8c0e799108d8f1686839102cc81ec4cc9008b810e722d2a8dd1401d20e956a08

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VanishRaider-main/main.exe
Size 6.5MB
Sample260804-qqdweaxyhw
SHA256 8c0e799108d8f1686839102cc81ec4cc9008b810e722d2a8dd1401d20e956a08
MD5 c754cf71a51c8ac7e121e155ab310dc5
SHA1 a6006efcf466c07d65b1dddc3549fa387b8dd60f
SHA512 adbdf71cedba4742c84de8419178483bae3eb359bf02ac9cd08a93da130ae84e667265f6d39e80c77a7b9b10c96cd26f97f92a0a858ab78c2af12a86028fa0fc
SSDEEP 98304:ytaW5AskzTC6AEjsB/3DNTLQYLTrAS4rAStn3TfV:SchyPhFR4rASd9
TLSH
T17E663321F2CE1C56A75254F8B0FEF6BA917A6D78B4639008F1ED6BA0C01CB0D16F157A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery persistence spyware stealer upx

Malware Config

Signatures

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 3 IoCs

pid	Process
4764	wu_3568.exe
6064	wu.exe
5264	wu_6064.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate\\wu.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate\\wu.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3568-0-0x00007FF6A6F90000-0x00007FF6A97D8000-memory.dmp	upx
behavioral2/memory/3568-7-0x00007FF6A6F90000-0x00007FF6A97D8000-memory.dmp	upx
behavioral2/files/0x000e00000001c52a-18.dat	upx
behavioral2/memory/6064-20-0x00007FF726C20000-0x00007FF729468000-memory.dmp	upx
behavioral2/memory/6064-104-0x00007FF726C20000-0x00007FF729468000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wu_3568.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wu_3568.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wu_3568.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2100	reg.exe
5504	reg.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
1848	chrome.exe
2856	msedge.exe
2856	msedge.exe
4764	wu_3568.exe
4764	wu_3568.exe
4764	wu_3568.exe
4764	wu_3568.exe
4764	wu_3568.exe
4764	wu_3568.exe
4764	wu_3568.exe
4764	wu_3568.exe
4764	wu_3568.exe
4764	wu_3568.exe
4764	wu_3568.exe
4764	wu_3568.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 2100	3568	main.exe	89
PID 3568 wrote to memory of 4764	3568	main.exe	91
PID 4764 wrote to memory of 1848	4764	wu_3568.exe	94
PID 4764 wrote to memory of 1848	4764	wu_3568.exe	94
PID 4764 wrote to memory of 2856	4764	wu_3568.exe	98
PID 4764 wrote to memory of 2856	4764	wu_3568.exe	98
PID 6064 wrote to memory of 5504	6064	wu.exe	99
PID 6064 wrote to memory of 5264	6064	wu.exe	101

C:\Users\Admin\AppData\Local\Temp\VanishRaider-main\main.exe
"C:\Users\Admin\AppData\Local\Temp\VanishRaider-main\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2100
- C:\Users\Admin\AppData\Local\Temp\wu_3568.exe
  C:\Users\Admin\AppData\Local\Temp/wu_3568.exe
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2856

