Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 11:42
General
- Target DumpFall.exe
- Size 69.5MB
- Sample260604-nt46naev6l
- SHA256 0bef104025341c7004fcade4d9c9440a303a946a6c3970102a5c06f80bfd5466
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 16 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Kills process with taskkill 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DumpFall.exe"C:\Users\Admin\AppData\Local\Temp\DumpFall.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DumpFall.exe"C:\Users\Admin\AppData\Local\Temp\DumpFall.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /s /c "rd /s /q "C:\Users\Admin\AppData\Local\Exastealer""4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Exastealer\jre.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Exastealer' -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Exastealer\bin\java.exeC:\Users\Admin\AppData\Local\Exastealer\bin\java.exe -noverify -jar C:\Users\Admin\AppData\Local\Exastealer\exastealer-obfuscated.jar4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM "Discord.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM "DiscordCanary.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM "DiscordPTB.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM "DiscordDevelopment.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show('Tac', 'Tic')"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show('Tac', 'Tic')"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Exastealer\jre.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Exastealer' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
EXASTE~1.JAR
VCRUNTIME140.dll
awt.dll
java.dll
java.exe
javajpeg.dll
jimage.dll
jli.dll
msvcp140.dll
net.dll
nio.dll
jvm.dll
vcruntime140_1.dll
zip.dll
logging.properties
net.properties
java.security
default_US_export.policy
default_local.policy
jre.zip
COPYRIGHT
LICENSE
jvm.cfg
modules
cacerts
tzdb.dat
tzmappings
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_clzoesqw.ncv.ps1
db_11616656431940361476_cookies.sqlite-shm
db_11670472830649518856_places.sqlite
db_560474614117613479_cookies.sqlite
debug.log
sqlite3.dll
imageio6592862977011804969.tmp
jna16049341224290403305.dll
launch_hidden.vbs
sys_cache_436e88b3.dll
memory/416-423-0x0000019516F80000-0x0000019516F90000-memory.dmp
memory/1720-994-0x000001FDFA4A0000-0x000001FDFAF62000-memory.dmp
memory/2008-27-0x0000018FA5820000-0x0000018FA582A000-memory.dmp
memory/2008-10-0x0000018FA5490000-0x0000018FA54B2000-memory.dmp
memory/2008-23-0x0000018FA5820000-0x0000018FA583C000-memory.dmp
memory/2008-24-0x0000018FA5840000-0x0000018FA58F3000-memory.dmp
memory/2008-25-0x0000018FA5900000-0x0000018FA590A000-memory.dmp
memory/2008-26-0x0000018FA5A60000-0x0000018FA5A72000-memory.dmp