b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281

Analysis

max time kernel
40s
max time network
38s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe
Size 10.3MB
Sample260730-lt7wfayybt
SHA256 b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281
MD5 3eac0ca11847844f7b223a1892bc62b6
SHA1 fb7c537686c19c0fa80ae7e390469afdd46c1b26
SHA512 07255e691d6d875074c494b3d8ba1a69fa50f7456f79f89d0d085b246b335eb9c365533b70fa80c3334912f3e48542e700983ee0a73ed0948ed348b19ab7bec7
SSDEEP 98304:spcJfdWCxfZkerNyYEMwH1ZmN6HV0ewFanjE:sWfWWfZRrzN6HKelw
TLSH
T1A7B63957E87541A5E0AED136C6669163BA713C88CF3863D72B90F7242F72BD06EB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1444	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
124	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	4	Go-http-client/1.1

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
3368	taskkill.exe
5872	taskkill.exe
4980	taskkill.exe
4984	taskkill.exe
1692	taskkill.exe
484	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
124	powershell.exe
124	powershell.exe
124	powershell.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	484	taskkill.exe
Token: SeDebugPrivilege	3368	taskkill.exe
Token: SeDebugPrivilege	5872	taskkill.exe
Token: SeDebugPrivilege	4980	taskkill.exe
Token: SeDebugPrivilege	4984	taskkill.exe
Token: SeDebugPrivilege	1692	taskkill.exe
Token: SeDebugPrivilege	124	powershell.exe
Token: SeIncreaseQuotaPrivilege	124	powershell.exe
Token: SeSecurityPrivilege	124	powershell.exe
Token: SeTakeOwnershipPrivilege	124	powershell.exe
Token: SeLoadDriverPrivilege	124	powershell.exe
Token: SeSystemProfilePrivilege	124	powershell.exe
Token: SeSystemtimePrivilege	124	powershell.exe
Token: SeProfSingleProcessPrivilege	124	powershell.exe
Token: SeIncBasePriorityPrivilege	124	powershell.exe
Token: SeCreatePagefilePrivilege	124	powershell.exe
Token: SeBackupPrivilege	124	powershell.exe
Token: SeRestorePrivilege	124	powershell.exe
Token: SeShutdownPrivilege	124	powershell.exe
Token: SeDebugPrivilege	124	powershell.exe
Token: SeSystemEnvironmentPrivilege	124	powershell.exe
Token: SeRemoteShutdownPrivilege	124	powershell.exe
Token: SeUndockPrivilege	124	powershell.exe
Token: SeManageVolumePrivilege	124	powershell.exe
Token: 33	124	powershell.exe
Token: 34	124	powershell.exe
Token: 35	124	powershell.exe
Token: 36	124	powershell.exe
Token: SeDebugPrivilege	1444	tasklist.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 484	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	89
PID 4264 wrote to memory of 3368	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	92
PID 4264 wrote to memory of 5872	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	94
PID 4264 wrote to memory of 4980	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	96
PID 4264 wrote to memory of 4984	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	98
PID 4264 wrote to memory of 1692	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	100
PID 4264 wrote to memory of 124	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	104
PID 4264 wrote to memory of 4848	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	106
PID 4264 wrote to memory of 4848	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	106
PID 4264 wrote to memory of 5820	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	108
PID 4264 wrote to memory of 5820	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	108
PID 4264 wrote to memory of 1444	4264	b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe	110

C:\Users\Admin\AppData\Local\Temp\b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe
"C:\Users\Admin\AppData\Local\Temp\b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3368
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5872
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4984
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -c "$kb = try { (Get-WinUserLanguageList | % { $_.LocalizedName }) -join ' / ' } catch { 'Unknown' }; $p = Get-CimInstance Win32_Processor | Select -First 1; \"$kb\"; \"$($p.NumberOfCores)\"; \"$($p.NumberOfLogicalProcessors)\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5820
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cd_17622511.db

Path C:\Users\Admin\AppData\Local\Temp\cd_17622511.db
Size 138KB
SHA256 64b20f8301a750c24fddb911af9e442d7a21f4556897517d84094e0e30a5b092
MD5 d1ac818018a8ee4ab7dc0913418c586e
SHA1 031e126715af76419944fd25e12d50a814102cf2
SHA512 abdc778d603c6f79a8bdd0397a1c4cd6fc9bf018af767e080b4f001131b160ed17a181c17effeff7b5392361087be65a05d95dddc22ac8a67642fc5d636a9179
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OhGVumjnP/n:FnbZeMrv/hGthSnPP
TLSH
T11BD3874B3A743002EDE69A722CE0517B5E3CB16D4F5595D428B620688EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd_400048603.db

Path C:\Users\Admin\AppData\Local\Temp\cd_400048603.db
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ck_4264_1785405054873726900.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_4264_1785405054873726900.bin
Size 32B
SHA256 8994fdfaf36e4b24ca61e0adcb25a9bd3336bb392ccfd074c9dc9e03f4011935
MD5 851a5b1bfe38b93919d3a908eca227b3
SHA1 45e4d6274a5c51a666a28f137b9e1bda8c2e6390
SHA512 d8d69cba5a3bdedaec0a9bc9476c7ecff275244b4db0aae71636e63f981c89131153e73322fccd0a619e378d860160977d5848f787799809f58b579b27acaabc
MD5 SHA1 SHA512