ba889221d2d608b764311dda6ef7d4d58a6a98ad1c29dbb513d508788db7c302

Analysis

max time kernel
164s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
23d5..exe
Size 190KB
Sample260730-gte37s1eng
SHA256 ba889221d2d608b764311dda6ef7d4d58a6a98ad1c29dbb513d508788db7c302
MD5 187070567a6841188dc78ad362e2e792
SHA1 2166307b5e354d801e5d76cff52d13578572db65
SHA512 bfa53aec7a8d58cba1382d76eac919e87b6be12ee32c174191b5afcec08537340c5e000b754e746e93a978c24ade8f5b62447b8b959e6030f4f5fc323bbe1583
SSDEEP 3072:Kgi9NEqoiLNDPK9ru92hTuzYnfbefexFiMGGYqTQT+C/nw2OgVByJQOn4MYWZgT:OGqoCPK89GTHnfbY2RIlyJQHM1Zs
TLSH
T1D014F2476D143036CC31057809AE85A34B6DC3DDB4980B3B38855BB97EE1A678F5A3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1540	elbef.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23d5..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elbef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1540	elbef.exe
1540	elbef.exe
1540	elbef.exe
1540	elbef.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5492	23d5..exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5492 wrote to memory of 1540	5492	23d5..exe	89
PID 1540 wrote to memory of 5080	1540	elbef.exe	90
PID 1540 wrote to memory of 5080	1540	elbef.exe	90
PID 1540 wrote to memory of 464	1540	elbef.exe	45
PID 1540 wrote to memory of 3160	1540	elbef.exe	47
PID 1540 wrote to memory of 3468	1540	elbef.exe	50
PID 1540 wrote to memory of 3296	1540	elbef.exe	57
PID 1540 wrote to memory of 4364	1540	elbef.exe	59
PID 1540 wrote to memory of 4420	1540	elbef.exe	60
PID 1540 wrote to memory of 4492	1540	elbef.exe	61
PID 1540 wrote to memory of 4764	1540	elbef.exe	63
PID 1540 wrote to memory of 5056	1540	elbef.exe	64
PID 1540 wrote to memory of 2864	1540	elbef.exe	65
PID 1540 wrote to memory of 5180	1540	elbef.exe	66
PID 1540 wrote to memory of 5224	1540	elbef.exe	67
PID 1540 wrote to memory of 2428	1540	elbef.exe	80
PID 1540 wrote to memory of 2908	1540	elbef.exe	81
PID 1540 wrote to memory of 5840	1540	elbef.exe	82
PID 1540 wrote to memory of 4888	1540	elbef.exe	83
PID 1540 wrote to memory of 5492	1540	elbef.exe	88
PID 5492 wrote to memory of 6092	5492	23d5..exe	91

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3160

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3296

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4364

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4492

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4764

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000270;0000000000000274;
1⤵
PID:5056

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:2864

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5180

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5224

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2428
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:2908
- - C:\Users\Admin\AppData\Local\Temp\23d5..exe
    "C:\Users\Admin\AppData\Local\Temp\23d5..exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Users\Admin\AppData\Roaming\Hisau\elbef.exe
      "C:\Users\Admin\AppData\Roaming\Hisau\elbef.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpc153739e.bat"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:6092

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5840

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials in Registry

T1552.002

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpc153739e.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpc153739e.bat
Size 189B
SHA256 278b3917bb61dac24731cedf8daad0edfa52468bc16cc0f91542902a26fa1107
MD5 263b45d4b6df4861194486818cc8ed56
SHA1 b0c1ba5a09f43aed4797f14490b2cf2551acb6d2
SHA512 f2dc2d05e20f81c376186061135863d94f9890d940f65a61694152fc3eeb7b8b7acd9d53fdebfe1718aa7d260882d28db0af9368993414b8796b8d976ef865d7
TLSH
T169C0120181CECA9A4808526B0AFE718CD1B91CE83F8A27105631C55D61D241DF5D7781
MD5 SHA1 SHA512 TLSH

Submit Download

elbef.exe

Path C:\Users\Admin\AppData\Roaming\Hisau\elbef.exe
Size 190KB
SHA256 c43a8a08acbd5d22298ccd5bc3065e6553edb6c576656e6416c34073e3aecb73
MD5 3b701fd9e0d9fcabdc0b1c25fbb4ecec
SHA1 4528decb0e916978483abc96debc6d8a9371b0ad
SHA512 691ed44dcbd8f9d2047688df5fdcbc82d216e5229a870b1c66edcef00a81faf6f39c2a6487e7486758c66398df5ce386827c6a369556b1cef1f092cfec1f0955
SSDEEP 3072:Kgi9NEqoiLNDPK9ru92hTuzYnfbefexFiMGGYqTQT+C/nw2OgVByJQOn4MYWeFgT:OGqoCPK89GTHnfbY2RIlyJQHM1Cs
TLSH
T1BE14F2466D153032CC31057809AF85A34B6DC2DDB4980B3B38855BB57FE1A678E6B3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-9-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1540-18-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5080-11-0x0000000000A60000-0x0000000000A91000-memory.dmp

Download

memory/5080-10-0x0000000000A60000-0x0000000000A91000-memory.dmp

Download

memory/5080-12-0x0000000000A60000-0x0000000000A91000-memory.dmp

Download

memory/5492-0-0x00000000023F0000-0x00000000023F9000-memory.dmp

Download

memory/5492-13-0x0000000002510000-0x0000000002541000-memory.dmp

Download

memory/5492-14-0x0000000002510000-0x0000000002541000-memory.dmp

Download

memory/5492-15-0x0000000002510000-0x0000000002541000-memory.dmp

Download

memory/5492-21-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5492-20-0x00000000023F0000-0x00000000023F9000-memory.dmp

Download

memory/5492-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/5492-2-0x0000000000400000-0x0000000000475000-memory.dmp

Download