1f7330e82778177b6c6d6b27f5452fb49089e952f50f0adbf7cca59f1feb611c

Analysis

user interaction
yes
max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client_packed.exe
Size 3.4MB
Sample260628-xcmdysct5m
SHA256 1f7330e82778177b6c6d6b27f5452fb49089e952f50f0adbf7cca59f1feb611c
MD5 556bf1f33a8c5868cbb957771e7aa900
SHA1 afa16a6cecbda85e0891def8ca30ad20aec85b88
SHA512 0ff5246a833aaf89fa8244ac50b7f44f7ee9a98b70d01b4557073e083f354a9982152848651501e62e708587b8fc9e91aca60c9432cfd798a8f0cf122ca3793b
SSDEEP 49152:dlTZoZqSnSVTHR9y7AxCSZe+mg+kbHX6Z7pAO78ISH9uabjnIW9P1IgNswNstt:+eR0EIg+RWduabcW9PRNstt
TLSH
T1E9F54B47D26310ECC127C1748A6A9772FA31B45C42B47E7F6694CBF12F21E50BA2EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdateCore.exe	client_packed.exe

Executes dropped EXE 1 IoCs

pid	Process
3780	MicrosoftEdgeUpdateCore.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdateCore = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdateCore.exe"	client_packed.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3384	whoami.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1116	client_packed.exe
3780	MicrosoftEdgeUpdateCore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2980	1116	client_packed.exe	91
PID 1116 wrote to memory of 5784	1116	client_packed.exe	92
PID 5784 wrote to memory of 3384	5784	cmd.exe	94
PID 1116 wrote to memory of 2600	1116	client_packed.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\client_packed.exe
"C:\Users\Admin\AppData\Local\Temp\client_packed.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:2980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c whoami
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c
  2⤵
  PID:2600

C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdateCore.exe
C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdateCore.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

stl_240747109.db

Path C:\Users\Admin\AppData\Local\Temp\stl_240747109.db
Size 138KB
SHA256 d9bb3678317c4a80af2322c89bed63688c5aec65be136a2f0dc161c8053f1041
MD5 a8796d04444a04e9fc0bb2d4f0f86b2f
SHA1 6a46506ff27e81505c983ee41629cd83c1b491b8
SHA512 5a92d78e161ae069989ab15b0ed246e15f79f8c5c0af46aaaef5b432508e3d02be05da3df010b5bbe55613c329924d88ea990b075e94dab8e88f596ae279ef9a
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2Ow5e0oLVumSnQfH:FnbZeMrv/hGtw5eGna
TLSH
T19CD3764B3A743002EDE5DA722CE050BB5D3CB26D8F5595D528B620588EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stl_240747125.db

Path C:\Users\Admin\AppData\Local\Temp\stl_240747125.db
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdateCore.exe
Size 3.4MB
SHA256 1f7330e82778177b6c6d6b27f5452fb49089e952f50f0adbf7cca59f1feb611c
MD5 556bf1f33a8c5868cbb957771e7aa900
SHA1 afa16a6cecbda85e0891def8ca30ad20aec85b88
SHA512 0ff5246a833aaf89fa8244ac50b7f44f7ee9a98b70d01b4557073e083f354a9982152848651501e62e708587b8fc9e91aca60c9432cfd798a8f0cf122ca3793b
SSDEEP 49152:dlTZoZqSnSVTHR9y7AxCSZe+mg+kbHX6Z7pAO78ISH9uabjnIW9P1IgNswNstt:+eR0EIg+RWduabcW9PRNstt
TLSH
T1E9F54B47D26310ECC127C1748A6A9772FA31B45C42B47E7F6694CBF12F21E50BA2EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-0-0x00007FF97E3C0000-0x00007FF97E623000-memory.dmp

Download

memory/1116-5-0x00007FF7116F0000-0x00007FF711A5F000-memory.dmp

Download

memory/1116-47-0x00007FF7116F0000-0x00007FF711A5F000-memory.dmp

Download

memory/3780-2-0x00007FF97E3C0000-0x00007FF97E623000-memory.dmp

Download

memory/3780-6-0x00007FF7124A0000-0x00007FF71280F000-memory.dmp

Download

memory/3780-48-0x00007FF7124A0000-0x00007FF71280F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads