188d03e509eaab7b23df6a8dfacb9d1fcebd646a02bc7716ae5aa556de7df3cb

Analysis

user interaction
yes
max time kernel
37s
max time network
42s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
recon.exe
Size 10.9MB
Sample260723-bgc57aydmg
SHA256 188d03e509eaab7b23df6a8dfacb9d1fcebd646a02bc7716ae5aa556de7df3cb
MD5 3f8311501c68d07c2f354976664bf244
SHA1 fc1335cbac1a321e7135da626c3c7bdbb9a18dac
SHA512 86ecc1fe1c98ba84efe42908ada2b6675ecc24c8396e5886b11ca730e16ef2c150ea5aa1c66739481e59a53f97b6af884244d6de72267d05c6c5f9b673bd240c
SSDEEP 98304:yDefzsSlZJ40uoGAm2I1E0etmteHXaneqN4zJWGoPkZjB+YWCg/0:yA4SeAmsztv3AeqN4zEGoPEvb
TLSH
T113B67C43EC9515E9C1AE923289B78212BB71BC490B3263D71B60F2387F76BD06DB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com
1	discord.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4124	cmd.exe
1836	ARP.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1788	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3424	cmd.exe
3904	cmd.exe
3492	cmd.exe
1388	cmd.exe
4484	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1164	netsh.exe
3904	cmd.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4688	NETSTAT.EXE
4484	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4688	NETSTAT.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1788	powershell.exe
1788	powershell.exe
4828	recon.exe
4828	recon.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeIncreaseQuotaPrivilege	1788	powershell.exe
Token: SeSecurityPrivilege	1788	powershell.exe
Token: SeTakeOwnershipPrivilege	1788	powershell.exe
Token: SeLoadDriverPrivilege	1788	powershell.exe
Token: SeSystemProfilePrivilege	1788	powershell.exe
Token: SeSystemtimePrivilege	1788	powershell.exe
Token: SeProfSingleProcessPrivilege	1788	powershell.exe
Token: SeIncBasePriorityPrivilege	1788	powershell.exe
Token: SeCreatePagefilePrivilege	1788	powershell.exe
Token: SeBackupPrivilege	1788	powershell.exe
Token: SeRestorePrivilege	1788	powershell.exe
Token: SeShutdownPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeSystemEnvironmentPrivilege	1788	powershell.exe
Token: SeRemoteShutdownPrivilege	1788	powershell.exe
Token: SeUndockPrivilege	1788	powershell.exe
Token: SeManageVolumePrivilege	1788	powershell.exe
Token: 33	1788	powershell.exe
Token: 34	1788	powershell.exe
Token: 35	1788	powershell.exe
Token: 36	1788	powershell.exe
Token: SeDebugPrivilege	4688	NETSTAT.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3424	4828	recon.exe	90
PID 4828 wrote to memory of 1788	4828	recon.exe	91
PID 4828 wrote to memory of 3904	4828	recon.exe	93
PID 3904 wrote to memory of 1164	3904	cmd.exe	94
PID 4828 wrote to memory of 3492	4828	recon.exe	95
PID 3492 wrote to memory of 2700	3492	cmd.exe	96
PID 4828 wrote to memory of 4124	4828	recon.exe	97
PID 4124 wrote to memory of 1836	4124	cmd.exe	98
PID 4828 wrote to memory of 1388	4828	recon.exe	99
PID 1388 wrote to memory of 2900	1388	cmd.exe	100
PID 4828 wrote to memory of 4484	4828	recon.exe	101
PID 4484 wrote to memory of 4688	4484	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\recon.exe
"C:\Users\Admin\AppData\Local\Temp\recon.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-CimInstance Win32_VideoController).Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\system32\cmd.exe
  cmd /c "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1164
- C:\Windows\system32\cmd.exe
  cmd /c "vaultcmd /list"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\system32\VaultCmd.exe
    vaultcmd /list
    3⤵
    PID:2700
- C:\Windows\system32\cmd.exe
  cmd /c arp -a
  2⤵
  - Network Service Discovery
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\system32\ARP.EXE
    arp -a
    3⤵
    - Network Service Discovery
    PID:1836
- C:\Windows\system32\cmd.exe
  cmd /c route print
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\system32\ROUTE.EXE
    route print
    3⤵
    PID:2900
- C:\Windows\system32\cmd.exe
  cmd /c netstat -ano
  2⤵
  - Executes a command shell one-liner
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4688