3e22b966c6bb3644f5060041c93c0ddd7d321fa33c9bfc59c5dbc20b6d20c937

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e22b966c6bb3644f5060041c93c0ddd7d321fa33c9bfc59c5dbc20b6d20c937.exe
Size 2.3MB
Sample260815-efdl4sdg23
SHA256 3e22b966c6bb3644f5060041c93c0ddd7d321fa33c9bfc59c5dbc20b6d20c937
MD5 23e02f6715ceaa195862e5ba5bf28fcc
SHA1 25d567de35f8f3deb3ab7c3ab383f5e6009a218f
SHA512 fef5a950c8590a7158821731663df5d3feabd199f5b0c104cab3482f6a852ba1f7bbb49a1d7e820adf9210f21081e81b966c638f27a0efd2fba2652de1a4e74c
SSDEEP 49152:yYLh4Jg9sj8vKoJOJaP60sYwvaATnVVd56MKMmmESnG3v7:NhX9u89Ys7H
TLSH
T18AB5485E8018A378F6A9C4E8850E7E9130F9377C8DF294E8111B4AB15B617E09FD7B36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1188	3e22b966c6bb3644f5060041c93c0ddd7d321fa33c9bfc59c5dbc20b6d20c937.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\host = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3e22b966c6bb3644f5060041c93c0ddd7d321fa33c9bfc59c5dbc20b6d20c937.exe"	3e22b966c6bb3644f5060041c93c0ddd7d321fa33c9bfc59c5dbc20b6d20c937.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com
1	api.ipify.org

C:\Users\Admin\AppData\Local\Temp\3e22b966c6bb3644f5060041c93c0ddd7d321fa33c9bfc59c5dbc20b6d20c937.exe
"C:\Users\Admin\AppData\Local\Temp\3e22b966c6bb3644f5060041c93c0ddd7d321fa33c9bfc59c5dbc20b6d20c937.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
PID:1188

C:\Users\Admin\AppData\Local\Temp\3e22b966c6bb3644f5060041c93c0ddd7d321fa33c9bfc59c5dbc20b6d20c937.exe
C:\Users\Admin\AppData\Local\Temp\3e22b966c6bb3644f5060041c93c0ddd7d321fa33c9bfc59c5dbc20b6d20c937.exe
1⤵
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dsA81D.tmp.dll

Path C:\Users\Admin\AppData\Local\Temp\dsA81D.tmp.dll
Size 11KB
SHA256 9bfbfbcfefa85e70a66f71824965144f55832c2d4468b66534c0d5a26867445f
MD5 9de4fec6dbe2c1e9aab0fc356a85fc83
SHA1 975e5efc81fedef7d43eb0c8ddc16eeadc83df44
SHA512 58f6050d05fa8a3e31bda4d167bf9ba27317a2616ac077f7469503d82e0b8d47fa458736c3e2a8f1ae840975de5e042a60d0f3332eeeb4ea6671b69958bd68ce
SSDEEP 192:KLM2gi0sJJH37mTw40HbJrUNkWjR1KJrclSAlgA0J4hnTFn:KLM2gi0sJJHUZqFUNkWjR1KJrclS20Jg
TLSH
T1DE32B60B3BC1D26DE81CD9B2E2139D1336F4F92551507B8F06494CAE3C15BAA3ABDE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads