61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45

Analysis

max time kernel
38s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45.exe
Size 121KB
Sample260730-lt2pesfd22
SHA256 61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45
MD5 2980c33b9f0de038fc408602fbf34187
SHA1 995793cde6debc9daad92f2ba42bd255a39a2870
SHA512 67d2cb6c71470fe78cee4a2aba35c138d93d97cb69e6d1cfd3fbefc69593efd821efc6a2df00de469aab3572b3f6f951dbfdb493ad64318d1420ee6ed1548935
SSDEEP 1536:KjPSF6+cSOSp0wKO/Vt2FHeA0MlSvktbDnbDnijr1cgPVI+PEy/LW/KfAWkxwv:KLuITw5/VCmMlSvkdijruzo/LV
TLSH
T160C382A5B2D91CCBE651927C82D6E232753CB8E107139B971A3459334FA9FC33AE4643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2608	svchost32.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
2608	svchost32.exe
4496	msedgeupdate.exe
2084	svchost32.exe

Loads dropped DLL 3 IoCs

pid	Process
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	svchost32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}	61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32	61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHelper\\WinSyncProvider.dll"	61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32\ThreadingModel = "Both"	61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2680	schtasks.exe
2220	schtasks.exe
1892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2608	svchost32.exe
2608	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe
2084	svchost32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	svchost32.exe
Token: SeDebugPrivilege	2084	svchost32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 2220	4776	61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45.exe	88
PID 4776 wrote to memory of 2608	4776	61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45.exe	90
PID 2608 wrote to memory of 4496	2608	svchost32.exe	91
PID 2608 wrote to memory of 2052	2608	svchost32.exe	92
PID 2608 wrote to memory of 1892	2608	svchost32.exe	94
PID 2084 wrote to memory of 1748	2084	svchost32.exe	98
PID 2084 wrote to memory of 2680	2084	svchost32.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45.exe
"C:\Users\Admin\AppData\Local\Temp\61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "MicrosoftEdgeUpdateBase" /xml "C:\Users\Admin\AppData\Local\Temp\~df0e586de8.tmp" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2220
- C:\Users\Admin\AppData\Roaming\WindowsHelper\svchost32.exe
  "C:\Users\Admin\AppData\Roaming\WindowsHelper\svchost32.exe" --cleanup "C:\Users\Admin\AppData\Local\Temp\61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Users\Admin\AppData\Roaming\EdgeUpdate\msedgeupdate.exe
    "C:\Users\Admin\AppData\Roaming\EdgeUpdate\msedgeupdate.exe" --watchdog
    3⤵
    - Executes dropped EXE
    PID:4496
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn "MicrosoftEdgeUpdateBase" >NUL 2>NUL
    3⤵
    PID:2052
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /create /tn "MicrosoftEdgeUpdateBase" /xml "C:\Users\Admin\AppData\Local\Temp\~df0e5870a7.tmp" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1892

C:\Users\Admin\AppData\Roaming\WindowsHelper\svchost32.exe
C:\Users\Admin\AppData\Roaming\WindowsHelper\svchost32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn "MicrosoftEdgeUpdateBase" >NUL 2>NUL
  2⤵
  PID:1748
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "MicrosoftEdgeUpdateBase" /xml "C:\Users\Admin\AppData\Local\Temp\~df0e587a6b.tmp" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ch809A.tmp

Path C:\Users\Admin\AppData\Local\Temp\ch809A.tmp
Size 138KB
SHA256 3c8c0f7aad84f267a4b3ab4a160c51d73c184680c610ea05e91880137c028b3f
MD5 02ae92575ef0af2d24e8d554a12db686
SHA1 223239119452390e905a1a68b5b6f09d159d85e7
SHA512 bb29d751d5479a8b75176dcbc4c0830094f3f9878d38e2fff961dc1fc40f07b1d21c91894dd30c2221caa6a7bbd7c6925bec0a38053f3b2763f10a0015df8a1e
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2O3pX6rq3VumXwkA:zeuvBnhJsueMEGvIW1DcP2OxhVumXnA
TLSH
T168D3974B3A743002EDE59A721CE054BB5E3C717D4F52A5D428B620588EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ch80AF.tmp

Path C:\Users\Admin\AppData\Local\Temp\ch80AF.tmp
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mod_0e587d59_d9748c80.dll

