Analysis
- geolocation tags
- max time kernel
298s - max time network
186s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 06:38
General
- Target VolcanoExecutor/libwinpthread-1.dll
- Size 25.6MB
- Sample260802-heflvsvvcs
- SHA256 852030540e77516fcad10c3f639c07b6fd8ca05887099e0d63783edda0a24102
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VolcanoExecutor\libwinpthread-1.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\93a87676\4d2634e4.dll",Collect C:\Users\Admin\AppData\Local\Temp\93a87676\20653fe7.job2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
20653fe7.job
20653fe7.job.ok
225fa5a9
2a24eabb
446dabf0
4d2634e4.dll
797cff64
9bd7e566
a60381f9
adee522e
b655655d
bfc8b9d8
db4e73c9
f04e0015
f6dd9d12
memory/1760-16-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-81-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-17-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-15-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-13-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-14-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-52-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-12-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-11-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-10-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-9-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-8-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-55-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-54-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-53-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-51-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-65-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-7-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-6-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-72-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-5-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-4-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-67-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-75-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-3-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-0-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-86-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-85-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-84-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-2-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-78-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-87-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-88-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-1-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-64-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-63-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-89-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-90-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-91-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-92-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-93-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-94-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-95-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-96-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-97-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-98-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-99-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-100-0x0000000500000000-0x000000050023A000-memory.dmp
memory/1760-101-0x0000000500000000-0x000000050023A000-memory.dmp