4b788dc59db568205a6180f30bae301d6107896ee3e80c1edca4017c9bee5bed

Analysis

max time kernel
299s
max time network
229s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SacramentoZum.exe
Size 2.1MB
Sample260804-w48wlaxdpc
SHA256 4b788dc59db568205a6180f30bae301d6107896ee3e80c1edca4017c9bee5bed
MD5 25d4dc16ff90dad6221c7846336f357f
SHA1 03e70215222767e6fde4a379b7979d31bf5f12ef
SHA512 a8f2312b5bad3e09dd913bc0197c49f26c62e31b9464ded2b440b92746f567fd737424f2da6997b9284abc0b3cd48f658f85d575b42adbeb700c2f4acc60f00b
SSDEEP 49152:2FgFI1VciQbuls6SVZO4/AYMqvainRcchDuBSwujCxW3QsZ6BveK:AZVM03SVZSYMqvaiRcchDsSbjWW3nZCe
TLSH
T15BA52362A3D50576D8FAAB3C86B642AB17317E6D567C5D8B13C4C81E1F33A918A3034F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3668	AutoIt3.exe
5368	AutoIt3.exe
3948	mqJDgzQjgyKf.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3668 set thread context of 5368	3668	AutoIt3.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5684	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3668	AutoIt3.exe
3668	AutoIt3.exe
3668	AutoIt3.exe
3668	AutoIt3.exe
3668	AutoIt3.exe
3668	AutoIt3.exe
3668	AutoIt3.exe
3668	AutoIt3.exe
5368	AutoIt3.exe
5368	AutoIt3.exe
3948	mqJDgzQjgyKf.exe
3948	mqJDgzQjgyKf.exe
3948	mqJDgzQjgyKf.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3668	AutoIt3.exe
3668	AutoIt3.exe
3668	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3668	AutoIt3.exe
3668	AutoIt3.exe
3668	AutoIt3.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 5684	2424	SacramentoZum.exe	80
PID 2424 wrote to memory of 3668	2424	SacramentoZum.exe	82
PID 3668 wrote to memory of 5368	3668	AutoIt3.exe	83
PID 3668 wrote to memory of 5368	3668	AutoIt3.exe	83
PID 3668 wrote to memory of 5368	3668	AutoIt3.exe	83
PID 5368 wrote to memory of 3192	5368	AutoIt3.exe	84
PID 5368 wrote to memory of 3192	5368	AutoIt3.exe	84
PID 5368 wrote to memory of 2492	5368	AutoIt3.exe	87
PID 5368 wrote to memory of 2492	5368	AutoIt3.exe	87
PID 5368 wrote to memory of 3948	5368	AutoIt3.exe	90

C:\Users\Admin\AppData\Local\Temp\SacramentoZum.exe
"C:\Users\Admin\AppData\Local\Temp\SacramentoZum.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig.exe /?syndrome accessed locations guy msgstr bibliography wound
  2⤵
  - Gathers network information
  PID:5684
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Basename.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2492
  - - C:\Users\Admin\AppData\Local\mqJDgzQjgyKf.exe
      "C:\Users\Admin\AppData\Local\mqJDgzQjgyKf.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5D9DB353-1840-556F-74AB-0807FC83501F.txt

Path C:\ProgramData\5D9DB353-1840-556F-74AB-0807FC83501F.txt
Size 64B
SHA256 bbfeb05e1567d10f38e693c245a25187c97f0bd4b794b58fb218c867bf7c1979
MD5 368e7a10d2720ebc33fe8743c798ac14
SHA1 18ba08b2a387562ade16d4ebcd5660865d83fd01
SHA512 65719b6b53463ee28bbe07833a4eb9d2a2c636d1e61befc70d2b9968af5923337d16beae0dfd236a61925fc832f40ea7aca69aa902e0ea4aee4eec0caea51abb
TLSH
T167A00221255C0C9019970C868B7964C114BD158574F7946FEEE8A09354F6C41525DA39
MD5 SHA1 SHA512 TLSH

Submit Download

5D9DB353-1840-556F-74AB-0807FC83501F.txt

Path C:\ProgramData\5D9DB353-1840-556F-74AB-0807FC83501F.txt
Size 64B
SHA256 1b13372721948480ec9501a168908dc583ee30606b3bfde5665c64ddd7aac7c2
MD5 30dade351bfee106d77315ef79405aab
SHA1 ead03250cae0704f72bf326abd6dbfd3bb30eb3d
SHA512 1d24f74ae264a5fb08005c8b1674d38bdc5188a031f085c246f7f50ac342b3fd9598159e82f796898c1bc90e434951a9bff107d20b7abf1174bba5d7652f15fb
TLSH
T13BA002BEEC80005B485F4128556E0BDD7A6EA4D901645D85958244668964D8F55E02D5
MD5 SHA1 SHA512 TLSH

