91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe
Size 7.4MB
Sample260811-12jadadr3s
SHA256 91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e
MD5 60239d8977c758dcdbe5a3b5d886ccd5
SHA1 46bdb7c61ec8257a6b19ca11db7a46c50feec94c
SHA512 fec0a9add9bb559304e1312092a617b4f256fd39a50b9cd99070ae1fdbb8b341ba0a0784e74073c71d28cde574e07f6ea86796093acbbe8b8190bd0abcb48d25
SSDEEP 98304:025feLkuzyzdGvlKnHXnInTfnjT8hsF+bDC:06eYsyJyL7nbJ
TLSH
T13E768D03F99545F9C0AAD2318667A232BB71B849173173DB2A90EB742F72BD05E3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3228	powershell.exe
3228	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4100	BVPtl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\ibrowser = "\"\\\\?\\C:\\Users\\Admin\\AppData\\Local\\Packages\\Extensions\\E5ECF5C34A97BCF0ADDDD797F99637A4C886AB175EC91AD11D2CF81F68A827C6-agent\\ibrowser.exe\""	BVPtl.exe

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x0008000000016ca8-4.dat	suspicious_telegram_bot
behavioral2/memory/4100-79-0x00007FF753770000-0x00007FF753B19000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4100-81-0x00007FF753770000-0x00007FF753B19000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4100-83-0x00007FF753770000-0x00007FF753B19000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4100-86-0x00007FF753770000-0x00007FF753B19000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4100-89-0x00007FF753770000-0x00007FF753B19000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4100-90-0x00007FF753770000-0x00007FF753B19000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4100-91-0x00007FF753770000-0x00007FF753B19000-memory.dmp	suspicious_telegram_bot

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5332	91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
2068	taskkill.exe
1120	taskkill.exe
4320	taskkill.exe
1428	taskkill.exe
2128	taskkill.exe
1184	taskkill.exe
3092	taskkill.exe
2292	taskkill.exe
1436	taskkill.exe
1940	taskkill.exe
2280	taskkill.exe
2864	taskkill.exe
1384	taskkill.exe
248	taskkill.exe
4224	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4100	BVPtl.exe
4100	BVPtl.exe
5332	91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe
5332	91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe
5332	91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe
5332	91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe
5332	91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe
5332	91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
3228	powershell.exe
3228	powershell.exe
3228	powershell.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe
4100	BVPtl.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeIncreaseQuotaPrivilege	3228	powershell.exe
Token: SeSecurityPrivilege	3228	powershell.exe
Token: SeTakeOwnershipPrivilege	3228	powershell.exe
Token: SeLoadDriverPrivilege	3228	powershell.exe
Token: SeSystemProfilePrivilege	3228	powershell.exe
Token: SeSystemtimePrivilege	3228	powershell.exe
Token: SeProfSingleProcessPrivilege	3228	powershell.exe
Token: SeIncBasePriorityPrivilege	3228	powershell.exe
Token: SeCreatePagefilePrivilege	3228	powershell.exe
Token: SeBackupPrivilege	3228	powershell.exe
Token: SeRestorePrivilege	3228	powershell.exe
Token: SeShutdownPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeSystemEnvironmentPrivilege	3228	powershell.exe
Token: SeRemoteShutdownPrivilege	3228	powershell.exe
Token: SeUndockPrivilege	3228	powershell.exe
Token: SeManageVolumePrivilege	3228	powershell.exe
Token: 33	3228	powershell.exe
Token: 34	3228	powershell.exe
Token: 35	3228	powershell.exe
Token: 36	3228	powershell.exe
Token: SeDebugPrivilege	248	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	1428	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	2280	taskkill.exe
Token: SeDebugPrivilege	1184	taskkill.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeDebugPrivilege	4224	taskkill.exe
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeDebugPrivilege	1120	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	1384	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5332 wrote to memory of 4100	5332	91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe	89
PID 4100 wrote to memory of 3976	4100	BVPtl.exe	90
PID 4100 wrote to memory of 3228	4100	BVPtl.exe	94
PID 4100 wrote to memory of 248	4100	BVPtl.exe	96
PID 4100 wrote to memory of 4320	4100	BVPtl.exe	98
PID 4100 wrote to memory of 1940	4100	BVPtl.exe	100
PID 4100 wrote to memory of 1428	4100	BVPtl.exe	102
PID 4100 wrote to memory of 2128	4100	BVPtl.exe	104
PID 4100 wrote to memory of 2280	4100	BVPtl.exe	106
PID 4100 wrote to memory of 1184	4100	BVPtl.exe	107
PID 4100 wrote to memory of 2292	4100	BVPtl.exe	110
PID 4100 wrote to memory of 4224	4100	BVPtl.exe	112
PID 4100 wrote to memory of 2068	4100	BVPtl.exe	114
PID 4100 wrote to memory of 3092	4100	BVPtl.exe	116
PID 4100 wrote to memory of 1120	4100	BVPtl.exe	118
PID 4100 wrote to memory of 2864	4100	BVPtl.exe	120
PID 4100 wrote to memory of 1436	4100	BVPtl.exe	122
PID 4100 wrote to memory of 1384	4100	BVPtl.exe	124
PID 4100 wrote to memory of 4652	4100	BVPtl.exe	128
PID 4100 wrote to memory of 4652	4100	BVPtl.exe	128
PID 4100 wrote to memory of 4316	4100	BVPtl.exe	130
PID 4100 wrote to memory of 4316	4100	BVPtl.exe	130

