00db8c93931d53670b14b3db7b98b64e0b7ee81bf72c8c77e9449cc91f5e2e64

Analysis

max time kernel
148s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
troll tool.bat
Size 947B
Sample260620-ed9xjac12q
SHA256 00db8c93931d53670b14b3db7b98b64e0b7ee81bf72c8c77e9449cc91f5e2e64
MD5 77c7411b2c315d613249672b05463ffa
SHA1 8ebbf659dce998b64a90721db20eceacabdfe687
SHA512 0ecad14a644b4c803be5fd8b727a6b5ce76db6ef686137dad047c2725980a2ca429b7b622caea595568b4c5a5f5e1c1428587f9917acffc3b6e062e5c743947f
TLSH
T19911569EF85DCC67887F955209FB4C9DEAA105DAB142CEFCF6926CA439103BC89DC019
MD5 SHA1 SHA512 TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
832	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
832	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 5052	1276	cmd.exe	89
PID 5052 wrote to memory of 1136	5052	cscript.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\troll tool.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\run_cmd_through_run.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
    3⤵
    PID:1136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:832

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

run_cmd_through_run.vbs

Path C:\Users\Admin\AppData\Local\Temp\run_cmd_through_run.vbs
Size 480B
SHA256 96b3c0162687b03f614e413766a86dd1b6f252a0da72703917355f8624eecd2c
MD5 6a6d5b6d7a11e6480ef34f7a3e45fefc
SHA1 9f352318e3e3a28d923dcc59ead486e19383c8c5
SHA512 e0473b1f7393890d9b7c071bfdf6fcc9d0814c9c6e314c7baa6f3f9771dfd1afd8abaec0ca020aa933213b5762a1118f62c6e1cae11f5258cc9840916840a0a7
TLSH
T166F0A22CDCDEDCDA619DE1A30EB799ECD7C91421B4534D78A304C9087221104EE31827
MD5 SHA1 SHA512 TLSH

Submit Download