8796a067e557ddeb967d85adfbd2c55f4c98f82ce0f4cebfb19088a12b6d2a60

Analysis

user interaction
yes
max time kernel
90s
max time network
77s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 814.6MB
Sample260808-n7bq9seq71
SHA256 8796a067e557ddeb967d85adfbd2c55f4c98f82ce0f4cebfb19088a12b6d2a60
MD5 55396dc7fe71b601801f214d92c8323c
SHA1 37ce92bfeeaea57309533c0837d1f298e3af0178
SHA512 7c7674c63754adbef1c8697d4cd69a6c5100e185cde58f72009546d28135e576e2a29c130a2cc74e3c1b4c8b55e01c0036d97636df48fd5f7bb5d71ea70c5358
SSDEEP 393216:nWennxfnH2aQFkGOYMDqFA2QsUVoo6xt3uFJqc7pTzW97ziyHURnuLsQoIKf/dln:n1h6FSDGrziysAKf1lRyVRjS
TLSH
T1FD99BF02B7E84066E1FB973489B78612EA36BC551B31C3DF1650A66D2E737C09F34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5096	file.exe
5096	file.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4672	5096	file.exe	89
PID 5096 wrote to memory of 4672	5096	file.exe	89
PID 5096 wrote to memory of 3408	5096	file.exe	92
PID 5096 wrote to memory of 3408	5096	file.exe	92
PID 5096 wrote to memory of 3304	5096	file.exe	95
PID 5096 wrote to memory of 3304	5096	file.exe	95
PID 5096 wrote to memory of 3836	5096	file.exe	98
PID 5096 wrote to memory of 3836	5096	file.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C437EAF4-FF2B-E288-877C-03D09F845B98.txt

Path C:\ProgramData\C437EAF4-FF2B-E288-877C-03D09F845B98.txt
Size 64B
SHA256 3f6bbc0bc197ea3b01ef32bd5913a833e39bd9676f9bc6ff694419a06b3375c1
MD5 a2902d9f8953374ea892de9580cf210b
SHA1 5f1373fb802655c5615743a4417a13fd493a4223
SHA512 5be9c34bc30feec8f81bcdad8660efb4c65a2159e145b7e18f5a4eeb3e11659501ab9101ed885af0def892545fc9844b49a4bff496bd91d1f5af407d2e33155f
TLSH
T1B1A022300830B0C3088CCA0A02A80ECF0C2030E2A0A8822C0000E0020E28000C32800F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5096-5-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-8-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-11-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-10-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-9-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-7-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-6-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-0-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-13-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-3-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-2-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-4-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-12-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-16-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-17-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-18-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/5096-19-0x0000000140000000-0x00000001400D7000-memory.dmp

Download