Submit Download

background.ts-D6ogNSgd.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\F33E95738F4C070C4E42171B1D40A3BC11992AD136FF460171B3CFA2893124E4\e0\assets\background.ts-D6ogNSgd.js
Size 19KB
SHA256 3e0970de3b2b12a70d8cf0f09f6a78e23ec056c1a7065fccd245d3fdd1f9c861
MD5 82f4bf36fa090579f493c116a5e2c1a9
SHA1 cdbadb9d956784eda03edb94e4e1b95d20b0b2a8
SHA512 9c6ad6cf05e4cc41dc887e1123f698a5f6b75d7ead736e36d253b58f111a890bd4b63cd14c691a154f0e2507fb0a5cd3bf9b5588e6a3cd541f37f37af73f0b0e
SSDEEP 384:LhGacWt1UArM8iwIVP4svuUtCGRhxdno4o/ZDE/v6fqvTprRqA660aOvBMI4M2nC:LEacWt17rM8iwCP4svuUtCGRhnno4o/5
TLSH
T1EC92FB59317A2070E6E535F8A0774241B2398B347409C0A2B13E8E757D6ED46997EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\F33E95738F4C070C4E42171B1D40A3BC11992AD136FF460171B3CFA2893124E4\e0\manifest.json
Size 1KB
SHA256 a68297b6ff8218690abddc5ef63de45cd126695a4e677e3e3a2be087a7c6ac2c
MD5 ac45ab511f5530abc94313434adaf432
SHA1 febec023387908b6be72a9dfba895d886ed1e60e
SHA512 f7aeb6110d091b0ebcd5f19d50588eeb84980fa7fbe80238cb99458d52189709a417c9f3b2e2393b89fe08b66f8b6e87f3881431e1acb452e4f90e796b1d6e05
TLSH
T19D310025D9685C6B03CCAB302DFA4987A50509879D947C1C7ADE800C8FBD61F02FBB9C
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Basename.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Basename.a3x
Size 1.5MB
SHA256 235eb6c67d041c6e1d82645ba0826d9868c84b1e09b12936c84327ca4d1f069e
MD5 554c2c8a125781c3ce28fcbe34b00d11
SHA1 1d7915f81342c2afbd7d0be299c5e3ada69011b8
SHA512 e3431048a08e18cbbd9ddcb32a0fcffa54858208a830fc27b862916afdcbc31c6bfec24f283255a963b919c34b436f4e2b2a889a28be245534b75fa5e3543e14
SSDEEP 49152:ymchv917UmSVaOPaAyMqV1JCBlcehji4ct:ym2FTSVaoyMqV1JQlcehW4ct
TLSH
T1327533EAF00A5A7E48FA793E4315127F3602767C14EC8D214A9DC90E0AB7726C9617DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mqJDgzQjgyKf.exe

Path C:\Users\Admin\AppData\Local\mqJDgzQjgyKf.exe
Size 8.8MB
SHA256 539ba287959675b42d20c3b907c0c9a35d52f164c71c7412196ecabdc655e4c0
MD5 d51a85d2701bbbab243518a2a0c1cd26
SHA1 a5ba82b16ea5091ef07d3110b35724aad1046f6e
SHA512 1e1053df51ad4e1645d982e2fefa69a3ca2bc1247c22e00fac1e040ea227425af5031c463a7202e24bbe71735d9cf88dff47165a3f249eb913c409b870a01d5f
SSDEEP 98304:iYTCosUljaV9ILAg0ao8/ijRelB3E5W1F2k9zGGabD9u:iyNlGV9IAg/x/oIlS540k9Labw
TLSH
T1B096CF0B7A9848F6C199E731C4A71345BAB4780E4B3437D32EA1AEB86F717C19E75B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3668-7-0x00007FFDFBAC0000-0x00007FFDFBCC9000-memory.dmp

Download

memory/3668-8-0x000001EB3A9F0000-0x000001EB3A9F1000-memory.dmp

Download

memory/3948-93-0x0000000140000000-0x00000001403B9000-memory.dmp

Download

memory/3948-91-0x0000000140000000-0x00000001403B9000-memory.dmp

Download

memory/3948-94-0x0000000140000000-0x00000001403B9000-memory.dmp

Download

memory/3948-92-0x0000000140000000-0x00000001403B9000-memory.dmp

Download

memory/5368-16-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-70-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-18-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-20-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-15-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-14-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-17-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-13-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-22-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-34-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-23-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-19-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-24-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-90-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-87-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-25-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-27-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-26-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-21-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-11-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download

memory/5368-10-0x00000233D75F0000-0x00000233D76C7000-memory.dmp

Download