dccbbe0120ee7e343bcf1879f4384b1c872af05dba7bb64605af
MD5 fa3f1f403c9fdd2acaaff3d6f681d8b6
SHA1 9bfd4e16c1d60dacd3f6a2a2dde9656f0e1092b3
SHA512 3f0a7116ccb3cdbb76fd2803ad1535c22fd630a8e447eec85bf6272fed0f97778e4c721dc98af48ed3395969da732daaf2009b2676f9f82f2f8e0e03bb6ea3cf
SSDEEP 12288:gY55WhL54HhICbICCOIKrkLpDnfiDp2x8OyeGgDH:F55W9m2Ryyr
TLSH
T13FA43AD4325686E54F9FA7F23CA4C9C6381047DD873F164C1EB707850836A9ACAACDD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Venezuela

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Venezuela
Size 27KB
SHA256 eadb528cd99245393c6829e59664e39dd7edadf22d8e66c9b86e62be9d924f2e
MD5 1daf8ec80c2876ee42321da4b6d33063
SHA1 3167e3dad826a7550cd0b8c2b15458c0f2d93484
SHA512 b41520371b9bc736858531903daa7888d71899ef3a1037a27f7642480c4c0b1ed0c02121215bb79beb2ce6475232fadd9555e7d076ce8f72a9c72edfd431f705
SSDEEP 768:zshg/7sD4/gs1HxHkH5zHwj3NnSIDQOJ8uG:R1gsdj9H0GVG
TLSH
T182C2D7E4322656E64FAF47F33C68C6867A204BCE973F25580CB307595026B58EBB8CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Venice

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Venice
Size 472KB
SHA256 a6982aedd84cceb39309340c2fa6239a7223a2e4c2b01d8e25b28fd3bbb6c7a8
MD5 68ff7af5d5157b0426e304df4d82eba6
SHA1 a8e9bf7fadf3d3619628b4797789fba77cb1911e
SHA512 66dee9d9ca475d30bfac4a90c4a15c99a9e14bde866b74484c3b5b42ee8262a4b0e98186b9cdf898d0a4680cc5faa91cfa16992830f2565e47e9c8119e74dbc2
SSDEEP 6144:cS532GsGAt/SqfIxFqDGJUrup9ZE8aGbslhE+k6Ngdkp5Yk6F7p+Ki:fF2SqfImkr/a2Su3dFi
TLSH
T1D9A4CFC9E13A84D24D053FC6AC686AC75B2047364AB800583A7F7D895F379BEC16DDE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Worm

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Worm
Size 223KB
SHA256 f82242c4134488257b48407124723bca234bd866d7eb64c2208f28af899b5601
MD5 76ec56acdf3cfcff17fd1f3acaefef40
SHA1 be2c663fa39f109611fc8e03a7fc1f14c3435031
SHA512 2d571d70d3790d5552874a6ca26095083c3ff0bf262ca49806c516458b2b634929c51f1a1e8e90d5b77dbcddba32a54a8bdd33be7de47ff5ca920270fa705b36
SSDEEP 3072:CaAtbPf6jKj+wsxjgarB3RZgDWy4ZNogXJ3i2Umb2Oq:CdV364EgarxUaBZ2myoG
TLSH
T13324610223A48127FFD7F63B665FD32A46B97D9E8753912E11186FB9B830370466C632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3744-30-0x0000000004190000-0x0000000004203000-memory.dmp

Download

memory/3744-31-0x0000000004190000-0x0000000004203000-memory.dmp

Download

memory/3744-32-0x0000000004190000-0x0000000004203000-memory.dmp

Download

memory/3744-34-0x0000000004190000-0x0000000004203000-memory.dmp

Download

memory/3744-33-0x0000000004190000-0x0000000004203000-memory.dmp

Download