Overview

overview

10

Static

static

3

c2ef45750d...15.exe

windows10-2004-x64

10

c2ef45750d...15.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/06/2026, 06:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215.exe
  • Size 40KB
  • Sample260601-gqc5faft3m
  • SHA256 c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2084
    • C:\Windows\system32\taskhostw.exe
      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
      1⤵
        PID:704
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:3168
        • C:\Users\Admin\AppData\Local\Temp\c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215.exe
          "C:\Users\Admin\AppData\Local\Temp\c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5292
          • C:\Users\Admin\AppData\Local\Temp\348mhzlh.exe
            "C:\Users\Admin\AppData\Local\Temp\348mhzlh.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5992
          • C:\Users\Admin\AppData\Local\Temp\6diibccy.exe
            "C:\Users\Admin\AppData\Local\Temp\6diibccy.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1216
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\winsysdrv.exe" /sc onlogon /rl highest /f
              4⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:576
            • C:\Users\Admin\AppData\Roaming\dwrvc.exe
              "C:\Users\Admin\AppData\Roaming\dwrvc.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4196
          • C:\Users\Admin\AppData\Local\Temp\gl1kosi0.exe
            "C:\Users\Admin\AppData\Local\Temp\gl1kosi0.exe"
            3⤵
            • Executes dropped EXE
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3768
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              4⤵
                PID:5224
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                4⤵
                  PID:3972
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            1⤵
            • Suspicious use of UnmapMainImage
            PID:3724
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            1⤵
              PID:3844
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              1⤵
              • Modifies registry class
              PID:5228
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
              1⤵
              • Executes dropped EXE
              PID:5856
            • C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exe
              C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exe
              1⤵
              • Executes dropped EXE
              PID:4928
            • C:\Users\Admin\AppData\Roaming\winsysdrv.exe
              C:\Users\Admin\AppData\Roaming\winsysdrv.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3160
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "WindowsUpdate" /tr "C:\ProgramData\winsysdrv.exe" /sc onlogon /rl highest /f
                2⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:5648
              • C:\ProgramData\dwrvc.exe
                "C:\ProgramData\dwrvc.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1748
            • C:\ProgramData\winsysdrv.exe
              C:\ProgramData\winsysdrv.exe
              1⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3340
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\winsysdrv.exe" /sc onlogon /rl highest /f
                2⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:4728
              • C:\Users\Admin\AppData\Roaming\dwrvc.exe
                "C:\Users\Admin\AppData\Roaming\dwrvc.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4148
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
                PID:5916
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                  PID:5204
                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                  1⤵
                    PID:1732
                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                    1⤵
                      PID:3968

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Defense Evasion

                          Modify Registry

                          1
                          T1112

                          Credential Access

                          Credentials from Password Stores

                          1
                          T1555

                          Credentials from Web Browsers

                          1
                          T1555.003

                          Unsecured Credentials

                          1
                          T1552

                          Credentials In Files

                          1
                          T1552.001

                          Discovery

                          Query Registry

                          3
                          T1012

                          System Information Discovery

                          2
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Lateral Movement

                          Collection

                          Data from Local System

                          1
                          T1005

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          57BE3469-A632-84D5-D6E1-5A8DBED902C5.txt
                          • Path C:\ProgramData\57BE3469-A632-84D5-D6E1-5A8DBED902C5.txt
                          • Size 64B
                          • SHA256 5b7ca72d179a378a24d403e06ce92ef9c94502e9bc0010c1d94c624f25c7c218
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          348mhzlh.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\348mhzlh.exe
                          • Size 232KB
                          • SHA256 f87238a50db54c9cfb0b32dcc448d8574ea8bf7c996c8252d72dbc08532ba130
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          6diibccy.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\6diibccy.exe
                          • Size 2.5MB
                          • SHA256 472db8d633e8a9a0c3a2d19ff44f08abdb28487664c8dbb17b013a28dc7e92ae
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          gl1kosi0.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\gl1kosi0.exe
                          • Size 767KB
                          • SHA256 0e167816dc4dc7f0dcbfd4b0a9083ce9202751dae56a13f8f6804618183796e1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vsruntime20579.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\vsruntime20579.tmp
                          • Size 109KB
                          • SHA256 10aabdd53dcf9afc1d987fbb5079e05c3856e1b5480e4df4d762f052cf35ba56
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          winhost.exe
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
                          • Size 40KB
                          • SHA256 c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dwrvc.exe
                          • Path C:\Users\Admin\AppData\Roaming\dwrvc.exe
                          • Size 2.4MB
                          • SHA256 4e56d256bcc125a7e5dc7f46c28c36347ea0d67cfefdab63b2e7dd6433ceb1ff
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          memory/1748-82-0x00007FF658010000-0x00007FF65828A000-memory.dmp
                          Download

                          memory/2084-4-0x0000026FE15F0000-0x0000026FE15F3000-memory.dmp
                          Download

                          memory/2084-21-0x0000026FE1800000-0x0000026FE1807000-memory.dmp
                          Download

                          memory/3168-69-0x00000000025C0000-0x00000000025C1000-memory.dmp
                          Download

                          memory/3168-20-0x0000000002C70000-0x0000000002C77000-memory.dmp
                          Download

                          memory/3168-67-0x00007FF6D31F0000-0x00007FF6D346B000-memory.dmp
                          Download

                          memory/3168-45-0x0000000002F50000-0x0000000002F51000-memory.dmp
                          Download

                          memory/3168-81-0x00007FF658010000-0x00007FF65828B000-memory.dmp
                          Download

                          memory/3168-84-0x0000000002600000-0x0000000002601000-memory.dmp
                          Download

                          memory/3168-97-0x00007FF74EF50000-0x00007FF74F1CB000-memory.dmp
                          Download

                          memory/3168-24-0x0000000002CA0000-0x0000000002CA1000-memory.dmp
                          Download

                          memory/4148-98-0x00007FF74EF50000-0x00007FF74F1CA000-memory.dmp
                          Download

                          memory/4196-68-0x00007FF6D31F0000-0x00007FF6D346A000-memory.dmp
                          Download

                          memory/5292-0-0x00007FFEFE9A0000-0x00007FFEFEBA9000-memory.dmp
                          Download

                          memory/5856-28-0x00007FFEFE9A0000-0x00007FFEFEBA9000-memory.dmp
                          Download