Analysis
- user interaction
yes - max time kernel
39s - max time network
40s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/05/2026, 08:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
60 seconds
Behavioral task
behavioral2
Sample
624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
60 seconds
General
- Target 624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.exe
- Size 2.6MB
- Sample260527-kf4feshs8j
- SHA256 624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8
- MD5 afe35a657ea5aed591505db40d59a6db
- SHA1 f00edabd1cde158179019278507b72c517e2ff71
- SHA512 055d45d92682e1aa4e03f73372e24fd87598a2ee6a0adbeebfa7544b8f72e0aa5d6fac65f206aa507b06d41a9e90d6f41cbd5d7d419e39eebae4a9f61360c9bc
- SSDEEP 49152:NJ/viHNnC7x7l8DKE8RuRqu2LVHGiIpRVNZB99:NJ/viHw7x7lXdRyiER/R9
- TLSH T188C58D01FD9784B2E402133299AAA2FF2335AC054F759B97EA587A7EF9776D11C32301
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3620 624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 3620 624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.exe 3620 624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5100 taskmgr.exe Token: SeSystemProfilePrivilege 5100 taskmgr.exe Token: SeCreateGlobalPrivilege 5100 taskmgr.exe - Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe 5100 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.exe"C:\Users\Admin\AppData\Local\Temp\624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3620
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5100
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2