Analysis
- max time kernel
150s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/05/2026, 17:46
General
- Target out.exe
- Size 691KB
- Sample260529-wcdalsbv8v
- SHA256 7d27644922e124a837d33a1fcbb86ca12bd04737008d49a74b215c103bb3efb7
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\out.exe"C:\Users\Admin\AppData\Local\Temp\out.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2028-0-0x0000000000620000-0x00000000006D4000-memory.dmp
memory/2028-1-0x0000000005130000-0x0000000005140000-memory.dmp
memory/2028-2-0x00000000051B0000-0x000000000521A000-memory.dmp
memory/2028-3-0x0000000005500000-0x00000000055E8000-memory.dmp
memory/2028-4-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-13-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-93-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-91-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-129-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-127-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-125-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-123-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-121-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-119-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-117-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-115-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-113-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-111-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-109-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-107-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-105-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-103-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-101-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-99-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-97-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-95-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-89-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-87-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-85-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-83-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-81-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-79-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-75-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-73-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-71-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-69-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-68-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-63-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-61-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-59-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-57-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-55-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-53-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-51-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-49-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-77-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-65-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-47-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-45-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-43-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-41-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-39-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-35-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-33-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-31-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-29-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-27-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-25-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-24-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-21-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-19-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-15-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-12-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-9-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-7-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-5-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-37-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-17-0x0000000005500000-0x00000000055E2000-memory.dmp
memory/2028-2090-0x0000000005120000-0x0000000005126000-memory.dmp
memory/2028-2091-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/2028-2092-0x0000000005130000-0x0000000005140000-memory.dmp
memory/2028-2095-0x0000000006650000-0x00000000066E2000-memory.dmp
memory/2028-2096-0x0000000006CA0000-0x0000000007246000-memory.dmp
memory/2028-2097-0x00000000069E0000-0x0000000006A64000-memory.dmp
memory/2028-4350-0x0000000005130000-0x0000000005140000-memory.dmp
memory/2028-4351-0x00000000068A0000-0x00000000068AA000-memory.dmp
memory/2028-4352-0x0000000005130000-0x0000000005140000-memory.dmp