ec7bc48213f6be12aacc6360dcec4d2a3fe0de09a68c4b836ae302fd2ac7edc8

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
webrat.exe
Size 9.7MB
Sample260810-jalgzstdqg
SHA256 ec7bc48213f6be12aacc6360dcec4d2a3fe0de09a68c4b836ae302fd2ac7edc8
MD5 21b1006f8e52ed0bdb54014c5ca4f489
SHA1 659736e7ec16f62260121dc0fb60b1d95edfaef8
SHA512 10d934f9f332c3deb6377a032d3716df2d4589f8cffbca92257091f1a09dd302e2f2989598a7cdecb03f44fef9bc80583dee4b4f9cf9f266d800048eca593342
SSDEEP 98304:ai2HMamE5a3Hbm+Ho4DLAeM4V3aWCEnEqB+dIe5e5mBfu:asab5a3HqdmsWCxqB+dIeTB
TLSH
T111A64A47E8A501A4C0AED175CA269253BE717C984B3473D36F50FB282F77BD0AAB9701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4432	powershell.exe
3096	powershell.exe
4508	powershell.exe
372	powershell.exe
968	powershell.exe
1536	powershell.exe
4632	powershell.exe
3356	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4092	webrat.exe
4500	webrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\webrat = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\webrat.exe"	webrat.exe

Kills process with taskkill 14 IoCs

defense_evasion

pid	Process
4540	taskkill.exe
1960	taskkill.exe
1772	taskkill.exe
3068	taskkill.exe
868	taskkill.exe
216	taskkill.exe
5060	taskkill.exe
1752	taskkill.exe
1948	taskkill.exe
2964	taskkill.exe
2084	taskkill.exe
3052	taskkill.exe
2572	taskkill.exe
4632	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4816	schtasks.exe
3620	schtasks.exe
4868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4432	powershell.exe
4432	powershell.exe
3096	powershell.exe
3096	powershell.exe
4508	powershell.exe
4508	powershell.exe
968	powershell.exe
968	powershell.exe
372	powershell.exe
1536	powershell.exe
1536	powershell.exe
372	powershell.exe
4632	powershell.exe
4632	powershell.exe
3356	powershell.exe
3356	powershell.exe
4500	webrat.exe
4500	webrat.exe
4092	webrat.exe
4092	webrat.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	372	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	2084	taskkill.exe
Token: SeDebugPrivilege	3068	taskkill.exe
Token: SeDebugPrivilege	868	taskkill.exe
Token: SeDebugPrivilege	216	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	1752	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	4540	taskkill.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4816	2236	webrat.exe	86
PID 2236 wrote to memory of 4092	2236	webrat.exe	89
PID 4092 wrote to memory of 3620	4092	webrat.exe	90
PID 4500 wrote to memory of 4868	4500	webrat.exe	92
PID 4500 wrote to memory of 4432	4500	webrat.exe	94
PID 4092 wrote to memory of 3096	4092	webrat.exe	96
PID 4092 wrote to memory of 4508	4092	webrat.exe	100
PID 4500 wrote to memory of 372	4500	webrat.exe	102
PID 4092 wrote to memory of 968	4092	webrat.exe	104
PID 4092 wrote to memory of 1536	4092	webrat.exe	106
PID 4500 wrote to memory of 4632	4500	webrat.exe	108
PID 4500 wrote to memory of 3356	4500	webrat.exe	110
PID 4500 wrote to memory of 2964	4500	webrat.exe	112
PID 4500 wrote to memory of 1960	4500	webrat.exe	114
PID 4500 wrote to memory of 1772	4500	webrat.exe	116
PID 4500 wrote to memory of 2084	4500	webrat.exe	118
PID 4500 wrote to memory of 3068	4500	webrat.exe	120
PID 4500 wrote to memory of 868	4500	webrat.exe	122
PID 4500 wrote to memory of 216	4500	webrat.exe	126
PID 4092 wrote to memory of 5060	4092	webrat.exe	133
PID 4092 wrote to memory of 1752	4092	webrat.exe	135
PID 4092 wrote to memory of 3052	4092	webrat.exe	137
PID 4092 wrote to memory of 2572	4092	webrat.exe	139
PID 4092 wrote to memory of 1948	4092	webrat.exe	141
PID 4092 wrote to memory of 4632	4092	webrat.exe	143
PID 4092 wrote to memory of 4540	4092	webrat.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\webrat.exe
"C:\Users\Admin\AppData\Local\Temp\webrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\webrat_task.xml /TN webrat /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4816
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\webrat.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\webrat.exe --installed
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\webrat_task.xml /TN webrat /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4540

