Overview

overview

7

Static

static

3

devmarker.exe

windows10-2004-x64

7

devmarker.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 12:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    devmarker.exe
  • Size 3.3MB
  • Sample260710-pcfbmsa17m
  • SHA256 e6b97cb8c9bc93ff0e851d785eed4daaa2c1411e6f032398060896c02af51351
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionspywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Kills process with taskkill 12 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\devmarker.exe
    "C:\Users\Admin\AppData\Local\Temp\devmarker.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM chrome.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4364
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM GoogleCrashHandler.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5076
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM GoogleCrashHandler64.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5852
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM elevation_service.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4440
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM chrome.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2936
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM GoogleCrashHandler.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2024
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM GoogleCrashHandler64.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1072
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM elevation_service.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5260
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM chrome.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4852
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM GoogleCrashHandler.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5008
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM GoogleCrashHandler64.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2044
    • C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM elevation_service.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3980

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        manifest.json
        • Path C:\Users\Admin\AppData\Local\Packages\Extensions\jbdekjdllckeenhfeciecbkcemjbibem\1.99.2\manifest.json
        • Size 1KB
        • SHA256 74fe27c190c73555d7ea88ae84faca0ae6c9ca6ea1187eea72cb24b59f713016
        • MD5 SHA1 SHA512 TLSH
        Submit Download