8c0e799108d8f1686839102cc81ec4cc9008b810e722d2a8dd1401d20e956a08

Analysis

user interaction
yes
max time kernel
97s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/06/2026, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EqualizerAPO.exe
Size 6.5MB
Sample260621-ghkvbacw2s
SHA256 8c0e799108d8f1686839102cc81ec4cc9008b810e722d2a8dd1401d20e956a08
MD5 c754cf71a51c8ac7e121e155ab310dc5
SHA1 a6006efcf466c07d65b1dddc3549fa387b8dd60f
SHA512 adbdf71cedba4742c84de8419178483bae3eb359bf02ac9cd08a93da130ae84e667265f6d39e80c77a7b9b10c96cd26f97f92a0a858ab78c2af12a86028fa0fc
SSDEEP 98304:ytaW5AskzTC6AEjsB/3DNTLQYLTrAS4rAStn3TfV:SchyPhFR4rASd9
TLSH
T17E663321F2CE1C56A75254F8B0FEF6BA917A6D78B4639008F1ED6BA0C01CB0D16F157A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery persistence spyware stealer upx

Malware Config

Signatures

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 3 IoCs

pid	Process
5696	wu_4464.exe
592	wu.exe
4868	wu_592.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate\\wu.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate\\wu.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4464-0-0x00007FF741550000-0x00007FF743D98000-memory.dmp	upx
behavioral2/memory/4464-7-0x00007FF741550000-0x00007FF743D98000-memory.dmp	upx
behavioral2/files/0x000a00000001bc47-18.dat	upx
behavioral2/memory/592-23-0x00007FF7A2990000-0x00007FF7A51D8000-memory.dmp	upx
behavioral2/memory/592-147-0x00007FF7A2990000-0x00007FF7A51D8000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wu_4464.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wu_4464.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wu_4464.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1260	reg.exe
2896	reg.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
5800	msedge.exe
5800	msedge.exe
5696	wu_4464.exe
5696	wu_4464.exe
5696	wu_4464.exe
5696	wu_4464.exe
5696	wu_4464.exe
5696	wu_4464.exe
5696	wu_4464.exe
5696	wu_4464.exe
5696	wu_4464.exe
5696	wu_4464.exe
5696	wu_4464.exe
5696	wu_4464.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1260	4464	EqualizerAPO.exe	88
PID 4464 wrote to memory of 5696	4464	EqualizerAPO.exe	90
PID 5696 wrote to memory of 2016	5696	wu_4464.exe	92
PID 5696 wrote to memory of 2016	5696	wu_4464.exe	92
PID 5696 wrote to memory of 5800	5696	wu_4464.exe	97
PID 5696 wrote to memory of 5800	5696	wu_4464.exe	97
PID 592 wrote to memory of 2896	592	wu.exe	98
PID 592 wrote to memory of 4868	592	wu.exe	100

C:\Users\Admin\AppData\Local\Temp\EqualizerAPO.exe
"C:\Users\Admin\AppData\Local\Temp\EqualizerAPO.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1260
- C:\Users\Admin\AppData\Local\Temp\wu_4464.exe
  C:\Users\Admin\AppData\Local\Temp/wu_4464.exe
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1592

