Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 18:22
General
- Target pysdthonw.exe
- Size 3.5MB
- Sample260808-w1brpafa55
- SHA256 a0e0ba8ca27b68979819e03cb64097b9f608001cffc36d64b828e0d65078ca07
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pysdthonw.exe"C:\Users\Admin\AppData\Local\Temp\pysdthonw.exe"1⤵
-
C:\ProgramData\AppRepository\0a2c0f09\erRela.exeC:\ProgramData\AppRepository\0a2c0f09\erRela.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/236-11-0x0000000073122000-0x0000000073123000-memory.dmp
memory/236-12-0x00000000045D0000-0x000000000463E000-memory.dmp
memory/236-13-0x0000000073110000-0x00000000738CC000-memory.dmp
memory/236-15-0x0000000073110000-0x00000000738CC000-memory.dmp
memory/236-14-0x0000000073110000-0x00000000738CC000-memory.dmp
memory/236-16-0x0000000073110000-0x00000000738CC000-memory.dmp
memory/236-17-0x0000000004840000-0x000000000485A000-memory.dmp
memory/236-18-0x0000000006BB0000-0x0000000006BDC000-memory.dmp
memory/236-40-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-44-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-88-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-94-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-100-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-144-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-142-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-140-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-138-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-136-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-134-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-132-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-130-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-128-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-126-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-124-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-122-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-120-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-118-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-116-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-114-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-112-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-110-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-108-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-106-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-104-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-102-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-98-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-96-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-92-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-91-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-86-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-84-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-82-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-80-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-78-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-76-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-74-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-72-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-70-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-68-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-66-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-64-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-62-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-60-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-58-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-56-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-54-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-52-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-50-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-46-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-42-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-38-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-36-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-34-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-32-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-30-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-28-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-26-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-49-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-24-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-20-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-19-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-22-0x0000000006BB0000-0x0000000006BD6000-memory.dmp
memory/236-645-0x0000000006E20000-0x0000000006E86000-memory.dmp
memory/236-646-0x0000000073122000-0x0000000073123000-memory.dmp
memory/236-647-0x0000000073110000-0x00000000738CC000-memory.dmp
memory/236-648-0x0000000073110000-0x00000000738CC000-memory.dmp
memory/236-651-0x0000000007560000-0x00000000075F2000-memory.dmp
memory/236-652-0x0000000007BC0000-0x000000000817A000-memory.dmp
memory/236-653-0x0000000073110000-0x00000000738CC000-memory.dmp
memory/236-654-0x0000000007AA0000-0x0000000007B24000-memory.dmp
memory/236-2907-0x0000000007870000-0x000000000787A000-memory.dmp