6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe
Size 63KB
Sample260808-ltppvsdj5y
SHA256 6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53
MD5 edc363b70430949e73fcbd0dd1cf5f18
SHA1 798464efe355b352b1f8c42ac912b4e5b925dc74
SHA512 b19efb5b45a9844126cb88a379af2b51d4db61baaed5de977069dae3723fe9033f4c924cc055d2066d8a6bd6f6af4850aaa528f3ae60ab702df6814737667a50
SSDEEP 768:i6gjnkiPE8T8sEhhAwFnJJy8WY293ouz1ySYXN2aoeqAqy50N+UiRnqpq32g:LInk62RzDnNA3p1yjcye1iIpq32g
TLSH
T19953E11BB39348DED62BC575D3F35F38F9B0F82146915B3C46A0E4790E30A686AA2F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3364	powershell.EXE

Downloads MZ/PE file 6 IoCs

flow	pid	Process
26	4340	svchost.exe
9	832	svchost.exe
10	1200	svchost.exe
12	1200	svchost.exe
18	832	svchost.exe
23	4340	svchost.exe

Executes dropped EXE 5 IoCs

pid	Process
832	svchost.exe
1200	svchost.exe
6044	stealer.exe
4664	hvnc.exe
4340	svchost.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3364	powershell.EXE

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5884	certutil.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
1	ifconfig.me

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4632	cmd.exe
5264	cmd.exe
4672	cmd.exe
1784	cmd.exe
3900	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	hvnc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	hvnc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1476	schtasks.exe
776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2568	powershell.exe
2568	powershell.exe
3364	powershell.EXE
3364	powershell.EXE
3364	powershell.EXE

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	3364	powershell.EXE
Token: SeIncreaseQuotaPrivilege	3364	powershell.EXE
Token: SeSecurityPrivilege	3364	powershell.EXE
Token: SeTakeOwnershipPrivilege	3364	powershell.EXE
Token: SeLoadDriverPrivilege	3364	powershell.EXE
Token: SeSystemProfilePrivilege	3364	powershell.EXE
Token: SeSystemtimePrivilege	3364	powershell.EXE
Token: SeProfSingleProcessPrivilege	3364	powershell.EXE
Token: SeIncBasePriorityPrivilege	3364	powershell.EXE
Token: SeCreatePagefilePrivilege	3364	powershell.EXE
Token: SeBackupPrivilege	3364	powershell.EXE
Token: SeRestorePrivilege	3364	powershell.EXE
Token: SeShutdownPrivilege	3364	powershell.EXE
Token: SeDebugPrivilege	3364	powershell.EXE
Token: SeSystemEnvironmentPrivilege	3364	powershell.EXE
Token: SeRemoteShutdownPrivilege	3364	powershell.EXE
Token: SeUndockPrivilege	3364	powershell.EXE
Token: SeManageVolumePrivilege	3364	powershell.EXE
Token: 33	3364	powershell.EXE
Token: 34	3364	powershell.EXE
Token: 35	3364	powershell.EXE
Token: 36	3364	powershell.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3900	4136	6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe	88
PID 3900 wrote to memory of 1476	3900	cmd.exe	90
PID 4136 wrote to memory of 4632	4136	6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe	94
PID 4632 wrote to memory of 2648	4632	cmd.exe	96
PID 4632 wrote to memory of 2824	4632	cmd.exe	98
PID 3364 wrote to memory of 5884	3364	powershell.EXE	102
PID 3364 wrote to memory of 776	3364	powershell.EXE	103
PID 3364 wrote to memory of 2504	3364	powershell.EXE	104
PID 3364 wrote to memory of 4448	3364	powershell.EXE	105
PID 832 wrote to memory of 6044	832	svchost.exe	109
PID 1200 wrote to memory of 4664	1200	svchost.exe	110
PID 832 wrote to memory of 5264	832	svchost.exe	112
PID 5264 wrote to memory of 4932	5264	cmd.exe	114
PID 1200 wrote to memory of 4672	1200	svchost.exe	117
PID 4672 wrote to memory of 3428	4672	cmd.exe	119
PID 4340 wrote to memory of 1784	4340	svchost.exe	120
PID 1784 wrote to memory of 4684	1784	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe
"C:\Users\Admin\AppData\Local\Temp\6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "schtasks /create /tn "S0" /tr "powershell -ep bypass -f C:\Users\Public\setup.ps1" /sc once /st 00:00 /it /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "S0" /tr "powershell -ep bypass -f C:\Users\Public\setup.ps1" /sc once /st 00:00 /it /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\run.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn S0
    3⤵
    PID:2648
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn S0 /f
    3⤵
    PID:2824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -ep bypass -f C:\Users\Public\setup.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\system32\certutil.exe
  "C:\Windows\system32\certutil.exe" -decode C:\Users\Public\l.cer C:\Users\Public\svchost.exe
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5884
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn MU /tr C:\Users\Public\svchost.exe /sc once /st 00:00 /it /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:776
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /run /tn MU
  2⤵
  PID:2504
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /delete /tn MU /f
  2⤵
  PID:4448

