4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Size 4.6MB
Sample260731-q3hecsvxcs
SHA256 4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8
MD5 dbf0f03147fd6077aeb202b68a5dc948
SHA1 9b9bf391a24eee06b2268cc626ea0a71f0e39c02
SHA512 75794e2124dc09bb7bd5798f9a883896f2f2ca3b43b4270b713e1dd9a719e644f2fc27f6b3b4e8e44f89007bc4513e9202da16f4af378649c3c95ff079e8ba32
SSDEEP 49152:HqJ8E8oLLASg5WbvKqegAitdBwQ+RyE/H5mKMQUzuoDFB:Hq63CSgAitdBwQ+RyhKMQSB
TLSH
T1C1266C137348A03FE06B1A3A5C77D710593FB66029138E5FA7F48A5C8E763806E2E657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
20	api.ipify.org

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe = "1"	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOMSTORAGE\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe = "1"	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOMSTORAGE	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe = "0"	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe = "1"	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe = "11001"	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_WEBGL	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_WEBGL\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe = "1"	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe = "0"	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe = "0"	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\KLRemota.Cliente.Notify.v2	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\KLRemota.Cliente.Notify.v2\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe,0"	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1596	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
1596	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
2288	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
2288	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	1596	4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe

C:\Users\Admin\AppData\Local\Temp\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
"C:\Users\Admin\AppData\Local\Temp\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596
- C:\Users\Admin\AppData\Local\Temp\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
  "C:\Users\Admin\AppData\Local\Temp\4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe" --uiaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-0-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/1596-2-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/1596-1-0x0000000000500000-0x000000000099E000-memory.dmp

Download

memory/1596-10-0x0000000000500000-0x000000000099E000-memory.dmp

Download

memory/2288-11-0x00000000012C0000-0x00000000012C1000-memory.dmp

Download

memory/2288-15-0x00000000012C0000-0x00000000012C1000-memory.dmp

Download

memory/2288-14-0x0000000000500000-0x000000000099E000-memory.dmp

Download

memory/2288-18-0x0000000000500000-0x000000000099E000-memory.dmp

Download

memory/2288-19-0x0000000000500000-0x000000000099E000-memory.dmp

Download

memory/2288-20-0x0000000000500000-0x000000000099E000-memory.dmp

Download

memory/2288-21-0x0000000000500000-0x000000000099E000-memory.dmp

Download

memory/2288-22-0x0000000000500000-0x000000000099E000-memory.dmp

Download