Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 08:16
General
- Target a824bc75d5e76a8e91a6c15501d9c68f723d4d92ea8217f906024ed217a36a42.exe
- Size 4.6MB
- Sample260802-j6cvqafe97
- SHA256 a824bc75d5e76a8e91a6c15501d9c68f723d4d92ea8217f906024ed217a36a42
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 16 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a824bc75d5e76a8e91a6c15501d9c68f723d4d92ea8217f906024ed217a36a42.exe"C:\Users\Admin\AppData\Local\Temp\a824bc75d5e76a8e91a6c15501d9c68f723d4d92ea8217f906024ed217a36a42.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a824bc75d5e76a8e91a6c15501d9c68f723d4d92ea8217f906024ed217a36a42.exe"C:\Users\Admin\AppData\Local\Temp\a824bc75d5e76a8e91a6c15501d9c68f723d4d92ea8217f906024ed217a36a42.exe" --uiaccess2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/4252-8-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-10-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-2-0x0000000001BC0000-0x0000000001BC1000-memory.dmp
memory/4252-4-0x0000000001BC0000-0x0000000001BC1000-memory.dmp
memory/4252-3-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-5-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-6-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-7-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-17-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-16-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-9-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-11-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-12-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-13-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-14-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/4252-15-0x0000000000DB0000-0x0000000001251000-memory.dmp
memory/5108-0-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/5108-1-0x0000000000DB0000-0x0000000001251000-memory.dmp