C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe
C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\wu_592.exe
  C:\Users\Admin\AppData\Local\Temp/wu_592.exe
  2⤵
  - Executes dropped EXE
  PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 037ca8813007e4cd1d89aeb9b93f5ba1e43985ff134e7497d30b813e6e47f884
MD5 e4f50e935ba131236889c435f72a37c5
SHA1 ccda84b340fd821cad7be9c97c1d2e22fc9ba663
SHA512 0e56e70d085586ca2c497c33dfb35569cb2ec5a20167ffa386c97e0d615afa0c4b4118fc183bf1907374486f03531597dccee9ef12f44a9f7e8036f325c5e765
SSDEEP 96:Y/adB5/q/6G/eG/t/YImO9dj5mvmpGmqmGeI4vcfcfL8Hd7ewJdcrNu8fmf8fJfb:5v5TE9lz2emLS
TLSH
T1C1A1DB1659D5CA4E6B81D8E397B2E16C86F188887FCC3722CBA6D8CD34C180DF4C6683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 5KB
SHA256 75a5da858719ab1081921cf02332171eb63dc7558bb339b17f1b7916b85185cc
MD5 0a1f564f964e94511fbf3d32f6add3ad
SHA1 98ba2ca7f6a1e7b25f7d9542e23a67e6db7885b2
SHA512 d38483bc0a9d639ca70ef848841808d2d145ff35743a23e4010e9ee161326effe44ddcf49ee75dd5a5ece473c46fc8db1ec16224e104ad4dbed1d9a21077a926
SSDEEP 96:Y/adB5/q/6G/eG/t/YImO9dj5mvmpGmqmGeI4vcfcfL8Hd7ewJdcrNu8fmf8fJfF:5v5TE9lz2emL9hFJta1
TLSH
T1E2B1CC165AE6CA5E6B80D8E387B2E16C85F188483FC93731CB66D8CD35D180DF9C6287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 5KB
SHA256 4a1576cf22d8123cbff0eedc59f427d5500f8b9502a7b97d9f06dc098c61fd78
MD5 f5f17ef92d70c6a23e9bc386ac0532f8
SHA1 6defa953cf0aa9cf7c079ae371591ccfdb6f994a
SHA512 e5a69b790a5e283c0226d83e119500e0e4f73849ee3bb8e807987d190b0a7cfa7488c884a09e1be3d3906cc5185feec80bd887f41c85906b548aab9d98cd2a53
SSDEEP 96:Y/adB5/q/6G/eG/t/YImO9dj5mvmpGmqmGeI4vcfcfL8Hd7ewJdcrNu8fmf8fJfb:5v5TE9lz2emL9hFJtaL
TLSH
T1E9B1CC165AE6CA5E6B80D8E387B2E16C85F188483FC93731CB65D8CD35D280DF9C6287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 254B
SHA256 95b7fc78051d2e91c08c6347f8a8b6865b33718ac95aae9832b21ffcf0ba4f4c
MD5 af0fecd784a923a0b8a531e2193fc402
SHA1 d2f3304e6260322be851c322c13e6f4331f1a854
SHA512 23e4a5bb229caca8144d0dd9bdec6a890532a695f7e268ff3e361e533ad466ccac28195adc071db302305a574ffe74a7dadc595af6620ce4c530a6a670096ae1
TLSH
T167D09712EC82C0CC26A2E4B78300556DDCFF4018AB590303BB86808D14C0B0C9CCB3EA
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1017B
SHA256 7ccb577dce2fa4635dec435c09808599992dd1c4a343223d2a93bbeca0134246
MD5 c805811222d82d83553c23a60a2afc24
SHA1 1053a2aba88471c610e6b3a0b723fa11e7978828
SHA512 0880d52f5e9da40b61b7ead94d9c4051be75eaded69710f38c3880e3e8c79e2926a654b695984bbf04e6befb256dbc2a63354e6d7307fce992f244fdc707bc90
TLSH
T1DF117B02BCC5D82E1140E8E39361B66C9CE484049BCE2B429B85D98C75C582EF5CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 9d7b1a0c50cc106ef1ccf6d789d1ed57febc3e1010cccef06699c93ab5cf11c9
MD5 125271679ba6e5843603c510fde8015c
SHA1 114d7ed5c3e42552bd3d4fc10b1ae32f3b9e68a7
SHA512 fb6ccdf1929af7128be60ca69f2dd0fe10489e92d62d85da2a4088699849c66a7f5994983bea263b2c9b20fcbdc6c72a0bd6ef1f36b2bb0e2e9ba454236c12fe
TLSH
T1B5316903F9C6D82E1200ECD39351A66C98E94448ABCE2B469B44D84CB4C695EF5CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 74f8c9648842f8354b7e20dc4d5b62a44f266eeb8b67a2ad98a25ac094aa18b5
MD5 b77eb33a8aecfd48bc589337995b8f48
SHA1 527671956ba22fc174d900ca7e66c8303a42835d
SHA512 ba27dd8e1deaf484d7a1c0812090d24235a5c3f554dae7727e7d17c3d9fd3c3da5b6bfeb667c1fc9e686297bb533a176d914b964d911ec6d55049bfb8d6b145e
TLSH
T15D316C02F9C6D82E2200FCD39355EA6C98E484499BCE3B469B44DC4CB58685EF6DF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 73082a26cffc112cf3ec959234cc5e71c82ab9d3f9f7c47cc7482c11f95b5ee8
MD5 28461bfe72366f1167a56eaebbd12939
SHA1 41869d6652c9a9aff05a8e5d29c36113a1ce40ae
SHA512 0054804f0dcfb4ae93456fa8df649978b844d1c10942b0b41c0bfd4d2dfe3d18d075f489017a1062ff5b34cc8cbe3cea03b243a6630a6b07950561c3c6108b5b
TLSH
T1C3319C02FDC6D82E1100BCD39355E66C98E484489BCE3B429B44DC4C758685EF6CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 64e23a008595135d2d204132d0cdccd5111f286db00d3c251eaf9c46fcfb43ff
MD5 f4670c137cdb12aa20eae434afa45472
SHA1 5328706a7c871956016a157b2e0f4902b36e0ea1
SHA512 7941c8e523a2b41af8213ee31c456e21e60739a0349d9b321cbaeca02798063f55073c4df78179447be860541939996b47c5e7ea4eed510518ca49224d626d7c
TLSH
T17B41CB43E8C5D81E1214B8D3E351A66C99F484989FCE3B429B88D88C74CA52BF6CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 9f0ebaa16313059cfb3c61e1e4ecf5a6d3f0aff94c2962438ea9e6a099faba2b
MD5 59626f9dd1531e3f2e6303d4622ae3d7
SHA1 1d08e32861cd0b25586e7090d9c3f6cba1739e08
SHA512 51e3bda7e6691feb61ff11105b698c2d3e8968f9a3d71607b34e385e7c54246ace81f4bc33471e89fe07d492ea48cbc14272924e1e883aa0f717bd07eb5f17f5
TLSH
T1F551FE4BA8D5C81E1750E8D3E331E21CD9E588486FCE37119B89D88D34CA52BF6CA757
MD5 SHA1 SHA512 TLSH

