0193e9ddd05fc529b73e8ec1d0d28c5ce812a463327a7e0019e90ce1fb659234

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0193e9ddd05fc529b73e8ec1d0d28c5ce812a463327a7e0019e90ce1fb659234.exe
Size 2.5MB
Sample260703-qyn2cah161
SHA256 0193e9ddd05fc529b73e8ec1d0d28c5ce812a463327a7e0019e90ce1fb659234
MD5 e5e494cc939e9b55d3986ca65a8ce6e1
SHA1 6fd8206ce53c66d26ad2e7e1f3dee46ee2048d7b
SHA512 afe30a52ccf3626568e638fb9159e4bfa2fe1a596ad87d525f1376bcf4817edd996ca82f895e3a078c2d33d7e98b9583f6440f0798c1274bb4f30c9b4781f4cd
SSDEEP 49152:Sn1TTyZ+oWAEybzTz3G1I/s3t+NA9IrcRED0zuHAJPMFlhSe:S1ir/NbzP3+3VIIlzlMJb
TLSH
T162C55A13F29901E8D05DC1B58B469232FB62BC960B31B6DF069077652F77EE46B3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 5716	5904	0193e9ddd05fc529b73e8ec1d0d28c5ce812a463327a7e0019e90ce1fb659234.exe	89

C:\Users\Admin\AppData\Local\Temp\0193e9ddd05fc529b73e8ec1d0d28c5ce812a463327a7e0019e90ce1fb659234.exe
"C:\Users\Admin\AppData\Local\Temp\0193e9ddd05fc529b73e8ec1d0d28c5ce812a463327a7e0019e90ce1fb659234.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Users\Admin\AppData\Local\Temp\0193e9ddd05fc529b73e8ec1d0d28c5ce812a463327a7e0019e90ce1fb659234.exe
  C:\Users\Admin\AppData\Local\Temp\0193e9ddd05fc529b73e8ec1d0d28c5ce812a463327a7e0019e90ce1fb659234.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.41 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff7f3c0dda8,0x7ff7f3c0ddb4,0x7ff7f3c0ddc0
  2⤵
  PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads