6fdb60289683f9c6066384c892a233bed716fd6d80e5e5eaabd9def26600136c

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6fdb60289683f9c6066384c892a233bed716fd6d80e5e5eaabd9def26600136c.exe
Size 6.3MB
Sample260809-mbst8swbma
SHA256 6fdb60289683f9c6066384c892a233bed716fd6d80e5e5eaabd9def26600136c
MD5 8f7100079586cfd75330c9e4c7f67419
SHA1 a9450c5ff34f18d9b564a2b71cc558cde20f8696
SHA512 b8fe0518ae5d8eec2cbe48e6b9d74cc38ce702c67aa95a74c9c6053cbca76680b594d14035a354edc25b2ef9b0ca2006e07ce21b940f6462d1beb503744757cd
SSDEEP 98304:vqJbc5xtz+kl/m5lifMc/PKkuExnaZ/l+7Y1rtJKCg8:yJk+y/mnifVKkbaZ/l+7Y1rtECg8
TLSH
T134669D1576E840E8E073523189569A5FDEB5B9261B3642CF368C5B1F1F336D28E3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
992	geek64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fdb60289683f9c6066384c892a233bed716fd6d80e5e5eaabd9def26600136c.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1752	6fdb60289683f9c6066384c892a233bed716fd6d80e5e5eaabd9def26600136c.exe
992	geek64.exe
992	geek64.exe
992	geek64.exe
992	geek64.exe
992	geek64.exe
992	geek64.exe
992	geek64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 992	1752	6fdb60289683f9c6066384c892a233bed716fd6d80e5e5eaabd9def26600136c.exe	89

C:\Users\Admin\AppData\Local\Temp\6fdb60289683f9c6066384c892a233bed716fd6d80e5e5eaabd9def26600136c.exe
"C:\Users\Admin\AppData\Local\Temp\6fdb60289683f9c6066384c892a233bed716fd6d80e5e5eaabd9def26600136c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\geek64.exe
  C:\Users\Admin\AppData\Local\Temp\geek64.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

geek64.exe

Path C:\Users\Admin\AppData\Local\Temp\geek64.exe
Size 3.5MB
SHA256 316fbec9eca41deef9a63837dfaf4de4369ca507c5b2143cd3a805cb238e5057
MD5 2062e8118cf10d1fba19a80a885c80f0
SHA1 7e4a6fee0595832708b9cc9ee9b7d589f9c2bcc8
SHA512 684533abd11842833a0a4bab308c5a06253307dd8f0297211624eb1acd36ade78bf85a19cf2c8f0cc0cf85593732ebd612d6c32ce49eff284ebd6d7e8aa922b2
SSDEEP 49152:j4quwLl+92FitN5YrkzIsDscQIe3H17Sv2uEoGZGzuGowIKqtBP/TXOLzh2CS0u:jZ/l+7Y1rtJKCg8H
TLSH
T196F56C4A72E801E8D0B6D179C952894BDEB2B8061B2287CF395D475B1F376E18D3F362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download