51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634

Analysis

max time kernel
149s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
Size 989KB
Sample260627-vcadaact9m
SHA256 51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634
MD5 a1fb8a7bf9e843a85afacbaa79e1dd99
SHA1 94a7ab6bb75e8e7ecfd943fe2608305846fee3db
SHA512 2a89ae826aaad283600a2a9913628015199f4021ec38ba231b53461479d434a8425200fc6859f79bf7a6663ad087da9e59ecdc1325f5637b2111f80bb95a99db
SSDEEP 12288:QD6a83ZQMKG6UYCSMxq6yn5BJYLEzhvxwxhDREtcI2wbYhjNjpUIbfMTo/:/D3Z0Gpzq6eJYQZ8bEtih5nt
TLSH
T194256E2E5B5801B8E1B6C1BDCE878D02D771784903B199EF0BD08E525E6B6E45F3AB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6080	powershell.exe
2816	powershell.exe
6080	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	940	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
8	api.gofile.io

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	ip-api.com
6	api.ipify.org

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
940	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
940	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
6080	powershell.exe
6080	powershell.exe
5824	WMIC.exe
5824	WMIC.exe
5824	WMIC.exe
5824	WMIC.exe
2816	powershell.exe
2816	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6080	powershell.exe
Token: SeIncreaseQuotaPrivilege	6080	powershell.exe
Token: SeSecurityPrivilege	6080	powershell.exe
Token: SeTakeOwnershipPrivilege	6080	powershell.exe
Token: SeLoadDriverPrivilege	6080	powershell.exe
Token: SeSystemProfilePrivilege	6080	powershell.exe
Token: SeSystemtimePrivilege	6080	powershell.exe
Token: SeProfSingleProcessPrivilege	6080	powershell.exe
Token: SeIncBasePriorityPrivilege	6080	powershell.exe
Token: SeCreatePagefilePrivilege	6080	powershell.exe
Token: SeBackupPrivilege	6080	powershell.exe
Token: SeRestorePrivilege	6080	powershell.exe
Token: SeShutdownPrivilege	6080	powershell.exe
Token: SeDebugPrivilege	6080	powershell.exe
Token: SeSystemEnvironmentPrivilege	6080	powershell.exe
Token: SeRemoteShutdownPrivilege	6080	powershell.exe
Token: SeUndockPrivilege	6080	powershell.exe
Token: SeManageVolumePrivilege	6080	powershell.exe
Token: 33	6080	powershell.exe
Token: 34	6080	powershell.exe
Token: 35	6080	powershell.exe
Token: 36	6080	powershell.exe
Token: SeIncreaseQuotaPrivilege	5824	WMIC.exe
Token: SeSecurityPrivilege	5824	WMIC.exe
Token: SeTakeOwnershipPrivilege	5824	WMIC.exe
Token: SeLoadDriverPrivilege	5824	WMIC.exe
Token: SeSystemProfilePrivilege	5824	WMIC.exe
Token: SeSystemtimePrivilege	5824	WMIC.exe
Token: SeProfSingleProcessPrivilege	5824	WMIC.exe
Token: SeIncBasePriorityPrivilege	5824	WMIC.exe
Token: SeCreatePagefilePrivilege	5824	WMIC.exe
Token: SeBackupPrivilege	5824	WMIC.exe
Token: SeRestorePrivilege	5824	WMIC.exe
Token: SeShutdownPrivilege	5824	WMIC.exe
Token: SeDebugPrivilege	5824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5824	WMIC.exe
Token: SeRemoteShutdownPrivilege	5824	WMIC.exe
Token: SeUndockPrivilege	5824	WMIC.exe
Token: SeManageVolumePrivilege	5824	WMIC.exe
Token: 33	5824	WMIC.exe
Token: 34	5824	WMIC.exe
Token: 35	5824	WMIC.exe
Token: 36	5824	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5824	WMIC.exe
Token: SeSecurityPrivilege	5824	WMIC.exe
Token: SeTakeOwnershipPrivilege	5824	WMIC.exe
Token: SeLoadDriverPrivilege	5824	WMIC.exe
Token: SeSystemProfilePrivilege	5824	WMIC.exe
Token: SeSystemtimePrivilege	5824	WMIC.exe
Token: SeProfSingleProcessPrivilege	5824	WMIC.exe
Token: SeIncBasePriorityPrivilege	5824	WMIC.exe
Token: SeCreatePagefilePrivilege	5824	WMIC.exe
Token: SeBackupPrivilege	5824	WMIC.exe
Token: SeRestorePrivilege	5824	WMIC.exe
Token: SeShutdownPrivilege	5824	WMIC.exe
Token: SeDebugPrivilege	5824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5824	WMIC.exe
Token: SeRemoteShutdownPrivilege	5824	WMIC.exe
Token: SeUndockPrivilege	5824	WMIC.exe
Token: SeManageVolumePrivilege	5824	WMIC.exe
Token: 33	5824	WMIC.exe
Token: 34	5824	WMIC.exe
Token: 35	5824	WMIC.exe
Token: 36	5824	WMIC.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 6080	940	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe	89
PID 940 wrote to memory of 540	940	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe	91
PID 940 wrote to memory of 4288	940	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe	93
PID 4288 wrote to memory of 5824	4288	cmd.exe	95
PID 940 wrote to memory of 2816	940	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe	98

C:\Users\Admin\AppData\Local\Temp\51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
"C:\Users\Admin\AppData\Local\Temp\51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe"
1⤵
- Downloads MZ/PE file
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp', '$env:TEMP' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6080
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe" -a -c -f "C:\Users\Admin\AppData\Local\Temp\nexartemp6Bf9em\File_Grabber.zip" -C "C:\Users\Admin\AppData\Local\Temp\nexartemp6Bf9em\FileGrabber" .
  2⤵
  PID:540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName, productState /format:list 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName, productState /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -WindowStyle Hidden -Command "Add-Type -Assembly System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::CreateFromDirectory('C:\Users\Admin\AppData\Local\Temp\nexartemp6Bf9em', 'C:\Users\Admin\AppData\Local\Temp\nexartemp6Bf9em\..\Nexar_Report.zip', [System.IO.Compression.CompressionLevel]::Fastest, $false)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

Nexar_Report.zip

Path C:\Users\Admin\AppData\Local\Temp\Nexar_Report.zip
Size 12.2MB
SHA256 e66ba386a40189e602f10da889a2123d7ebd17d707c2e370144e1579835cd01d
MD5 cbe8b8c4b3f4b2763fdb5284e571909f
SHA1 df51ef8d6da11667326ec82df70041c2ff09d928
SHA512 f8f3ecdbcfd745a3a30d12fb0e4b2e224cbe35b2738fdccd9c9cf74e9ca31ab932c201e7e2efef54074c26fe655c1c5173e54d7e27b781ce0baa570eaa0da5f0
SSDEEP 196608:0eiRKazH1qiCe6lDPnr0ailrInQg3aVVWFogKO4X+frrLoEGWCXt9RxIIYlBkfTX:Pir5bcIadZ3IVPB3XWz/GMIfULaRV9qm
TLSH
T1D9D6334497212EE9D60C5D983E017A934DDB7EA022E402610FAAE3211D76FD38F5F5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qimcyzyq.l2u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qimcyzyq.l2u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nexar_run.log

Path C:\Users\Admin\AppData\Local\Temp\nexar_run.log
Size 1KB
SHA256 3b4e83f4612c723a7f3aa9fd69afde97f04668eec9b2f62f5a4092a3d118111e
MD5 e341668a96f06507df85b4df1b7ded54
SHA1 03a387597ee166a896e7753623246243dc5cf298
SHA512 c4fd0dbe0fadac45a43b651e88df14bb84ff2d13bbed453bdc35c6b6db8a21f215acda3609358bde5d33372da0708f1d128d6c13d03397c74d07ad36484e0926
TLSH
T1C321571BC0D7725AC02434BBC225FA9ED422BE8D4FC9AA3C6A3C140C31A5D0977E6631
MD5 SHA1 SHA512 TLSH

Submit Download

nexar_run.log

Path C:\Users\Admin\AppData\Local\Temp\nexar_run.log
Size 2KB
SHA256 f4116d58b5a5674b739eb27aa2f22d11231819636f6880082924f87d534f3c48
MD5 d6663f0ca2b1c6054f09356844549b93
SHA1 17e30d14dfa994da3de80b04c24814e3d607fab7
SHA512 a3786fb7431571fb53a94f2eb950ff4595111a000602dfbfcbb1b8f424860fa14d218f8c43ab9e080f9c76045b8b742a47a447620d67aa900c495502a2604d9a
TLSH
T1D351996B85C7A26E8055B5B3CA28F89EC121BECDAFC87CBC9A2C410D6194F8D75E5031
MD5 SHA1 SHA512 TLSH

Submit Download

nexar_run.log

Path C:\Users\Admin\AppData\Local\Temp\nexar_run.log
Size 562B
SHA256 1446a462040977644cd860df85c7add21489dedb8afadcc870562e9ba9b19e57
MD5 571d63174695137126c185226f3a0fb7
SHA1 d4d3d2c92af852dc1f7cb5662d2675ed643d3c09
SHA512 317a22fba5fc68b1e85cd90b142a38d507e48d4a4c1d36bba79efa415295eb72b4bf41081ce162133e37aa92de4fec7b7611a5c259b5114af663f72a91085363
TLSH
T19EF04C1E80E3722AC54428BB8255BA8EC431FD995FC06A3C5B68580C20BA85973F6021
MD5 SHA1 SHA512 TLSH