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\webrat.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\webrat.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\webrat_task.xml /TN webrat /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3356
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM browser.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 6c6ec3994fe82488d0dde0cc1f8a203ab543cb45381634d605ffc568e63a8f5b
MD5 8e050de4156ae7cb03fa2d73435c23cf
SHA1 8d2d01137486b7118156e89a9caa951979ba4d2d
SHA512 da7668d567d4f209d12cdb3b5be790e51b85884ab1d6e53d2f747bebb0bd9ed56047cd44eacfadedd20008445524d4bf909cc42d4ba3b1f32c1a7585156d8dfe
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

.aid

Path C:\Users\Admin\AppData\Local\Temp\.aid
Size 16B
SHA256 ecdc59c1ad69110a1a1d481c0c1d09f4bda26bce224e228745588b13ec06d655
MD5 7eca182e0a75a15a5a6be177450d6a8a
SHA1 cfe960b9d04e2e1ff3bd27f37833c5b8f115ec2a
SHA512 296df10b037d738c6abd2b48562fa420dc0989a036cd8532d15a9ec1a3c521d25b930ec9c1c1659305298c83a028c856b5f03b97b4b190f7910fd76c76518272
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_cewyyxyx.kz3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cewyyxyx.kz3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

webrat_stub.log

Path C:\Users\Admin\AppData\Local\Temp\webrat_stub.log
Size 1KB
SHA256 774c59dd9a4a480017f391a7b7547bb40f35bd175db9bf7ead3bf7312e670f98
MD5 67fe6ded1f8bc6d61a181209eeb3be42
SHA1 dde59337aaa8866261092967ac3d0f6e22cccff6
SHA512 2d24e713a224425d28efb84e9d3fb89d7f7e0664f871207897fb698b875edecf259f08c43d742f45bf45df7753e0faccb5734ddf606b5f8599f8119c15c82958
TLSH
T1A2219DD4688F666C8C309683C1E736ACCA294C1CDE11B4F6D69A751D03B9C1D7BC7232
MD5 SHA1 SHA512 TLSH

Submit Download

webrat_stub.log

Path C:\Users\Admin\AppData\Local\Temp\webrat_stub.log
Size 915B
SHA256 09cfbf28b56d0f7ecfe745a3e9446acfa8dd5142b8ae810ad3ad6ae515f2696d
MD5 8bcb91bc120a11aa147cf2c625835844
SHA1 3df92f893de3ee61dfe70896898c15db8c4b1804
SHA512 4127f64406ac9bcef88edc5072259d050e689656954204f540971024cc023a58c85303feaa2b159bed1ce7a2664aae2023b81299e0d649c78c03710aa3825616
TLSH
T174119CD4688F666D8C309683C1E736ACC929081C9E01B4F6D69A651D02B981D77C3232
MD5 SHA1 SHA512 TLSH

Submit Download

webrat_task.xml

Path C:\Users\Admin\AppData\Local\Temp\webrat_task.xml
Size 1KB
SHA256 9c53b1a0c70c4b99dc0ffabc97e6c28799c9475e2ee60c4855c807631860e3da
MD5 0369c7c6bf2bd4cabbda204e2f902eba
SHA1 91331ae061648e831543925bb56c01946632fead
SHA512 b9202d9002071abddaf434d467fa1c8b56185743bf65b20ed18597ad3fc813dc0bfc16dc17dc2297bc52031fe4a339273440c9e005f40376afbf0e6506df516a
TLSH
T16C2135945D10F11F7556663ACB9217C3373E9B650BB14038D8CC4DBC748A1CA711397B
MD5 SHA1 SHA512 TLSH

Submit Download

webrat.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\webrat.exe
Size 9.7MB
SHA256 ec7bc48213f6be12aacc6360dcec4d2a3fe0de09a68c4b836ae302fd2ac7edc8
MD5 21b1006f8e52ed0bdb54014c5ca4f489
SHA1 659736e7ec16f62260121dc0fb60b1d95edfaef8
SHA512 10d934f9f332c3deb6377a032d3716df2d4589f8cffbca92257091f1a09dd302e2f2989598a7cdecb03f44fef9bc80583dee4b4f9cf9f266d800048eca593342
SSDEEP 98304:ai2HMamE5a3Hbm+Ho4DLAeM4V3aWCEnEqB+dIe5e5mBfu:asab5a3HqdmsWCxqB+dIeTB
TLSH
T111A64A47E8A501A4C0AED175CA269253BE717C984B3473D36F50FB282F77BD0AAB9701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4432-14-0x0000029244EF0000-0x0000029244F00000-memory.dmp

Download

memory/4432-15-0x0000029244EF0000-0x0000029244F00000-memory.dmp

Download

memory/4432-18-0x0000029244EC0000-0x0000029244EE2000-memory.dmp

Download