C:\Users\Public\svchost.exe
"C:\Users\Public\svchost.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Public\stealer.exe
  C:\Users\Public\stealer.exe
  2⤵
  - Executes dropped EXE
  PID:6044
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SecurityHealth\" /t REG_SZ /d \"C:\Users\Public\svchost.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Windows\System32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SecurityHealth\" /t REG_SZ /d \"C:\Users\Public\svchost.exe\" /f
    3⤵
    PID:4932

C:\Users\Public\svchost.exe
C:\Users\Public\svchost.exe
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Public\hvnc.exe
  C:\Users\Public\hvnc.exe
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  PID:4664
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SecurityHealth\" /t REG_SZ /d \"C:\Users\Public\svchost.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SecurityHealth\" /t REG_SZ /d \"C:\Users\Public\svchost.exe\" /f
    3⤵
    PID:3428

C:\Users\Public\svchost.exe
"C:\Users\Public\svchost.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SecurityHealth\" /t REG_SZ /d \"C:\Users\Public\svchost.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SecurityHealth\" /t REG_SZ /d \"C:\Users\Public\svchost.exe\" /f
    3⤵
    PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 f54ade58f2e82c8916c44a344bb7d05a5814bfa84ed29e06d4881108c6063223
MD5 d7b2b67c4bcb4c416850eb8ff6855bbf
SHA1 cdb41e06c785bad46db641dbcc313e0b81ba387b
SHA512 8f5138fbaeb6110875235779f9be5b3f685fb68fc64e3e783dbedfb35d0c52900ac7b5feffc67dba9049be38041ace28efbe8492afe471a32bd565eaa2646f6d
SSDEEP 1536:AKLg07Yo2hk3MFfKQVCYxflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Vv:AKLg07Yo2hk3MFfKQVCYxflJd9YLqiUW
TLSH
T114636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_23zjm12y.ogs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_23zjm12y.ogs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hvnc.exe

Path C:\Users\Public\hvnc.exe
Size 1.9MB
SHA256 278762dfc0f743216a475919bdc9ecc59735bcc247bba5b7b468fc475407ec6a
MD5 f2ea42022380a711dcbbef1e699bb5d4
SHA1 86f6d64c4bbbe4521955f2e3fb21d07547ebab60
SHA512 815caed039fe3b9bd42c972ca20cb5c2478b605ff0f2bcdb87fa02a7caa0d064b5505b1d0b419808d0ee691268544f5ad8c040312804d99619d00dbaec73201f
SSDEEP 49152:62hv4e6rZPZVSEYf4PE2UFQeWtSCYsx+cOUmfihAEcm3Y2:TAGUEZn4+cM6hAgo2
TLSH
T1D1957C07E2A350ECC56BC174875BA772BE31B81901357DBF56A4CB302F51E606B6EB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l.cer

Path C:\Users\Public\l.cer
Size 5.4MB
SHA256 c348ab31e68e5888af45d1207c97cfe295ed2b44510e041e5dfae71b12e11052
MD5 d7824c4e9dc9a4cd7bb7ccfccbd06dcd
SHA1 2453527f10634ae18750ec49041b5f015d4b2f71
SHA512 145c1963213bb79d41be83dcf889d0b08f5ccfe448d340f7d7b83c1699818bc5be3cc58f9352812f2c877bbda84a815be910ddb6cc3184eb4368c1a2e8a3746e
SSDEEP 49152:15udcIPYw8DbMzFpFS4bxkx6+08G17ad8ThfG:d
TLSH
T12D469EB702AFB9AD39641D42E00226565CAE374F6669E506F8C838FE63FD190CD08F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.bat

Path C:\Users\Public\run.bat
Size 91B
SHA256 e7bda7016054deebfe6de8d9df7a7f650453271e599c768a105dfef15aa7841b
MD5 da39d275ee0f6473286a5ff8deee44d9
SHA1 8d4d806447d5498b104723e3083bcaecb21533c7
SHA512 dab146ffde53b92e517cbe9ffb91577f9db7f73584cf0c907cc626d323e93b646c77b5e15f894f6cc3a01834a242ce70cbc9d4142bec35710e71be81e82f0750
TLSH
T1D5B0121764429C1418006C435E8F00377CEC10D120054345D15700F8448D8651477572
MD5 SHA1 SHA512 TLSH