Submit Download

nexar_run.log

Path C:\Users\Admin\AppData\Local\Temp\nexar_run.log
Size 3KB
SHA256 17b9f942cca062050815d9dca73e96ba664f1d2211ba09b24c9f3c9222e7b5de
MD5 1a83fe94b751a1d89f7fdacc10e91c75
SHA1 59947cfc23855673e57782fdd893d30f2297a409
SHA512 3d8a0c82ce58bfd4eb63984a2d96bbbb851dece1a954206fa93c3577fcfe1d594a2c27026f45a93b54c583e34a5843ed0cda979bb641da5c6c85a0a8b7041087
TLSH
T1D271C92F86C7B26AC055B1B3C526F49EC521BFDDAFC87DBC562C420E6180E4DB5A6031
MD5 SHA1 SHA512 TLSH

Submit Download

File_Grabber.zip

Path C:\Users\Admin\AppData\Local\Temp\nexartemp6Bf9em\File_Grabber.zip
Size 5.8MB
SHA256 01fd04fad42772892f25a03609e50acbc161cbfd0da1318dd830265be7ed4291
MD5 b807903209cd37fb9039a06a6ef20713
SHA1 eaaa30593b5ed13173137f5fb248d21683e00f48
SHA512 216496a453d224289a8bce09b450fca44826fd84cef3f957f02d3dd2bf443d1c0508ca611de757342b9d0a39d870647e2f42737377712d8ab9fbf6bf29fe5499
SSDEEP 98304:FsOHoCP553meKcVPNq325xmukJ8QSQPxXBPZn1m3w6lXSCs5p8gosiXzuC9OJyww:NI0LKgPNLAeQSQPxXn1mg6lXUz8g9iX3
TLSH
T1AF563344A3213ED9C60C5DF83E016A934CDBBFE022A442611F96E2155D76EA38E1F5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\nexartemp6Bf9em\screenshot.png
Size 535KB
SHA256 f2e44961c5c560bca0431e79c4cd0b810d5d5a477dc00ac986f1c4b6adf94943
MD5 1a5d512141085574f47e7800cc54da8f
SHA1 663001f6b8c9642c230e5054d2556c4f68ff5fe8
SHA512 48568688c589a63296c8895c2d69466edb286a9bab24ce9535aeb2062b20827b587d366dd5c1a3523c8bd56389881383ff5339fd69e665eeb03aa1282b926d29
SSDEEP 12288:zsf5yPqcoOfCnDrWAWr/Asxc0gQHr1rYQNxy87SUyKnMJH4rWc:0ALTfCnDrWNrYxkL1VYgwhc
TLSH
T1E1C412DC2476D5186C9500BE3ED4457F2348A28BD5BE583EE7312F9168A6D2CED08CAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\nexartemp6Bf9em\system_info.txt
Size 809B
SHA256 814ce29162e922575b2c6344792368f62d566957a9c90dce417a1e00d55988c3
MD5 de9d5a923e6c72de717e97c9714ed1a0
SHA1 59d9c36911b47ea04a2916b341b562bc3be8a858
SHA512 607f3bf2dfa3ea4fdaca21b7551dcce971bdae82cf9028f867ac29e09145ddfd261a0baf29cdb6dd3c77292a683ac274ce1ece70ac538c39b7830d377d0334e7
TLSH
T16001F1B0E3060C10857A26A733164FE7376C5083130692FCACDE418679DE52A7BFF01A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2816-90-0x000001F1F3B60000-0x000001F1F3B6A000-memory.dmp

Download

memory/2816-91-0x000001F1F3DB0000-0x000001F1F3DC2000-memory.dmp

Download

memory/6080-45-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-14-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-17-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-41-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-42-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-43-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-25-0x000002AF79330000-0x000002AF793E2000-memory.dmp

Download

memory/6080-15-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-72-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-40-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-13-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-12-0x000002AF79050000-0x000002AF79072000-memory.dmp

Download

memory/6080-36-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-34-0x00007FFB422D0000-0x00007FFB42C74000-memory.dmp

Download

memory/6080-33-0x000002AF790F0000-0x000002AF790FA000-memory.dmp

Download

memory/6080-24-0x000002AF79310000-0x000002AF7932E000-memory.dmp

Download

memory/6080-9-0x00007FFB4245F000-0x00007FFB42460000-memory.dmp

Download