C:\Users\Admin\AppData\Local\Temp\91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe
"C:\Users\Admin\AppData\Local\Temp\91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Users\Admin\AppData\Local\Temp\BVPtl.exe
  "C:\Users\Admin\AppData\Local\Temp\BVPtl.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\getmac.exe
    "getmac" /fo csv /nh
    3⤵
    PID:3976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:248
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1436
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google/Chrome/Application/chrome.exe"
    3⤵
    PID:4652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google/Chrome/Application/chrome.exe"
    3⤵
    PID:4316

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\E5ECF5C34A97BCF0ADDDD797F99637A4C886AB175EC91AD11D2CF81F68A827C6\e0\manifest.json
Size 1KB
SHA256 a68297b6ff8218690abddc5ef63de45cd126695a4e677e3e3a2be087a7c6ac2c
MD5 ac45ab511f5530abc94313434adaf432
SHA1 febec023387908b6be72a9dfba895d886ed1e60e
SHA512 f7aeb6110d091b0ebcd5f19d50588eeb84980fa7fbe80238cb99458d52189709a417c9f3b2e2393b89fe08b66f8b6e87f3881431e1acb452e4f90e796b1d6e05
TLSH
T19D310025D9685C6B03CCAB302DFA4987A50509879D947C1C7ADE800C8FBD61F02FBB9C
MD5 SHA1 SHA512 TLSH

Submit Download

BVPtl.exe

Path C:\Users\Admin\AppData\Local\Temp\BVPtl.exe
Size 3.6MB
SHA256 50e61dc7624cdd79f3d44eaf7fa2f7b8ac71348f0e3982b964e4251d94fb4c79
MD5 04efec76cfefafa308c76f8add5af770
SHA1 d3ffb4658a30dc9dde49bee7f488e8062e9480db
SHA512 375c834dcb3f91822d158e6fcad24d1fabb6ec74e8b5a901b8deb8835d5a843ef0253529b6b6a0646a5c7b07e6ef4f3347c4c545893cceade5383eeb7cae164b
SSDEEP 49152:b1nHd0D+KMEEIiGJzJDZJ+FpHgB4hMtP/jJzdHeRI4XsK5VIdIIU6ib:ZnHXnInTfnjT8hsF+b
TLSH
T12D067D03E69581F9C46EC174835B9733FA32B8895534B69F2BD4DB213E22F50AB0E719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ck_4100_1786486137319493400.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_4100_1786486137319493400.bin
Size 32B
SHA256 df383c29890b8eb7200c9c7b63bc9d7159d37fa43c3a0d24090eb61f77989ec2
MD5 57e88aefbd41ee5f29053cc68379095a
SHA1 58794e84b5b7b0edda85a9bd427ff940c3cbdd65
SHA512 b92369fe05ce77395c4af8254e74f678e628a4a03e01af5b0e9dc5fd2660470a492168168ff5ced5358fffaa45a79a65823db330dfd607db08f0e5cf635f462e
MD5 SHA1 SHA512

Submit Download

memory/3228-57-0x0000013F69CF0000-0x0000013F69D14000-memory.dmp

Download

memory/3228-53-0x0000013F69770000-0x0000013F6978E000-memory.dmp

Download

memory/3228-54-0x0000013F69790000-0x0000013F69842000-memory.dmp

Download

memory/3228-55-0x0000013F69760000-0x0000013F6976A000-memory.dmp

Download

memory/3228-56-0x0000013F69CF0000-0x0000013F69D1A000-memory.dmp

Download

memory/3228-48-0x0000013F695D0000-0x0000013F695F2000-memory.dmp

Download

memory/4100-79-0x00007FF753770000-0x00007FF753B19000-memory.dmp

Download

memory/4100-90-0x00007FF753770000-0x00007FF753B19000-memory.dmp

Download

memory/4100-89-0x00007FF753770000-0x00007FF753B19000-memory.dmp

Download

memory/4100-86-0x00007FF753770000-0x00007FF753B19000-memory.dmp

Download

memory/4100-91-0x00007FF753770000-0x00007FF753B19000-memory.dmp

Download

memory/4100-83-0x00007FF753770000-0x00007FF753B19000-memory.dmp

Download

memory/4100-81-0x00007FF753770000-0x00007FF753B19000-memory.dmp

Download

memory/5332-62-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/5332-78-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/5332-75-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/5332-67-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/5332-63-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/5332-59-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/5332-47-0x0000000710000000-0x00000007101EF000-memory.dmp

Download