e41b0ea6ef4ac22fb2ee85ef02742292061f4e2885e59ec0ee6519d37d430407

Analysis

user interaction
yes
max time kernel
88s
max time network
58s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/06/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
original_560526.exe
Size 4.4MB
Sample260626-bcgb2sg15j
SHA256 e41b0ea6ef4ac22fb2ee85ef02742292061f4e2885e59ec0ee6519d37d430407
MD5 adbc80546137d1aec411f4cbedcfa99f
SHA1 5cce54401194ebd4113b2fb75342dbe37b706347
SHA512 1831dd5de078881a4c3963ca7313499acebc9ddb8a966768eb0245ef4cd20b85fc26a08b7e2d15a72b824f99f850f31782766c0c9eef3649f309e13ada7d4387
SSDEEP 49152:Z2ZWOiJd/WaAeJ8TzXnrDfBuqWRCDWkv4OnOsmX3aJVJ3vX1I4UvoHSIqdLFxLUt:ZPWaVJIfDfBzBWXA71I4vHSDeeS9
TLSH
T13526BF06D0C118A8D45D8CFE820FDF12E5E1E46C30346BEFE7DA9930BEE2AEC5559646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	original_560526.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	original_560526.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	original_560526.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
3052	msedge.exe
3052	msedge.exe
3008	original_560526.exe
3008	original_560526.exe
3008	original_560526.exe
3008	original_560526.exe
3008	original_560526.exe
3008	original_560526.exe
3008	original_560526.exe
3008	original_560526.exe
3008	original_560526.exe
3008	original_560526.exe
3008	original_560526.exe
3008	original_560526.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 5240	3008	original_560526.exe	81
PID 3008 wrote to memory of 5240	3008	original_560526.exe	81
PID 3008 wrote to memory of 3052	3008	original_560526.exe	84
PID 3008 wrote to memory of 3052	3008	original_560526.exe	84

