Analysis
- user interaction
yes - max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 17:07
General
- Target WindowsHostManager.exe
- Size 2.4MB
- Sample260807-vm262ssyex
- SHA256 8e9e5ca3458523a6f8fdcf8131987414ee9f82e4ba34a36041e6431f0b1e96aa
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowsHostManager.exe"C:\Users\Admin\AppData\Local\Temp\WindowsHostManager.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe"C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
WindowsHostManager.exe
memory/4860-6-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/4860-2-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/4860-1-0x000001D80B2E0000-0x000001D80B550000-memory.dmp
memory/4860-5-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/4860-3-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/4860-0-0x00007FFC72F2F000-0x00007FFC72F30000-memory.dmp
memory/5860-9-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5860-8-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5860-10-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5860-11-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5860-12-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/5860-17-0x0000020A43A80000-0x0000020A43A96000-memory.dmp
memory/5860-18-0x0000020A5C520000-0x0000020A5C532000-memory.dmp