Submit Download

setup.ps1

Path C:\Users\Public\setup.ps1
Size 339B
SHA256 6aef80514237808dfe25621a8912422d20a8414bc2054008a119e541166821b5
MD5 50c69c5bfdeef55e496249ef96bd7137
SHA1 ce20daec709d4827377dfdc711040e2b5ce3c050
SHA512 1de4348a87f712eddcf69331edf0928ba472b9600030079fa8c606f1f48d65be8f57a2162a02274d4583c78ee48903bc3ed90c8a6676a36b649945a78d9b5d6c
TLSH
T178E020250981C5577D8051830272511B6CF5103D295E2BF08F6B1C7C504AD7B329F212
MD5 SHA1 SHA512 TLSH

Submit Download

stealer.exe

Path C:\Users\Public\stealer.exe
Size 6.3MB
SHA256 d0f0734d4e31ec126da43a46896d0cd761e5532c0c385db6226cc5a6927d7722
MD5 ed9cd259602788d5d1ea1dcda422acbb
SHA1 d0f8797766ed74a021aaa7fd72f2f94d1780d02d
SHA512 77191c8ab504ca98eee56a64df9f844cae8b000057be24ae5f98d20798eb7875066270925b3528d4068f8a60822afa2e8b8b51ce337729f3203e31d357d8a213
SSDEEP 98304:5BHQDmpLeZ2gJC3/R6djtc6tvMu4t4xpDts6jMdURy5+Hi:r2po3evA/VUK/
TLSH
T13E666B53F6A390ECC16AC1B4835AA232FE32B84945317AAB57D4CB313E52F506F1DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Public\svchost.exe
Size 4.0MB
SHA256 7cb59abaa268ac66461447773d46bb0b0e5e2568e35e1a8f1d07ac2ec57f67a6
MD5 90e91b699ed457abdfbb0c3f30ed366f
SHA1 761b0e43db475700943255ca906c9156f16258cf
SHA512 6e665e7c0cb75dd249c2610d58e66950fcecc8c553fdb1cb5600e79ba57df13795d4409870f080a3e8abcadd9936e92cdf97ee59e0b85fed57a6d56ac67124a6
SSDEEP 49152:6dGMuBMd58ZZMsAeoKSHAZPYAfvcfjsPT9rSJCKgETsdFmUthrx5MxrTdRC1ZIUB:+sM16oxAxLcUMjsdFmUQd5+sC1
TLSH
T1B2164A43E66290FCC16AC0788356B632FF32BC8945327AAB57E48B313E65F506B1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/832-54-0x00007FF64FE20000-0x00007FF65021F000-memory.dmp

Download

memory/832-52-0x00007FF64FE20000-0x00007FF65021F000-memory.dmp

Download

memory/1200-61-0x00007FF64FE20000-0x00007FF65021F000-memory.dmp

Download

memory/1200-53-0x00007FF64FE20000-0x00007FF65021F000-memory.dmp

Download

memory/2568-15-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-2-0x00007FFCD4EDF000-0x00007FFCD4EE0000-memory.dmp

Download

memory/2568-21-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-6-0x000001EDEB170000-0x000001EDEB192000-memory.dmp

Download

memory/2568-5-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-7-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-17-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-19-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-34-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-35-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-8-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-22-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-14-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/2568-13-0x000001EDEB580000-0x000001EDEB5C8000-memory.dmp

Download

memory/3364-30-0x0000014D45D20000-0x0000014D45D2A000-memory.dmp

Download

memory/3364-28-0x0000014D45D80000-0x0000014D45D9E000-memory.dmp

Download

memory/3364-29-0x0000014D46040000-0x0000014D460F2000-memory.dmp

Download

memory/4136-18-0x00007FF628BF0000-0x00007FF628C08000-memory.dmp

Download

memory/4340-65-0x00007FF64FE20000-0x00007FF65021F000-memory.dmp

Download

memory/4664-63-0x00007FF70FD00000-0x00007FF70FEE5000-memory.dmp

Download

memory/6044-56-0x00007FF751C40000-0x00007FF75228B000-memory.dmp

Download

memory/6044-64-0x00007FF751C40000-0x00007FF75228B000-memory.dmp

Download