Analysis
- user interaction
yes - max time kernel
26s - max time network
48s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 01:53
General
- Target evil.exe
- Size 75.5MB
- Sample260723-ca2ewazalb
- SHA256 2ca5f5b71a9df0075f93c598f7cd56d3243f9126af56d8e79fff76c79238ef43
Malware Config
Signatures
- Clears Windows event logs 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell to get system information as a root user.
- Loads dropped DLL 38 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Modifies registry class 1 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\evil.exe"C:\Users\Admin\AppData\Local\Temp\evil.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\evil.exe"C:\Users\Admin\AppData\Local\Temp\evil.exe"2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName, productState | ConvertTo-Json"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AmServiceEnabled | ConvertTo-Json"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-StoredCredential | Select-Object Target, UserName, Password, Type, Persist | ConvertTo-Json"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\vaultcmd.exevaultcmd /list3⤵
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-StoredCredential -Type RDP | Select-Object Target, UserName, Password | ConvertTo-Json"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-StoredCredential | Where-Object {$_.Target -like \"*Outlook*\" -or $_.Target -like \"*Microsoft*\" -or $_.Target -like \"*Office*\" -or $_.Target -like \"*Live*\" -or $_.Target -like \"*Hotmail*\" -or $_.Target -like \"*Exchange*\"} | Select-Object Target, UserName, Password | ConvertTo-Json"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-PSDrive | Where-Object {$_.Provider -like \"*FileSystem*\" -and $_.Root -ne $null} | Select-Object Name, Root | ConvertTo-Json"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\net.exenet use3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-StoredCredential | Select-Object * | ConvertTo-Json -Depth 3"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\wevtutil.exewevtutil cl System3⤵
- Clears Windows event logs
-
-
C:\Windows\SYSTEM32\wevtutil.exewevtutil cl Security3⤵
- Clears Windows event logs
-
-
C:\Windows\SYSTEM32\wevtutil.exewevtutil cl Application3⤵
- Clears Windows event logs
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
_imaging.cp314-win_amd64.pyd
_imagingmath.cp314-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
md.cp314-win_amd64.pyd
md__mypyc.cp314-win_amd64.pyd
__init__.py
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_multiarray_umath.cp314-win_amd64.pyd
_psutil_windows.pyd
python3.DLL
python314.dll
pywintypes314.dll
select.pyd
Lorem ipsum.txt
sqlite3.dll
ucrtbase.dll
unicodedata.pyd
win32api.pyd
__PSScriptPolicyTest_tsi3n3ab.mbp.ps1
memory/1004-1238-0x00007FF83FD30000-0x00007FF84306D000-memory.dmp
memory/1004-1217-0x00007FF83FD30000-0x00007FF84306D000-memory.dmp
memory/1588-1212-0x000001EFFFBB0000-0x000001EFFFBCC000-memory.dmp
memory/1588-1209-0x000001EF99900000-0x000001EF999B2000-memory.dmp
memory/1588-1210-0x000001EFFFB30000-0x000001EFFFB4E000-memory.dmp
memory/1588-1211-0x000001EFFF770000-0x000001EFFF77A000-memory.dmp
memory/1588-1213-0x000001EF999C0000-0x000001EF999C8000-memory.dmp
memory/1588-1214-0x000001EF999D0000-0x000001EF999D6000-memory.dmp
memory/1588-1215-0x000001EFFF780000-0x000001EFFF78A000-memory.dmp
memory/4324-1176-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1177-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1179-0x000001E2DB140000-0x000001E2DB16A000-memory.dmp
memory/4324-1164-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1166-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1183-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1161-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1160-0x00007FF844A1F000-0x00007FF844A20000-memory.dmp
memory/4324-1181-0x000001E2DB2E0000-0x000001E2DB4A2000-memory.dmp
memory/4324-1180-0x000001E2DB140000-0x000001E2DB164000-memory.dmp
memory/4324-1178-0x000001E2DACD0000-0x000001E2DACDA000-memory.dmp
memory/4324-1184-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1165-0x000001E2DAC20000-0x000001E2DAC42000-memory.dmp
memory/4324-1173-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1175-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1174-0x000001E2DAF00000-0x000001E2DAFB2000-memory.dmp
memory/4324-1172-0x000001E2DAEE0000-0x000001E2DAEFE000-memory.dmp
memory/4324-1169-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1168-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/4324-1167-0x00007FF844890000-0x00007FF845234000-memory.dmp
memory/5960-1190-0x000001F2E7500000-0x000001F2E7A28000-memory.dmp