Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/07/2026, 07:23
General
- Target 2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e.exe
- Size 6.9MB
- Sample260730-h7whsaeq21
- SHA256 2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 16 IoCs
Network activity triggered a Suricata alert
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e.exe"C:\Users\Admin\AppData\Local\Temp\2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e.exe"1⤵
- Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
circuit_timeouts.tmp
guards.json
memory/5860-93-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-95-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-81-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-82-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-83-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-92-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-78-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-80-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-96-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-97-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-98-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-99-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-108-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-109-0x00007FF76CD00000-0x00007FF76D3F5000-memory.dmp
memory/5860-110-0x00000217A0500000-0x00000217A08E1000-memory.dmp
memory/5860-120-0x000002179BB40000-0x000002179BB41000-memory.dmp