c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d

Analysis

max time kernel
40s
max time network
39s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe
Size 7.6MB
Sample260811-3el4vs1thv
SHA256 c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d
MD5 9ad35020d2362048074c6fc4d43b1b74
SHA1 0efa564a90453558a9c7ea6429bf63a687b8f18f
SHA512 2c9b6882b674aca9666ead7eafe946f98b6dc5d6e206bc7a9f62d15860a510f836433bc3a87ee364d34fd815a410f18d162c9e5a4a561fac877e3875a75edb6d
SSDEEP 98304:mb6aCTcnESnnnnnnnnfi38ujy6FXiwxGlmmRTPlRxR7MNnanl6uctfonjfnjT8cT:mcTM3xFM+Lnsun
TLSH
T1BC867C03E99185F9C0AAD23586679232BA31BC48573177DB2E90EB742F32BD05F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2232	powershell.exe
2232	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1108	YbPFz.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
792	c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
4100	taskkill.exe
4548	taskkill.exe
1680	taskkill.exe
5948	taskkill.exe
4632	taskkill.exe
808	taskkill.exe
4176	taskkill.exe
4164	taskkill.exe
3380	taskkill.exe
5588	taskkill.exe
1520	taskkill.exe
3800	taskkill.exe
1516	taskkill.exe
4088	taskkill.exe
5428	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1108	YbPFz.exe
1108	YbPFz.exe
792	c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe
792	c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe
792	c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe
792	c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe
792	c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe
792	c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
2232	powershell.exe
2232	powershell.exe
2232	powershell.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe
1108	YbPFz.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeIncreaseQuotaPrivilege	2232	powershell.exe
Token: SeSecurityPrivilege	2232	powershell.exe
Token: SeTakeOwnershipPrivilege	2232	powershell.exe
Token: SeLoadDriverPrivilege	2232	powershell.exe
Token: SeSystemProfilePrivilege	2232	powershell.exe
Token: SeSystemtimePrivilege	2232	powershell.exe
Token: SeProfSingleProcessPrivilege	2232	powershell.exe
Token: SeIncBasePriorityPrivilege	2232	powershell.exe
Token: SeCreatePagefilePrivilege	2232	powershell.exe
Token: SeBackupPrivilege	2232	powershell.exe
Token: SeRestorePrivilege	2232	powershell.exe
Token: SeShutdownPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeSystemEnvironmentPrivilege	2232	powershell.exe
Token: SeRemoteShutdownPrivilege	2232	powershell.exe
Token: SeUndockPrivilege	2232	powershell.exe
Token: SeManageVolumePrivilege	2232	powershell.exe
Token: 33	2232	powershell.exe
Token: 34	2232	powershell.exe
Token: 35	2232	powershell.exe
Token: 36	2232	powershell.exe
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	5948	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	5588	taskkill.exe
Token: SeDebugPrivilege	808	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	3800	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	1680	taskkill.exe
Token: SeDebugPrivilege	5428	taskkill.exe
Token: SeDebugPrivilege	4164	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1108	792	c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe	89
PID 1108 wrote to memory of 2588	1108	YbPFz.exe	90
PID 1108 wrote to memory of 2232	1108	YbPFz.exe	94
PID 1108 wrote to memory of 3380	1108	YbPFz.exe	96
PID 1108 wrote to memory of 5948	1108	YbPFz.exe	98
PID 1108 wrote to memory of 4632	1108	YbPFz.exe	100
PID 1108 wrote to memory of 5588	1108	YbPFz.exe	102
PID 1108 wrote to memory of 808	1108	YbPFz.exe	104
PID 1108 wrote to memory of 4100	1108	YbPFz.exe	106
PID 1108 wrote to memory of 4548	1108	YbPFz.exe	107
PID 1108 wrote to memory of 4176	1108	YbPFz.exe	110
PID 1108 wrote to memory of 1520	1108	YbPFz.exe	112
PID 1108 wrote to memory of 3800	1108	YbPFz.exe	114
PID 1108 wrote to memory of 4088	1108	YbPFz.exe	116
PID 1108 wrote to memory of 1680	1108	YbPFz.exe	118
PID 1108 wrote to memory of 5428	1108	YbPFz.exe	120
PID 1108 wrote to memory of 4164	1108	YbPFz.exe	122
PID 1108 wrote to memory of 1516	1108	YbPFz.exe	124
PID 1108 wrote to memory of 2804	1108	YbPFz.exe	128
PID 1108 wrote to memory of 2804	1108	YbPFz.exe	128
PID 1108 wrote to memory of 5716	1108	YbPFz.exe	130
PID 1108 wrote to memory of 5716	1108	YbPFz.exe	130

C:\Users\Admin\AppData\Local\Temp\c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe
"C:\Users\Admin\AppData\Local\Temp\c202ce8dcf1679fb52d7e14817de30f6e7d3860b9e80a87ed0b98ad1fdc0da4d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Local\Temp\YbPFz.exe
  "C:\Users\Admin\AppData\Local\Temp\YbPFz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\getmac.exe
    "getmac" /fo csv /nh
    3⤵
    PID:2588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5948
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5588
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5428
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google/Chrome/Application/chrome.exe"
    3⤵
    PID:2804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google/Chrome/Application/chrome.exe"
    3⤵
    PID:5716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.ts-DLVbk4Oj.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\8AF36AB3C4A3D4522BED317A9259C7BC2A987BAEB62AF970510C000932A94E63\e0\assets\background.ts-DLVbk4Oj.js
Size 19KB
SHA256 cdf609d62430bbc32c3f7a44c67b11e043cd7a098a4434909b4d4d85471699ef
MD5 b12cc801cc8bd9005bd11421859c231d
SHA1 33b9ba1b23672de3d47c51a9b12a2ab96bced607
SHA512 4981e11d496bea4194659b8e091ad172c33e9ac00d1fb24c8b2901ed66f17d28d916050dd151cff555309a5dc874cd7991e9f24162e0218a7d2dd17710bda133
SSDEEP 384:HphGacWt1UArM8iwIVP4svuUtCGRhxdno4o/ZDE/v6fqvTprRqA660aOvBMI4M2C:JEacWt17rM8iwCP4svuUtCGRhnno4o/5
TLSH
T11292FA59317A2070E6E535F8A0774241B2398B347809C0A2B13E8E797D7ED46997EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\8AF36AB3C4A3D4522BED317A9259C7BC2A987BAEB62AF970510C000932A94E63\e0\manifest.json
Size 1KB
SHA256 a68297b6ff8218690abddc5ef63de45cd126695a4e677e3e3a2be087a7c6ac2c
MD5 ac45ab511f5530abc94313434adaf432
SHA1 febec023387908b6be72a9dfba895d886ed1e60e
SHA512 f7aeb6110d091b0ebcd5f19d50588eeb84980fa7fbe80238cb99458d52189709a417c9f3b2e2393b89fe08b66f8b6e87f3881431e1acb452e4f90e796b1d6e05
TLSH
T19D310025D9685C6B03CCAB302DFA4987A50509879D947C1C7ADE800C8FBD61F02FBB9C
MD5 SHA1 SHA512 TLSH

Submit Download

YbPFz.exe

Path C:\Users\Admin\AppData\Local\Temp\YbPFz.exe
Size 3.6MB
SHA256 4c67e0dd9948e3d367dd354d36bce2d8395d93636b61206752a709cd3d809dbf
MD5 1aa53410afa2927848d8ef92acd76e47
SHA1 9f587a08c49cb077129af4552ad37413d53fb474
SHA512 a2747cce6fc665c226e21f85391b5077f729b15a5e0fa46f35e364572e5a8136d7c99285f3ee52ae3f959f910db51d70ded2fb77d98c69907debf1562dd39287
SSDEEP 49152:5kuc70D+CMEEoiGJzJDRJuFpHYB4hMtP/jJzdHeRI4asJXdIIIIU6ib:2uctfonjfnjT8csX+b
TLSH
T1E4067D03E69581F9C46EC174835B9733FA32B8895534B69F2BD4DB213E22F50AB0E719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ck_1108_1786490756923651100.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_1108_1786490756923651100.bin
Size 32B
SHA256 a6c82745e326f06b3988b112787c0891357a9ccdbed7862707572c4e78ceeffa
MD5 484e390a3dcbfa3a6b465f4cd81fc55e
SHA1 dc3ea9dca87f84c92ea04e1da17470ecd2c36209
SHA512 967ccb33d8016fe666b2d35ec803c54f2e951962e020afe1bd056efead2076c66fd004c14cbd62efc95e75b9a428e63457169b0855297ca585b638283d16a2a0
MD5 SHA1 SHA512

Submit Download

memory/792-47-0x00000001F0000000-0x00000001F01EF000-memory.dmp

Download

memory/792-77-0x00000001F0000000-0x00000001F01EF000-memory.dmp

Download

memory/792-76-0x00000001F0000000-0x00000001F01EF000-memory.dmp

Download

memory/792-74-0x00000001F0000000-0x00000001F01EF000-memory.dmp

Download

memory/792-59-0x00000001F0000000-0x00000001F01EF000-memory.dmp

Download

memory/1108-80-0x00007FF7C1F30000-0x00007FF7C22D9000-memory.dmp

Download

memory/1108-75-0x00007FF7C1F30000-0x00007FF7C22D9000-memory.dmp

Download

memory/2232-48-0x0000029AF4200000-0x0000029AF4222000-memory.dmp

Download

memory/2232-57-0x0000029AF44C0000-0x0000029AF44E4000-memory.dmp

Download

memory/2232-56-0x0000029AF44C0000-0x0000029AF44EA000-memory.dmp

Download

memory/2232-55-0x0000029AF4480000-0x0000029AF448A000-memory.dmp

Download

memory/2232-54-0x0000029AF43C0000-0x0000029AF4472000-memory.dmp

Download

memory/2232-53-0x0000029AF4290000-0x0000029AF42AE000-memory.dmp

Download