a980505285bc469dc4b19a9df9d48db17cd28f97c56b68ef11dadb8c5023040e

Analysis

max time kernel
209s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libcurl.dll
Size 10.2MB
Sample260703-yeacvaby2n
SHA256 a980505285bc469dc4b19a9df9d48db17cd28f97c56b68ef11dadb8c5023040e
MD5 f0eeedaa0577440569080f61b180f353
SHA1 8c82acf8f1349b59166882452308e903205e6db2
SHA512 f4a7ea241496650353830dc9a95d570b5251d139b286db0a9835cb59554528b259c90208640a1d3a6980d719f4dbacce0ae452e293101e92c38abe73e9f3c5d2
SSDEEP 49152:FhsW01a/VHVYsNhKlrzPtGKO7CMwTO5cZuvsvoZhebKmpqszcbf5NYCIixa+3RGA:J7
TLSH
T17EB60773644D32CB58920453E112A0F38CBDE936A71A92E5D48F902D39EE0ED956FFB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5016	rundll32.exe
6	5016	rundll32.exe
19	5016	rundll32.exe
25	5016	rundll32.exe
30	5016	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
4	api.ipify.org
5	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 5068	5016	rundll32.exe	89
PID 5016 wrote to memory of 5068	5016	rundll32.exe	89
PID 5016 wrote to memory of 2496	5016	rundll32.exe	91
PID 5016 wrote to memory of 2496	5016	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
1⤵
- Badlisted process makes network request
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5016-1-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-7-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-17-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-19-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-18-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-16-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-15-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-14-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-13-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-12-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-11-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-10-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-9-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-8-0x000002383C780000-0x000002383C861000-memory.dmp

Download

memory/5016-107-0x000002383C780000-0x000002383C861000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads