8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 08:16

Target
8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e.exe
Size 14.3MB
Sample260706-j6dr1sf14r
SHA256 8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e
MD5 b05cec6a1c2af73ec7cae54320420afe
SHA1 c76896bb70d97a95690af03cad29c051ece24fdf
SHA512 1e829a8899a6edb2d12e9f648bd1245bcbca858cc14ad3d5a49d36dcc4e62aa765583abad278a63061958b9ae242bc21ffdb5dfbe7e2408cee2ef61c8fdfc5cf
SSDEEP 196608:kkQl3+HmF+Dch/F2ZIGULqo0VbncOKuHim7kKkPFWkyurrX2PUUR59M7ae92Z+:dQQGF+DO/AUuVcmlCFWkyurrmP59Zes
TLSH
T165E60143FA9986E9C09EC178875A5323EB72FC8D0620B39B67D44B212F57B602F5D358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
3200	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2880	8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e.exe
2880	8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e.exe
2880	8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3200	2880	8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e.exe	87
PID 2880 wrote to memory of 4772	2880	8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e.exe	89

C:\Users\Admin\AppData\Local\Temp\8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e.exe
"C:\Users\Admin\AppData\Local\Temp\8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\ipconfig.exe
  "ipconfig" /all
  2⤵
  - Gathers network information
  PID:3200
- C:\Windows\system32\netsh.exe
  "netsh" wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4772