75048fcff427bc2182991de96e68ea18efbfa35705de34d4cde01e44804c0fe7

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.v2.exe
Size 30.5MB
Sample260803-nvcsssweme
SHA256 75048fcff427bc2182991de96e68ea18efbfa35705de34d4cde01e44804c0fe7
MD5 cf7e5356f0beafa915e721292f2838c4
SHA1 a292b0aad54a0b9fca40594ee28b6135bc2ca69e
SHA512 cfd37c709aff840358a416094fb7b9f7997a07b04136f44259af56a682e7928d826d7ffe882e5ba35ddb4d01289b2e5ea45965aef05f8c7ed93e4cdaa1ff444a
SSDEEP 393216:ZLqph2ypSiEcNJECDECs5iYCOLYgCig8sQeNut5AVnDii6Ss1DT9SfhVEBhz:ZLqphhICahDLBtVbD1DT9SfhMhz
TLSH
T1AE670260064DE248741F8731E3A0EC3EF2E9349A737AE9E96C2991D774513C293BD58B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1200	Loader.v2.exe
1200	Loader.v2.exe

C:\Users\Admin\AppData\Local\Temp\Loader.v2.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.v2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-0-0x0000027D5BB90000-0x0000027D5BB93000-memory.dmp

Download

memory/1200-1-0x00007FF732230000-0x00007FF7340B4000-memory.dmp

Download