Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 06:00
General
- Target fab64bae586c637ca390091bc80d683579f1ba318f04695b7cc91b457256f5f9.exe
- Size 287KB
- Sample260702-gqnaeact4w
- SHA256 fab64bae586c637ca390091bc80d683579f1ba318f04695b7cc91b457256f5f9
Malware Config
Signatures
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fab64bae586c637ca390091bc80d683579f1ba318f04695b7cc91b457256f5f9.exe"C:\Users\Admin\AppData\Local\Temp\fab64bae586c637ca390091bc80d683579f1ba318f04695b7cc91b457256f5f9.exe"1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3168-0-0x0000000074232000-0x0000000074233000-memory.dmp
memory/3168-1-0x0000000002590000-0x00000000025EC000-memory.dmp
memory/3168-2-0x0000000074220000-0x00000000749DC000-memory.dmp
memory/3168-4-0x0000000004C60000-0x0000000004CBA000-memory.dmp
memory/3168-3-0x0000000004D40000-0x00000000052FA000-memory.dmp
memory/3168-5-0x0000000074220000-0x00000000749DC000-memory.dmp
memory/3168-25-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-11-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-37-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-104-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-274-0x0000000074220000-0x00000000749DC000-memory.dmp
memory/3168-129-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-127-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-125-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-123-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-121-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-119-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-117-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-115-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-113-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-111-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-109-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-107-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-101-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-99-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-97-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-95-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-93-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-91-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-89-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-87-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-85-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-83-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-105-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-79-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-77-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-75-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-73-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-71-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-69-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-65-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-61-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-59-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-57-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-55-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-54-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-51-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-49-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-47-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-43-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-41-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-35-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-33-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-31-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-29-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-27-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-24-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-21-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-19-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-17-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-15-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-13-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-9-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-8-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-6-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-81-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-67-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-63-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-53-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-46-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-39-0x0000000004C60000-0x0000000004CB4000-memory.dmp
memory/3168-1057-0x0000000074220000-0x00000000749DC000-memory.dmp
memory/3168-1058-0x0000000005400000-0x0000000005466000-memory.dmp
memory/3168-1059-0x0000000005C60000-0x0000000005CB0000-memory.dmp
memory/3168-1060-0x0000000005CB0000-0x0000000005D42000-memory.dmp
memory/3168-1061-0x0000000005D60000-0x0000000005D6A000-memory.dmp
memory/3168-1062-0x0000000074232000-0x0000000074233000-memory.dmp
memory/3168-1063-0x0000000074220000-0x00000000749DC000-memory.dmp