e41b0ea6ef4ac22fb2ee85ef02742292061f4e2885e59ec0ee6519d37d430407

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/06/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
original_560526.exe
Size 4.4MB
Sample260621-et8dmsct8w
SHA256 e41b0ea6ef4ac22fb2ee85ef02742292061f4e2885e59ec0ee6519d37d430407
MD5 adbc80546137d1aec411f4cbedcfa99f
SHA1 5cce54401194ebd4113b2fb75342dbe37b706347
SHA512 1831dd5de078881a4c3963ca7313499acebc9ddb8a966768eb0245ef4cd20b85fc26a08b7e2d15a72b824f99f850f31782766c0c9eef3649f309e13ada7d4387
SSDEEP 49152:Z2ZWOiJd/WaAeJ8TzXnrDfBuqWRCDWkv4OnOsmX3aJVJ3vX1I4UvoHSIqdLFxLUt:ZPWaVJIfDfBzBWXA71I4vHSDeeS9
TLSH
T13526BF06D0C118A8D45D8CFE820FDF12E5E1E46C30346BEFE7DA9930BEE2AEC5559646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	original_560526.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	original_560526.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	original_560526.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
3500	msedge.exe
3500	msedge.exe
2704	original_560526.exe
2704	original_560526.exe
2704	original_560526.exe
2704	original_560526.exe
2704	original_560526.exe
2704	original_560526.exe
2704	original_560526.exe
2704	original_560526.exe
2704	original_560526.exe
2704	original_560526.exe
2704	original_560526.exe
2704	original_560526.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 916	2704	original_560526.exe	81
PID 2704 wrote to memory of 916	2704	original_560526.exe	81
PID 2704 wrote to memory of 3500	2704	original_560526.exe	84
PID 2704 wrote to memory of 3500	2704	original_560526.exe	84