Path C:\Users\Admin\AppData\Local\Temp\mod_0e587d59_d9748c80.dll
Size 547KB
SHA256 6e35a2ea945c53377ef4534ced5254a59e2ccb7b021194aafeb70a5ecd41f460
MD5 d0665d36ee99f81ec66a09c38e3a297e
SHA1 6d6b40e984494aad8f967e2341f388081c0fe4c7
SHA512 55a2690c523466b0ab2bd933a4c5ddfb32fac288ec33e793119c92bd29e929a2bd47eb09cf602d29ca0bd788661d66f098cc183047f74c3ca71e69cfb236379e
SSDEEP 12288:jc8oQusEYKPYH1v9nJ9ORpBF3pzc+QtLPUyyB3Ggl:48oQXKYLLYpX3pY+mAyaGgl
TLSH
T1C2C48FAD22845AC8FFDF4B3005AD11DE924E0D735BBB1A9147A219EFDF21152ADB72C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mod_0e587e43_d9688a80.dll

Path C:\Users\Admin\AppData\Local\Temp\mod_0e587e43_d9688a80.dll
Size 290KB
SHA256 c0745e07474b41ee398a8e11734f28ed20a0c21c7be23e6269b783b8753bcdac
MD5 47e05294c1d1c39224a35d903a01fc95
SHA1 a1a9a5c6f14f4b705f5ed6eb23d8a360d37f4b2f
SHA512 44508e10b82f5bd87b1b8c9e5ee358c65a4b7d56c9a929a67a1539acb8470beebec07aa154a52aca675a26fe3711a60d16c68b850d7423ec96897da3855d229f
SSDEEP 6144:/JlAB92fXzgKo6kSyrNdEtGZtPcLYbMPvKEiGVGqB3:hVUKo63CNdEwcLYbMvxicGqB3
TLSH
T1DF54F796B2C56DDAEA17D27852DBE232743E7C9047235F9717305A324F31F81B6A8B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mod_0e58824a_d983b550.dll

Path C:\Users\Admin\AppData\Local\Temp\mod_0e58824a_d983b550.dll
Size 23KB
SHA256 1d25a6e27e8c1d0e6a477319d664e1549b539cdc87ce3df449bac4d3d4bfa12e
MD5 9cefc523a8ad06392b422e85c598ecd4
SHA1 c8b7f84d828d33d13784c2b701bcaaa59ce764f9
SHA512 4231d337d2a9fb60eed8084d89c43f9bfcbfb1969f92294cadfa17b1a9b5d1534a9bced8d639d1435915b9012f1257eca786792cea049b274b66a4503ee59944
SSDEEP 384:7LrNDOzZgvjTjGx6VNfUe4utmoIRy9VZ+7V829j:BDVjTjGGP4ucovWV8
TLSH
T120B21809E25328ADD51EC13981FE5A32F571BC8127715BFF13A0F73A1E206E56B39A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~df0e586de8.tmp

Path C:\Users\Admin\AppData\Local\Temp\~df0e586de8.tmp
Size 3KB
SHA256 24e456a8631a48897ac4ebc2ca666dfbd5f9992308454f8a2fd8b297ddfc507c
MD5 27b241ac618ed462eae40bcb6c6686dc
SHA1 1f128fb827802fff0107af34e0db2362c4a10c2b
SHA512 da40f3274cbf6fe1b2d87e8ec62d4ff45a9d7fc6d611cdbe9770cdaf1c8211f8ffc042c8093209f36f0f50c80c8980b75f8bdf35e26531991d433f513f226249
TLSH
T19751354367FA1109F1F36B2CAEB624618E6BBD556938C46D00AC240CCBF7D2285A07B7
MD5 SHA1 SHA512 TLSH

Submit Download

svchost32.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHelper\svchost32.exe
Size 121KB
SHA256 61858e50c96a6f37957e1d6e3249ddb49ebd5c592ddce8dacf039404897afe45
MD5 2980c33b9f0de038fc408602fbf34187
SHA1 995793cde6debc9daad92f2ba42bd255a39a2870
SHA512 67d2cb6c71470fe78cee4a2aba35c138d93d97cb69e6d1cfd3fbefc69593efd821efc6a2df00de469aab3572b3f6f951dbfdb493ad64318d1420ee6ed1548935
SSDEEP 1536:KjPSF6+cSOSp0wKO/Vt2FHeA0MlSvktbDnbDnijr1cgPVI+PEy/LW/KfAWkxwv:KLuITw5/VCmMlSvkdijruzo/LV
TLSH
T160C382A5B2D91CCBE651927C82D6E232753CB8E107139B971A3459334FA9FC33AE4643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download