47854afb3cfeb64a85dda148e00e5ca83168f431a28e5c5fb28733e37f484b13

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PhysicianBed.exe
Size 2.1MB
Sample260802-rcc8dsba87
SHA256 47854afb3cfeb64a85dda148e00e5ca83168f431a28e5c5fb28733e37f484b13
MD5 4f8d31ea9c92ca7d2da3c6438f1c8ea1
SHA1 23039d7c9ae5ce061abef48d04444983d3da15d1
SHA512 ce3e554d39bcac6043b10be569bf8dd4771b66ea506ce2db2f76d48ed88d60906b0cc0e135e2a0cda7b0424db361254198066dfca253583ce029b7acc9128a1b
SSDEEP 49152:BmTaEKDOfJ+XPE+b/Ap8miduNrCIZJ1q51SAP:B8PKR8+Lmid4rn1qC
TLSH
T181A5231223E94482D4BA173A89F554576A31FC628B7236CF72D6FDAE1A13EE4F430316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2092	AutoIt3.exe
5404	AutoIt3.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 5404	2092	AutoIt3.exe	89

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2092	AutoIt3.exe
2092	AutoIt3.exe
2092	AutoIt3.exe
2092	AutoIt3.exe
2092	AutoIt3.exe
2092	AutoIt3.exe
2092	AutoIt3.exe
2092	AutoIt3.exe
5404	AutoIt3.exe
5404	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2092	AutoIt3.exe
2092	AutoIt3.exe
2092	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2092	AutoIt3.exe
2092	AutoIt3.exe
2092	AutoIt3.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 2092	4032	PhysicianBed.exe	86
PID 2092 wrote to memory of 5404	2092	AutoIt3.exe	89
PID 2092 wrote to memory of 5404	2092	AutoIt3.exe	89
PID 2092 wrote to memory of 5404	2092	AutoIt3.exe	89
PID 5404 wrote to memory of 5764	5404	AutoIt3.exe	97
PID 5404 wrote to memory of 5764	5404	AutoIt3.exe	97
PID 5404 wrote to memory of 6132	5404	AutoIt3.exe	103
PID 5404 wrote to memory of 6132	5404	AutoIt3.exe	103

C:\Users\Admin\AppData\Local\Temp\PhysicianBed.exe
"C:\Users\Admin\AppData\Local\Temp\PhysicianBed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Oregon.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0AE68595-2716-3AA1-9A4D-FE9942856611.txt

Path C:\ProgramData\0AE68595-2716-3AA1-9A4D-FE9942856611.txt
Size 64B
SHA256 ff91dac14d100cab3618ff208bf889e3e8243eb586a870f7fe66bba205b22fc9
MD5 ede5e877d8eeb6435f4ffcb1ad7bdbf8
SHA1 6429ad7e78cd31257815fe1749f6c17896a525fd
SHA512 ad7f27fcfd55e7178753f97b043f325bb29f1b0ed99050b56a72b9fc10aee03b0d156d807b5720c74b1d3cc407c4f8c34a3c53c929ae490dc94ee2c7302a313f
TLSH
T1B5A00274755651768C5297815425B4C9147A867D51C1BC103430DFB903A545E2D49168
MD5 SHA1 SHA512 TLSH

Submit Download

0AE68595-2716-3AA1-9A4D-FE9942856611.txt

Path C:\ProgramData\0AE68595-2716-3AA1-9A4D-FE9942856611.txt
Size 64B
SHA256 64d96eb53b593f030481d2a4838db342aedf97823e884936d5d92c1abb6c3818
MD5 e971e2927b3419de3f43e4a4b26b1548
SHA1 b9d684700bf31b808d7e5a7d40b46d7ea62b1079
SHA512 4068d5213bf46ae65c5249dafdf2d6104ab01781b7737a326d493ec5e0e1a029e256c827e46bd3020f14334aed6927396bb038628430df1534fe252cd4b549c3
TLSH
T119A0025260159DE555C1DF8453CB881565B44F2D5F251D10168BB94423E1D8713428F5
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oregon.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Oregon.a3x
Size 1.4MB
SHA256 d736aec3cb877ab557bbdc76065d57e6677e69f12b371bd5f09d537baa6be1ed
MD5 b6018d66101e861b618f3b583f2b755f
SHA1 10850fa997758628accc575de1a20ab6e886c08c
SHA512 fe901ee11ebad28d58e54034539045af95822fd50cab9101be9281b6d7b694fb9e5f1849deadeecfb2490704c165e11a251ee9ab648eba771822d1dbcd7a7cce
SSDEEP 24576:VKSlUactLLrn4IajcH9GpX8OJ7NAM65MWcv/OYhduAry/dgKPDrjzPAI+tNR6/:VxMEfwdGpswqz5MWgxXuAjafOtNRk
TLSH
T12E653320256F6381C4B2680F45A56D322B617B71817132EBE4A7FDB6215FDACFC805AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2092-7-0x00007FFE5C270000-0x00007FFE5C465000-memory.dmp

Download

memory/2092-8-0x00000250FE660000-0x00000250FE661000-memory.dmp

Download

memory/5404-22-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-16-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-27-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-26-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-25-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-23-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-14-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-21-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-19-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-18-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-17-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-20-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-15-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-13-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-24-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-32-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-11-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-35-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-10-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-52-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download

memory/5404-53-0x000001B8E2210000-0x000001B8E22E7000-memory.dmp

Download