Submit Download

wu_4464.exe

Path C:\Users\Admin\AppData\Local\Temp\wu_4464.exe
Size 4.4MB
SHA256 8443b816a7044cddfb02171659631586ce512b8af45df18a188dbd49fe98fa24
MD5 f6fdf939b2a9cae28ededec12d500eee
SHA1 6b7663d594277e4073bf936514d54771204ee1a4
SHA512 8f121994fe4c8876c69dd97865b3e907149e298b1e5ca4e7b4876948bf12ab7578ac4730ed29f9dd7bb9e078ac9e3bb671d11049f6c97225e8b6a8943af516fe
SSDEEP 49152:S2ZWOiJd/WaAeJ8TzXnrDfBuqWRCDLNaLKtnoQ+p7WSv6o08XZ+Hjjrs21T6Je7I:SPWaVJIfDfBz+H6D4Gs2cGiCFSL9yd
TLSH
T16E26B0E6BA5260ACC425C9F0535E935D66E07DB1C054FFAE26308333DA62B89F63B714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wu.exe

Path C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe
Size 6.5MB
SHA256 8c0e799108d8f1686839102cc81ec4cc9008b810e722d2a8dd1401d20e956a08
MD5 c754cf71a51c8ac7e121e155ab310dc5
SHA1 a6006efcf466c07d65b1dddc3549fa387b8dd60f
SHA512 adbdf71cedba4742c84de8419178483bae3eb359bf02ac9cd08a93da130ae84e667265f6d39e80c77a7b9b10c96cd26f97f92a0a858ab78c2af12a86028fa0fc
SSDEEP 98304:ytaW5AskzTC6AEjsB/3DNTLQYLTrAS4rAStn3TfV:SchyPhFR4rASd9
TLSH
T17E663321F2CE1C56A75254F8B0FEF6BA917A6D78B4639008F1ED6BA0C01CB0D16F157A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-23-0x00007FF7A2990000-0x00007FF7A51D8000-memory.dmp

Download

memory/592-147-0x00007FF7A2990000-0x00007FF7A51D8000-memory.dmp

Download

memory/4464-0-0x00007FF741550000-0x00007FF743D98000-memory.dmp

Download

memory/4464-7-0x00007FF741550000-0x00007FF743D98000-memory.dmp

Download

memory/4868-152-0x00007FF6DB610000-0x00007FF6DD416000-memory.dmp

Download

memory/5696-155-0x00007FF756B00000-0x00007FF758906000-memory.dmp

Download

memory/5696-184-0x00007FF756B00000-0x00007FF758906000-memory.dmp

Download