Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 14:59
General
- Target sunwukongs.exe
- Size 1.5MB
- Sample260622-sczbasdy2z
- SHA256 f3355943d1b279778879cbe6f036bd1b2f86b6e33ef1c4b1f4896a4e540b3593
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sunwukongs.exe"C:\Users\Admin\AppData\Local\Temp\sunwukongs.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& { try { Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008A0F\2026-06-22 15.59.40\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008A0F\2026-06-22 15.59.40\result.zip' -Force -ErrorAction Stop; exit 0 } catch { exit 1 } }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SystemInfo.txt
V10.txt
V20.txt
monitor_0_1782140381945.png
result.zip
memory/572-39-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-30-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-19-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-18-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-17-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-16-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-15-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-10-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-9-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-4-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-12-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-11-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-24-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-48-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-28-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-45-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-32-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-29-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-37-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-21-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-41-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-36-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-20-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-35-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-26-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-43-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-49-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-50-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-51-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-59-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-63-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-71-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-73-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-98-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-14-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-22-0x0000000140000000-0x0000000140115000-memory.dmp
memory/572-13-0x0000000140000000-0x0000000140115000-memory.dmp
memory/1404-86-0x000001E672550000-0x000001E67255A000-memory.dmp
memory/1404-85-0x000001E672280000-0x000001E672332000-memory.dmp
memory/1404-84-0x000001E672260000-0x000001E67227E000-memory.dmp
memory/1404-79-0x000001E672090000-0x000001E6720B2000-memory.dmp
memory/1404-87-0x000001E6727D0000-0x000001E6727E2000-memory.dmp
memory/1404-88-0x000001E672570000-0x000001E67257A000-memory.dmp
memory/2080-27-0x0000024B1FD50000-0x0000024B1FD53000-memory.dmp
memory/4616-75-0x0000024A048F0000-0x0000024A048F3000-memory.dmp