b55ed6b16561b9e453442063ab68211ceadb4ca0465c5913f4719d7e4d699545

Analysis

user interaction
yes
max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:23

Target
stealer.exe
Size 175KB
Sample260801-br81lsbe23
SHA256 b55ed6b16561b9e453442063ab68211ceadb4ca0465c5913f4719d7e4d699545
MD5 c1e483517a4b5dfd9b99c869b75d1202
SHA1 9206bd534cfc73b221d8f53ff0756d6b66ac0af3
SHA512 94c7fefe1db9a612b2686fcc3e035ae35ac739a8f8aa4baec0c846695d446f13623f1ec984f8a1ec5e3da78c7326241ea48de1614fff67b4ef861b6a94d27d15
SSDEEP 3072:uAh3ChJGM9y31aGlNgLFZBfD7WRUErTKdXkNGSm:uFhJGM9y31DNgLLnS2Z
TLSH
T168047C56B3A910F9E0678238C9914A06F77274224770AFEF43A44776EF236D1AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

flow	ioc
1	ident.me
2	ident.me

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
4600	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

pid	Process
4600	cmd.exe
6040	netsh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4600	3524	stealer.exe	89
PID 4600 wrote to memory of 6040	4600	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\stealer.exe
"C:\Users\Admin\AppData\Local\Temp\stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6040