C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe
C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5504
- C:\Users\Admin\AppData\Local\Temp\wu_6064.exe
  C:\Users\Admin\AppData\Local\Temp/wu_6064.exe
  2⤵
  - Executes dropped EXE
  PID:5264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 c41016a00953ea9a2a775520f9f9f275394f5d765efa44fcb03816c8918769d6
MD5 f772068e479b713872a9385d26e4c750
SHA1 7b8f0b9bed78bddb1e0409bb19233ba2995cc5ea
SHA512 ba5ee93e319f2ac20f2631990c595cf253360a64883c445acb64252a963a427052e6cd47b61e07124f5f15f5eaa7b6fe4dcf72a3fe90acda7121289bd76e98af
TLSH
T19061ED4798D9C90E2790E4D3D371E25CDAE088587FCD37219B99C88D34CA81AF5CA787
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 0f21c4cc3757cb31137ad389c9b23b969173f33e90a4ae2b657426f1a18ef0d8
MD5 1ffb848c191b900a696f7f3d6049b99d
SHA1 45b7c3b3b0f870d8195e358645d3d7c570e96117
SHA512 13fbbbef02d2eddcb012d1e037b0e2b502cb8e1f607b30b97431b4a604d974d1baaefb8c0c7a224057a7ac6f27d2c24c90b176c38718d99463f39424b39033ab
TLSH
T13271DE4798D9C91E2790E4D39371E26CDAF088587FCD37219B99C88D34C681AF5CA787
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 84cb0f53f7e354a643baf5918a941ca7a151765535b40460b10369e5e0afdb37
MD5 402a5fa273a762f892263e4f4be4ae83
SHA1 cf03ead7d05e9a532db67ad652a477f9855c7236
SHA512 4a059adb73c47b9e0955f95a5668eeb0bc1fc4aff503389ff97936cbd56a15ae9ad62498d5c29ac59ee794b3b2b4aeeeb1000c416097876223ebb7d9a193996c
SSDEEP 96:Y/adB5/q/6G/eG/t/YImudj5mvmpGmqmGesld+djtfGudPeh8vTJpfMkdfndfjfT:5v5Tklz2ex05hF7wEK
TLSH
T10791F00699EACA1F2790E4E39771E25CD5F088487FC937219BA5C88D34D680EF5C6787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 254B
SHA256 95b7fc78051d2e91c08c6347f8a8b6865b33718ac95aae9832b21ffcf0ba4f4c
MD5 af0fecd784a923a0b8a531e2193fc402
SHA1 d2f3304e6260322be851c322c13e6f4331f1a854
SHA512 23e4a5bb229caca8144d0dd9bdec6a890532a695f7e268ff3e361e533ad466ccac28195adc071db302305a574ffe74a7dadc595af6620ce4c530a6a670096ae1
TLSH
T167D09712EC82C0CC26A2E4B78300556DDCFF4018AB590303BB86808D14C0B0C9CCB3EA
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1017B
SHA256 7ccb577dce2fa4635dec435c09808599992dd1c4a343223d2a93bbeca0134246
MD5 c805811222d82d83553c23a60a2afc24
SHA1 1053a2aba88471c610e6b3a0b723fa11e7978828
SHA512 0880d52f5e9da40b61b7ead94d9c4051be75eaded69710f38c3880e3e8c79e2926a654b695984bbf04e6befb256dbc2a63354e6d7307fce992f244fdc707bc90
TLSH
T1DF117B02BCC5D82E1140E8E39361B66C9CE484049BCE2B429B85D98C75C582EF5CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 f0c1f9c646cb6aca2ff6849b028ee4f29b5d93ef301bf74de23ebd40ad86d243
MD5 9169f1cf0d4ebde0ddbad6dc131fafd5
SHA1 09679af3a05a3da9eee2fbaf38ac64a57d4a291d
SHA512 f73fd0ef93d61bd0c99b171aaeafe53d300cd27a5fa17ebd89271130ab21dfda49e9aaed75eb6c5ed25f1f459d994776e91f6954762e82014f14a8572266e54a
TLSH
T10F316903F9C6D82E1200ACD39351AA6C98F94408ABCE2B469B44D88CB4C695EF5CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 a4dc39fb536d7f1ee4e97a1008431d9406bc8ab7918767834ccd574aa706bcd9
MD5 667f0de50731656c10fba4abf56ef442
SHA1 4b72010294cf0364812c916e676dc7dfed55e140
SHA512 e2ba72beca75c855106ad5f817822bbfb55fac8d78e1fb79f2611bdf5bec68042a6859cd3a6b82490ae17976f446fb9d6e54a8f59066791f52b4161f13d7b1a4
TLSH
T1C5317B02F9C6D82E2200ACD39355EA6C98E484499BCE3B465B44D88CB48685EF6DF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 108a041d53825a61fcaac4318fdd7e80865b5237cfe309e78ca3fd4cae07da97
MD5 a26077741254ff24590e9ca771f92b41
SHA1 548eff02081b9a139255982e1444fd4b12090be8
SHA512 91e2591ed40faddaccf5eeb440a2903e1aa5a2b4c1f33b131b6dd2f460f12fb755e5618763df1d8f88bd7bacf77b26b7ff2cd5c40a367223a0b308884ac26097
TLSH
T144318B02F9C6D82E1100BCD39355EA6C98E484489BCE3B469B44D84CB58685AF6CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 e7a29a0ac9e6c9a043fe7cc105a16ac417210f616306e30fb09870843e48b924
MD5 641383e89c4c4333f1b309b16ea12836
SHA1 d120440b392a6983f67e2d822b16c1a0cab13af8
SHA512 7601eefdf10907abef85f54ff21d27faa0be7fa907715558adff1cb28250d70c2340102773c1d3732eb6280777fd9793495354f941bcddcb7d6b9a9a29b21017
TLSH
T19A41DB47E8C5D81E1614B8D3E311A61C99F484989BCE3B425B89C88C74CA52BF6CE757
MD5 SHA1 SHA512 TLSH