C:\Users\Admin\AppData\Local\Temp\original_560526.exe
"C:\Users\Admin\AppData\Local\Temp\original_560526.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 a8b8028a43713b37e14ce14fb823cede4d81f153bb88124b2d7be7e81ff11215
MD5 0629eedef57c819be14d661dd65284dc
SHA1 579fc408fec1e19135fb4d6778516433b39adbc3
SHA512 d778a2246521059a1344cf4722e5fac2fc161c3f6cdb3a28f82e8c6451c14dd37ad8717ca6262dcc2c7165405133686f120d77c97ed2acff98184a43370c7f26
SSDEEP 96:Y/KdB5/q/6G/eG/t/YIm2CmOmpGmqmOeD3fKdflfOyPf3ftdfgDsduvRLd8d+df/:dv5Tk9ee71RQpI
TLSH
T175810F0A48D5CE1E6A91E8E39371E15C85F188447FCC36218BA5C8CC35C580EF9C6B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 594B
SHA256 985c14ff17abb8d2d4e1bfcc0dbfaa157a9760c16f0656873aff5c02c5f13c6a
MD5 5f12bb229e652e99aea705aaa6851a75
SHA1 4a3ba6d26377738f662886e83fefdc5c1e305004
SHA512 1b19aa2defda3a90b188d8922a0f6f4ca35774ae2df7fe5dc2d9ca32ecd461d0a6c7bc5e67416ff5fd5a0b479ee623fee5813c248b0f9367c12bb077521332bb
TLSH
T139F04C43FCC6981E1150DCE79752A66C9CED40089BDA27479B84D48C75C591DF8CA3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 256B
SHA256 20ad73503dca9d93a649854686c41017776d54909b9c436a9ee0b6ea6e4e0472
MD5 131e50f1b44e2faf28990adbb171c337
SHA1 aa6818ca26d3414ce628cbda2dbfbd04a24c274c
SHA512 bc568f3d57c487ccf6a6e4c8d417300b21f80a1261219b0bab78d25297c50300d68ee655cc6e78189692c21cadec5e5911ae3ee1c0e4420bd5f040a41a0c665c
TLSH
T1F3D09712EC83C08C2662E4B78301195CDCFF4018AB990303BB99C04E54C0B0C9CCB3E6
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1019B
SHA256 76722a42a5c0132511074bb8d0a6939c299b792e73044a895fe9e914f756c46f
MD5 496aedd21838f2384258d4ecc8340c4f
SHA1 68fb3b07640358e45f78c113eda4120f75efdd45
SHA512 5668f677b58a33d00d310d3ccde1095eb068d7c764bffda13ca84414988f4711ad5e3339469375347197e78676f3205f14d6bf20f34afb87ab244449b83616a0
TLSH
T16D117B02FCC6D82E1140E8E39361B66C9CE884049BCE2B429B84E94C75C582EF5CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 f29d72c0bdea5a3a6edc731ea97c9170973b2b9b0989cb4fbf20f5814de1190f
MD5 0efbd569ed25b36aba9b10eacd00682b
SHA1 62aa96b43494fd349745bd389d9524fd41779d2c
SHA512 b362676aac1d4597dd990b81117a02d0039c2e8a7e65b4d20391834fc17e84a3f2af42930db33042134968cb379fe3a5878ebdd70345bf0c1cb04f3222bb717b
TLSH
T1CC11AD02FCC6D82E1140E8E3A351B62C9CF884089BCE2B429784D94C75C581EF6CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 b7c2459bfbc7d429c8b1df9de2570f62ed7e775281651b62ef8c3a82a12333ac
MD5 35122b5f3da70a8c896b2746fdbfa9d9
SHA1 d0060225405c5905122d8344b868f8ef7ad59fd5
SHA512 02542d2dd6b9ee6445a31235bc8457e79cdb805de9afd84536e2dd28d6afb8af6c4ba59ca52b12c188ea0cba2e9d755ac70a50e1d50ac1e812282d99eb938d31
TLSH
T130316B02F9C6D82E1100ECD39355AA6C98F98448ABCE3B465B84D84CB5C695EF6CF397
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 f5bcfa2a3dce3ba2ffc626c2d2ecc291cefe0e383dcc943924daee4eb21f8f9a
MD5 264e798ebc4aa48f7d7891ca1b2c6d42
SHA1 3f711d51c3b7902d87b475c73b5cf41e7fa14a66
SHA512 229a9fed20e16486caa007b4e664a2f0029c95a19871f1f9795c510a47098c30a201b80148aa64e86ab76bd31fafca6e709bc47a06d22b0843fe1d2cc6513156
TLSH
T1F6318C02F8C6D82E2100FCD39354BA6C98E88545ABCE3B425B84DC4CB58695EF6DF397
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 439ebc331eacd269b3479c055e40ca5f58c2e6c55c2865e7963c52fa97d61069
MD5 4d2c357e63545c7222954407b4ffdeeb
SHA1 71d6e10671dfc7cbc827d93d215e2ced07a1cbc8
SHA512 001750fbed8dd2ac032883c324786ba12785d185c43d19ec687978c41699627d8cd48f657a49a68587a6b88581e909bd34e33cbbeea09fb431542b945a89b308
TLSH
T16E319C02F8C6D82E2100FCD39354BA6C98E485459BCE3B025B84DC4CB98695EF6CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 4a00ba691dfeb90f4b60ebfdf3f07fbcf1cce38cd958e0229765f60e485a795e
MD5 b1e87f9ae8261ebe9f11db98a14ec4ec
SHA1 8537d7e21f2452244c3d399137321fdac8f88e30
SHA512 26e5acb94a2c72e38e7909474a48270338a24b321b8ffcf2dc7a2181b6a8fa11415f429e15d128908cad93711ea776536690698ff66cd1b41f0eb631623868c6
TLSH
T12A41CC43F8C6D81E1214B8D3E311A61C99F484989BCE3B025B89D84C75C996BF6CF397
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 e7a7b093c488bdd195f87cf1b8714e0f66017057c446ff1eab420b7f0455e6b4
MD5 108244d2984cfc703dc798d7e9ea4a47
SHA1 fa8f027bdf8a6557b9cb66b349a35de00e2f1c90
SHA512 0864ed0f62514389bc264d32b1c6738d706c26e99cfbe1de78c6e173d6c16ad4a20ed2bc0d8326d96767455a421231fb13d4c6a327e48fb13b64fdb126500fd6
TLSH
T12561FC0B98C5C91E2650E8E3D331E15CDAE088886FCD37215B9AC88C74C596AF6CA797
MD5 SHA1 SHA512 TLSH

Submit Download

pwd_2448.db

Path C:\Users\Admin\AppData\Local\Temp\pwd_2448.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwd_3632.db

Path C:\Users\Admin\AppData\Local\Temp\pwd_3632.db
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3008-184-0x00007FF7E5790000-0x00007FF7E7596000-memory.dmp

Download

memory/3008-191-0x00007FF7E5790000-0x00007FF7E7596000-memory.dmp

Download

memory/3008-195-0x00007FF7E5790000-0x00007FF7E7596000-memory.dmp

Download

memory/3008-201-0x00007FF7E5790000-0x00007FF7E7596000-memory.dmp

Download

memory/3008-203-0x00007FF7E5790000-0x00007FF7E7596000-memory.dmp

Download