7c3bafccbda007cc0ccf17047471e927f11c39eebec67b9676c83340242cee2b

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VibraLCE.exe
Size 204.0MB
Sample260724-bykllaea75
SHA256 7c3bafccbda007cc0ccf17047471e927f11c39eebec67b9676c83340242cee2b
MD5 d444e1cfcd080d19bc8d787324fe6f54
SHA1 524a4556b408c05766e2db653182dea6fa54f7eb
SHA512 3fe7dcbe6cc5189624881cae603bea3087f506f0963be4d4815342f10205a6dc21a9718ad613f91186ab3e1615c4646e98ab3d5c8f32fba0e50792573a108f53
SSDEEP 1572864:tB4PuKuPCPGv6p3GWhe6RdAzNoJcEcm08jPF9aWbfEA32pKGv8WzXgGDPexfcK1X:zvuNB36/HlMjZ
TLSH
T15CA88B03E29A41D9C05DD175575A9233FEB1B8094724F3DF2BA447522FA6EE82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	VibraLCE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	VibraLCE.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	VibraLCE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	VibraLCE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	VibraLCE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	VibraLCE.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4668	VibraLCE.exe
4668	VibraLCE.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe
Token: SeShutdownPrivilege	4220	VibraLCE.exe
Token: SeCreatePagefilePrivilege	4220	VibraLCE.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 5052	4220	VibraLCE.exe	83
PID 4220 wrote to memory of 5052	4220	VibraLCE.exe	83
PID 4220 wrote to memory of 4392	4220	VibraLCE.exe	84
PID 4220 wrote to memory of 4884	4220	VibraLCE.exe	85
PID 4220 wrote to memory of 988	4220	VibraLCE.exe	87
PID 4220 wrote to memory of 988	4220	VibraLCE.exe	87
PID 4220 wrote to memory of 4668	4220	VibraLCE.exe	102

C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe
"C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe"
1⤵
- Checks computer location settings
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe
  "C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\vibralce" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,13158562997493064908,3501677170340805145,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  PID:5052
- C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe
  "C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\vibralce" --field-trial-handle=1756,i,13158562997493064908,3501677170340805145,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  PID:4392
- C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe
  "C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\vibralce" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1756,i,13158562997493064908,3501677170340805145,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2604 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4884
- C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe
  "C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\vibralce" --field-trial-handle=1756,i,13158562997493064908,3501677170340805145,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:988
- C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe
  "C:\Users\Admin\AppData\Local\Temp\VibraLCE.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\vibralce" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,13158562997493064908,3501677170340805145,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\vibralce\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\vibralce\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\vibralce\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\vibralce\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\vibralce\Network\Network Persistent State
Size 628B
SHA256 bd4806593a1ab13ae94f279c17cc5dec52a6a679410fa15d19c33b712b8a8d97
MD5 282166b0bb4bdff103927347bedb4c90
SHA1 e333ad63a06a81a9030ebead40bab23b9ddb49c4
SHA512 082857d18b646c2bb76768ac6a68ef5caa4b5557a15f0c3d70f3d3b2181dd166a2f97f25df42e3e07841f69da340515420627784c0023f1e233415a85d5a8854
TLSH
T199F049E6D7E806BD4A6253F42A603E63C1FE0008035C6C0389E8AF1F57E1475910058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe599215.TMP

Path C:\Users\Admin\AppData\Roaming\vibralce\Network\Network Persistent State~RFe599215.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\vibralce\config.json
Size 372B
SHA256 3336bc44236511e61af061f00e243c6ea66ed66d72e19962179ecebdf5e76ce9
MD5 8be5366bc4e15c5e1dea854d2d67503a
SHA1 7aae7f21f43af7fbe26d443b5cba98bc6834db1c
SHA512 0d2509f05131fb92fc8adeb640241a65aa3092196c3966995bc3d88cfc9706a14ee72fa5fd8974635fcf6132efe4d44cf3640076f43edc9b364e5179e40e9652
TLSH
T125E02693A77F58BFA808A7098D3E95CF416D4073A0882CD7A18E0958230347400FBD57
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-4857072416ffd1d0

Path C:\Users\Admin\AppData\Roaming\vibralce\config.json.tmp-4857072416ffd1d0
Size 429B
SHA256 b569cdb668ba29150d3a8a0579d59aa9fe2b02ab35ea2c64c9abba3484bffc67
MD5 2d515130747e863d618be0f4bb4e92c7
SHA1 439b9b55d7361f7e51a5ca5e65eba45752c20f46
SHA512 5b8a597bb5d70b720256d6884cdcc2b3e50f76e540f6ba828d27ff2be64f48dc14e08e422d29780a6bdddb365f574633ba774fb417f1702225c42c53616d4913
TLSH
T157E02293A77F58FFA808A7094D3EA5EB466E8023A0C829DBA18D0818520347940FBD5B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4668-339-0x0000023D240B0000-0x0000023D240B1000-memory.dmp

Download

memory/4668-338-0x0000023D240B0000-0x0000023D240B1000-memory.dmp

Download

memory/4668-337-0x0000023D240B0000-0x0000023D240B1000-memory.dmp

Download

memory/4668-350-0x0000023D240B0000-0x0000023D240B1000-memory.dmp

Download

memory/4668-349-0x0000023D240B0000-0x0000023D240B1000-memory.dmp

Download

memory/4668-348-0x0000023D240B0000-0x0000023D240B1000-memory.dmp

Download

memory/4668-347-0x0000023D240B0000-0x0000023D240B1000-memory.dmp

Download

memory/4668-346-0x0000023D240B0000-0x0000023D240B1000-memory.dmp

Download

memory/4668-345-0x0000023D240B0000-0x0000023D240B1000-memory.dmp

Download

memory/4668-344-0x0000023D240B0000-0x0000023D240B1000-memory.dmp

Download