4b788dc59db568205a6180f30bae301d6107896ee3e80c1edca4017c9bee5bed

Analysis

max time kernel
298s
max time network
249s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SacramentoZum.exe
Size 2.1MB
Sample260804-w48wlaxdpc
SHA256 4b788dc59db568205a6180f30bae301d6107896ee3e80c1edca4017c9bee5bed
MD5 25d4dc16ff90dad6221c7846336f357f
SHA1 03e70215222767e6fde4a379b7979d31bf5f12ef
SHA512 a8f2312b5bad3e09dd913bc0197c49f26c62e31b9464ded2b440b92746f567fd737424f2da6997b9284abc0b3cd48f658f85d575b42adbeb700c2f4acc60f00b
SSDEEP 49152:2FgFI1VciQbuls6SVZO4/AYMqvainRcchDuBSwujCxW3QsZ6BveK:AZVM03SVZSYMqvaiRcchDsSbjWW3nZCe
TLSH
T15BA52362A3D50576D8FAAB3C86B642AB17317E6D567C5D8B13C4C81E1F33A918A3034F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5112	AutoIt3.exe
3608	AutoIt3.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5112 set thread context of 3608	5112	AutoIt3.exe	93

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
924	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5112	AutoIt3.exe
5112	AutoIt3.exe
5112	AutoIt3.exe
5112	AutoIt3.exe
5112	AutoIt3.exe
5112	AutoIt3.exe
5112	AutoIt3.exe
5112	AutoIt3.exe
3608	AutoIt3.exe
3608	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5112	AutoIt3.exe
5112	AutoIt3.exe
5112	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5112	AutoIt3.exe
5112	AutoIt3.exe
5112	AutoIt3.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 924	2888	SacramentoZum.exe	86
PID 2888 wrote to memory of 5112	2888	SacramentoZum.exe	88
PID 5112 wrote to memory of 3608	5112	AutoIt3.exe	93
PID 5112 wrote to memory of 3608	5112	AutoIt3.exe	93
PID 5112 wrote to memory of 3608	5112	AutoIt3.exe	93
PID 3608 wrote to memory of 3804	3608	AutoIt3.exe	94
PID 3608 wrote to memory of 3804	3608	AutoIt3.exe	94
PID 3608 wrote to memory of 1800	3608	AutoIt3.exe	97
PID 3608 wrote to memory of 1800	3608	AutoIt3.exe	97
PID 3608 wrote to memory of 2352	3608	AutoIt3.exe	106
PID 3608 wrote to memory of 2352	3608	AutoIt3.exe	106
PID 3608 wrote to memory of 4716	3608	AutoIt3.exe	112
PID 3608 wrote to memory of 4716	3608	AutoIt3.exe	112

C:\Users\Admin\AppData\Local\Temp\SacramentoZum.exe
"C:\Users\Admin\AppData\Local\Temp\SacramentoZum.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig.exe /?syndrome accessed locations guy msgstr bibliography wound
  2⤵
  - Gathers network information
  PID:924
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Basename.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

58E8E1CB-7F68-3C27-5CA3-B03F64FB78D7.txt

Path C:\ProgramData\58E8E1CB-7F68-3C27-5CA3-B03F64FB78D7.txt
Size 64B
SHA256 9967364f911cc34f7fdf1cec554ec8e524373627d0e77236e2dcb4bc5d008a46
MD5 7c8ed5186eed90a60d70380fb0ca7c4f
SHA1 9f5154e2601c5c481c4206f5e980e62c9fcedf98
SHA512 ace63483f4580fa03a11ede2ed4d43d6f03d9fa9e7bfb464f7954ab38838e46e05d7fa02af2246a8f242f6a1e5f94d7c8662a76230f2ff6ebfa43d7a8993aaef
TLSH
T16DA0220EC00A00C0302EB828A0E2E2AA0A80300AB0B0200003B2CE832300230B800CAA
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Basename.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Basename.a3x
Size 1.5MB
SHA256 235eb6c67d041c6e1d82645ba0826d9868c84b1e09b12936c84327ca4d1f069e
MD5 554c2c8a125781c3ce28fcbe34b00d11
SHA1 1d7915f81342c2afbd7d0be299c5e3ada69011b8
SHA512 e3431048a08e18cbbd9ddcb32a0fcffa54858208a830fc27b862916afdcbc31c6bfec24f283255a963b919c34b436f4e2b2a889a28be245534b75fa5e3543e14
SSDEEP 49152:ymchv917UmSVaOPaAyMqV1JCBlcehji4ct:ym2FTSVaoyMqV1JQlcehW4ct
TLSH
T1327533EAF00A5A7E48FA793E4315127F3602767C14EC8D214A9DC90E0AB7726C9617DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3608-22-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-17-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-11-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-19-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-20-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-27-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-25-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-26-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-23-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-66-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-18-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-10-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-16-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-15-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-14-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-24-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-13-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-65-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-34-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/3608-41-0x000001F91F0A0000-0x000001F91F177000-memory.dmp

Download

memory/5112-7-0x00007FF9E0490000-0x00007FF9E0685000-memory.dmp

Download

memory/5112-8-0x000002A398A80000-0x000002A398A81000-memory.dmp

Download