C:\Users\Admin\AppData\Local\Temp\original_560526.exe
"C:\Users\Admin\AppData\Local\Temp\original_560526.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 39e040a81c16bb120b5c8769522a2a82c62b5395fcb70266126af5fb8c829214
MD5 b608c1d41bc0e1bb9fb53fa8ab8b66fd
SHA1 c63b3f7fcd58baff4ca89d0a32a96a374a4411bf
SHA512 3504cdfc9674a01f8636aeed0795c94e8185458f098dd2213fe174c4113089efee32edc0443d996e06e239e981304de6eb1c13ffe3deb5a115e280ebde93cdef
TLSH
T1A081BA0798D5C94E2750E8E3D371E15CD6F088883FC937219BAAC88D74C681AF5CA787
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 86226a70f6b8ad6e098bd32275384f1c113fa5faee259047883ca9f19db11a21
MD5 93fbc7d4a53d0a6ebb8fb8d4b11ccb91
SHA1 67e14c4e30f393f50c96cf63bf4cfa6be0747ed5
SHA512 18d931922985aad2560c96f14e3c8ff7c872d26f176eeb97224182a5d73777bc3e2255a87d4733700dbfbb4eb30fd53760be2f6c13cff644011c224d8ea0ded4
SSDEEP 96:Y/mdB5/q/6G/eG/t/YImiYdj5mvmpGmqmZeDfYfCgdTfJdfm6HdfnDyid0dsJd9d:9v5TQYlzpeJ+y+Kccn6J
TLSH
T12891BA0759D5CA4E6790E4E39371E16C96F088883FCD36319BA9C88D38C581AF5CA697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 594B
SHA256 840d11f0073ac551da3e09ef89adb881c2a59f13a5bf5ef0c72de2d64f9a6786
MD5 dcf5c10d1995a7ca9ca7cc012795c582
SHA1 f3ca8d2705f58fd0cc7db86e921b32d948aa2e29
SHA512 1985ac15dad09ff12a192b3cd16ad316e4dbbdb439e647760f3c7b7e7ed874d3cc4350d99f8180e90fc6f4f781097ef8f3440b063aff5285a52eda261142a738
TLSH
T119F04C43BCC6981E1110DCE79751A66C9CF940089B9A27479B44C48C75C591DF8CF3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 125B
SHA256 7d916624e0b9c4614d2cdb98469bee2aafa3efc5091ea5eb58c4fa9d5d123474
MD5 c74fa1aa6698e10744e96b22d2e982fd
SHA1 940ee8d9e1f07e793cf94e11274361d756abe469
SHA512 f439c32fc34d92be397e5ae149c2dc66cfbf49e2341f0c33e214f7d73d25ac24bf1ba03af7d66156864ac3fdfeb25a9f6d7b859b3d2fc4b226a4b69b59677579
TLSH
T1D8B0929ADC51C49C37B2F8B783005A54AEB748288B490213B2CA818E5985A088A4B7F1
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1019B
SHA256 c56a40b3ed36ad77ac182d8cef4d01d8de2a861dc140ceb8d99d94c7486aa790
MD5 4b1a08be86b21ba30f10c350dda7c9b2
SHA1 3f07fb1d53f2fda5c32227a199865752fcd2de76
SHA512 fc2b5ad7ec60aeda3ca21161985061ca4a6b1485503830dd1114d2675e6bd7b49bb2ef490d5bb29023afff8eb0f808e59fd3f1ac0c0f9d9870d91b33f37af59f
TLSH
T1C1117B02BCC5D82E1140E8E39361B66C9CF484049BDE2B429B84D94C75C582EF5CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 95a16041081f99a717743cca6955a00485b1b5e6e6c065e9f803a1d6894e96c4
MD5 30835497aafa6a3d4b52a96b992efd5a
SHA1 c908b42f8af478204ac8618fee0e19d330952ad9
SHA512 a0727a68f8ff8c7374d8b95a1aaa515af095c614ed58cfb328209de800c0cd4ccbd6d7b5d92e6c63541fa56afa61c18a83576c107ea9d17e86fdf087dc751317
TLSH
T13B11AD02FCC5D82E1140E8E39350F62C9CF884089BCE2B429784D94C75C581EF6CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 975957c29306c2375909b069182d84772372aaa26b4e36e713644950e730e270
MD5 39c2acc9606de15f924dc17285b07d95
SHA1 a049e2982f8358deb29477e00c2f6ec2e9213a8c
SHA512 38008a99e0edae84608a291ab513df7e90bc4d8bc9506aa7e3bfc7109ac29e897e9de95839a91ecdd367cf7d5f664247426959eb6114906d220368cf3d84dd15
TLSH
T137316903F9C6D82E1200ACD39761AA6C98F98448ABCE2B469B44D84CB4C685EF5CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 36efc32fc17f28563e4346193953c99dc8fb1d291c8d84d88c0d7f936d494d34
MD5 56aa1a1ff5225d02d80eaf342f081d8d
SHA1 299261af3c9bb45bb81063f29cb064c5e8f7ee14
SHA512 ab12a49c87ed23f28db019b4118bcd16fe3cee15c12d51385ecc103d8fc9a791b445c8c3b5ef71817bd212972649317f34f58a68763663946d684d4d1761757f
TLSH
T17C318902F9C6D82E2100BCD39365EA6C98E484489BCE3B429B44D84CB98685AF6DF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 e7832381ce002b01b86092ffe59c408087796581eba248e56c05f874cb591b45
MD5 e7da41d18497c0fe5602315838ddb139
SHA1 034a37b7ff342d851301f97d6808b9b4f31d26a0
SHA512 bcc6af2854beb5954b046860cb53245cbc6c1af393ce9a387a5e74c4bc34b98905abee6090352e1469689730ff51a93d55188800840849076ad1a1f60851c273
TLSH
T1F041CB43E8C5D81E1214B8D3E351A66C99F484989BCE3B425B88D88C74CA52BF6CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 29847697a92401b66a37abe16a9163a66bbbebbaeb10eb62383f74253afcb57a
MD5 e8277da2346fd183251efe7fb39b32ab
SHA1 86403bff88b220d7a7cd38280f2e2bf162717e87
SHA512 fdbf884d6e095471269498266238b66c1b3ed72dc3473c06ee2b8f916c785c073775c06036e711990cb7c877855d6b989f2016e0a5bd81c4f9b1a4c1114ecc08
TLSH
T17F81BB0798D5C94E2350E8E3D371E15CD6F088883FC937219BAAD88D74C681AF5CA787
MD5 SHA1 SHA512 TLSH

Submit Download

pwd_1072.db

Path C:\Users\Admin\AppData\Local\Temp\pwd_1072.db
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwd_3812.db

Path C:\Users\Admin\AppData\Local\Temp\pwd_3812.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2704-190-0x00007FF6CDBB0000-0x00007FF6CF9B6000-memory.dmp

Download

memory/2704-194-0x00007FF6CDBB0000-0x00007FF6CF9B6000-memory.dmp

Download

memory/2704-202-0x00007FF6CDBB0000-0x00007FF6CF9B6000-memory.dmp

Download

memory/2704-207-0x00007FF6CDBB0000-0x00007FF6CF9B6000-memory.dmp

Download

memory/2704-209-0x00007FF6CDBB0000-0x00007FF6CF9B6000-memory.dmp

Download

memory/2704-213-0x00007FF6CDBB0000-0x00007FF6CF9B6000-memory.dmp

Download

memory/2704-218-0x00007FF6CDBB0000-0x00007FF6CF9B6000-memory.dmp

Download

memory/2704-221-0x00007FF6CDBB0000-0x00007FF6CF9B6000-memory.dmp

Download

memory/2704-222-0x00007FF6CDBB0000-0x00007FF6CF9B6000-memory.dmp

Download