Analysis
- max time kernel
299s - max time network
213s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
05/07/2026, 15:59
General
- Target sslconf.exe
- Size 29KB
- Sample260705-te21msdw4w
- SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
Malware Config
Signatures
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sslconf.exe"C:\Users\Admin\AppData\Local\Temp\sslconf.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\DarkSeaGreenChartreuse\sslconf.exe"C:\ProgramData\DarkSeaGreenChartreuse\sslconf.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
sslconf.exe
tempdir.dll
vcruntime140.dll
Log.txt
Log.txt
Log.txt
Log.txt
Log.txt
Log.txt
Log.txt
Log.txt
Log.txt
Log.txt
memory/4352-0-0x00007FFE39400000-0x00007FFE39876000-memory.dmp
memory/4352-1-0x00007FFE39400000-0x00007FFE39876000-memory.dmp
memory/4352-4-0x00007FFE39400000-0x00007FFE39876000-memory.dmp
memory/4804-7-0x00007FFE39400000-0x00007FFE39876000-memory.dmp
memory/4804-20-0x00007FFE39400000-0x00007FFE39876000-memory.dmp
memory/4804-10-0x0000000140000000-0x0000000141E02000-memory.dmp
memory/4804-9-0x00007FFE39400000-0x00007FFE39876000-memory.dmp
memory/4804-160-0x0000000140000000-0x0000000141E02000-memory.dmp
memory/4804-179-0x0000000140000000-0x0000000141E02000-memory.dmp
memory/4804-182-0x00007FFE39400000-0x00007FFE39876000-memory.dmp
memory/4804-221-0x0000000140000000-0x0000000141E02000-memory.dmp
memory/4804-222-0x00007FFE39400000-0x00007FFE39876000-memory.dmp
memory/4804-225-0x00007FFE39400000-0x00007FFE39876000-memory.dmp