Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
28/06/2026, 06:01
General
- Target fab64bae586c637ca390091bc80d683579f1ba318f04695b7cc91b457256f5f9.exe
- Size 287KB
- Sample260628-grdscsfw2m
- SHA256 fab64bae586c637ca390091bc80d683579f1ba318f04695b7cc91b457256f5f9
Malware Config
Signatures
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fab64bae586c637ca390091bc80d683579f1ba318f04695b7cc91b457256f5f9.exe"C:\Users\Admin\AppData\Local\Temp\fab64bae586c637ca390091bc80d683579f1ba318f04695b7cc91b457256f5f9.exe"1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5392-0-0x00000000741C2000-0x00000000741C3000-memory.dmp
memory/5392-1-0x00000000027C0000-0x000000000281C000-memory.dmp
memory/5392-3-0x0000000004D00000-0x00000000052BA000-memory.dmp
memory/5392-2-0x00000000741B0000-0x000000007496C000-memory.dmp
memory/5392-4-0x0000000002820000-0x000000000287A000-memory.dmp
memory/5392-5-0x00000000741B0000-0x000000007496C000-memory.dmp
memory/5392-142-0x00000000741B0000-0x000000007496C000-memory.dmp
memory/5392-131-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-129-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-127-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-125-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-121-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-119-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-117-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-115-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-113-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-111-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-109-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-105-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-1057-0x00000000741B0000-0x000000007496C000-memory.dmp
memory/5392-103-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-99-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-1058-0x00000000053E0000-0x0000000005446000-memory.dmp
memory/5392-97-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-95-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-93-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-91-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-89-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-85-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-83-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-79-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-77-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-75-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-73-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-71-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-69-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-67-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-65-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-63-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-61-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-59-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-54-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-47-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-45-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-43-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-40-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-37-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-35-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-31-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-29-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-27-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-24-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-21-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-20-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-17-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-15-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-14-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-9-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-7-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-6-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-133-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-123-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-107-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-101-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-87-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-81-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-56-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-57-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-51-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-49-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-42-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-33-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-25-0x0000000002820000-0x0000000002874000-memory.dmp
memory/5392-1059-0x0000000005DA0000-0x0000000005DF0000-memory.dmp
memory/5392-1060-0x0000000005DF0000-0x0000000005E82000-memory.dmp
memory/5392-1061-0x0000000005EA0000-0x0000000005EAA000-memory.dmp
memory/5392-1062-0x00000000741C2000-0x00000000741C3000-memory.dmp
memory/5392-1063-0x00000000741B0000-0x000000007496C000-memory.dmp