Submit Download

wu_3568.exe

Path C:\Users\Admin\AppData\Local\Temp\wu_3568.exe
Size 4.4MB
SHA256 8443b816a7044cddfb02171659631586ce512b8af45df18a188dbd49fe98fa24
MD5 f6fdf939b2a9cae28ededec12d500eee
SHA1 6b7663d594277e4073bf936514d54771204ee1a4
SHA512 8f121994fe4c8876c69dd97865b3e907149e298b1e5ca4e7b4876948bf12ab7578ac4730ed29f9dd7bb9e078ac9e3bb671d11049f6c97225e8b6a8943af516fe
SSDEEP 49152:S2ZWOiJd/WaAeJ8TzXnrDfBuqWRCDLNaLKtnoQ+p7WSv6o08XZ+Hjjrs21T6Je7I:SPWaVJIfDfBz+H6D4Gs2cGiCFSL9yd
TLSH
T16E26B0E6BA5260ACC425C9F0535E935D66E07DB1C054FFAE26308333DA62B89F63B714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wu.exe

Path C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe
Size 6.5MB
SHA256 8c0e799108d8f1686839102cc81ec4cc9008b810e722d2a8dd1401d20e956a08
MD5 c754cf71a51c8ac7e121e155ab310dc5
SHA1 a6006efcf466c07d65b1dddc3549fa387b8dd60f
SHA512 adbdf71cedba4742c84de8419178483bae3eb359bf02ac9cd08a93da130ae84e667265f6d39e80c77a7b9b10c96cd26f97f92a0a858ab78c2af12a86028fa0fc
SSDEEP 98304:ytaW5AskzTC6AEjsB/3DNTLQYLTrAS4rAStn3TfV:SchyPhFR4rASd9
TLSH
T17E663321F2CE1C56A75254F8B0FEF6BA917A6D78B4639008F1ED6BA0C01CB0D16F157A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3568-0-0x00007FF6A6F90000-0x00007FF6A97D8000-memory.dmp

Download

memory/3568-7-0x00007FF6A6F90000-0x00007FF6A97D8000-memory.dmp

Download

memory/4764-187-0x00007FF6D1B80000-0x00007FF6D3986000-memory.dmp

Download

memory/4764-178-0x00007FF6D1B80000-0x00007FF6D3986000-memory.dmp

Download

memory/4764-184-0x00007FF6D1B80000-0x00007FF6D3986000-memory.dmp

Download

memory/4764-192-0x00007FF6D1B80000-0x00007FF6D3986000-memory.dmp

Download

memory/4764-202-0x00007FF6D1B80000-0x00007FF6D3986000-memory.dmp

Download

memory/4764-204-0x00007FF6D1B80000-0x00007FF6D3986000-memory.dmp

Download

memory/4764-206-0x00007FF6D1B80000-0x00007FF6D3986000-memory.dmp

Download

memory/4764-208-0x00007FF6D1B80000-0x00007FF6D3986000-memory.dmp

Download

memory/5264-115-0x00007FF6F8D90000-0x00007FF6FAB96000-memory.dmp

Download

memory/6064-104-0x00007FF726C20000-0x00007FF729468000-memory.dmp

Download

memory/6064-20-0x00007FF726C20000-0x00007FF729468000-memory.dmp

Download