4b371a0b9936b53786685156ae141afb95cbe22e138a93d818c7c50bcbe5ddb6

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
omx.exe
Size 56.6MB
Sample260820-e3wffazbmf
SHA256 4b371a0b9936b53786685156ae141afb95cbe22e138a93d818c7c50bcbe5ddb6
MD5 52c4a68cff93bd5cc84ad72ff44e4788
SHA1 341a3aec2e08095ce2d5b38087e98892a4bc2b21
SHA512 98a99ddfcbb88b9dc78b30f0bc4fb6b418f0c31639c258799f480cb376ddcdac3c90e1a231ce26f90a357163aee9cc22a0b8bd6644ba6b1ba936745ed1177808
SSDEEP 98304:WsRPTHUIN5GYt+LxXAzpE4qLrYVSt4Ytn+xAf1B:V5GYItXAzpGLoStxUAf1B
TLSH
T17CD7B43E00AA3DF7D184A19C92F36979FB30590AEF6C77E112AB447D4D19DA5083E21B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
25	ipapi.co
26	ip-api.com
24	ipapi.co

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5036	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1776	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1672	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1192	wmic.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1820	ipconfig.exe

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
1256	taskkill.exe
4656	taskkill.exe
2608	taskkill.exe
2568	taskkill.exe
4828	taskkill.exe
568	taskkill.exe
4684	taskkill.exe
4316	taskkill.exe
1832	taskkill.exe
3472	taskkill.exe
3676	taskkill.exe
2392	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3868	omx.exe
3868	omx.exe
3868	omx.exe
3868	omx.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3868	omx.exe
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3288	wmic.exe
Token: SeSecurityPrivilege	3288	wmic.exe
Token: SeTakeOwnershipPrivilege	3288	wmic.exe
Token: SeLoadDriverPrivilege	3288	wmic.exe
Token: SeSystemProfilePrivilege	3288	wmic.exe
Token: SeSystemtimePrivilege	3288	wmic.exe
Token: SeProfSingleProcessPrivilege	3288	wmic.exe
Token: SeIncBasePriorityPrivilege	3288	wmic.exe
Token: SeCreatePagefilePrivilege	3288	wmic.exe
Token: SeBackupPrivilege	3288	wmic.exe
Token: SeRestorePrivilege	3288	wmic.exe
Token: SeShutdownPrivilege	3288	wmic.exe
Token: SeDebugPrivilege	3288	wmic.exe
Token: SeSystemEnvironmentPrivilege	3288	wmic.exe
Token: SeRemoteShutdownPrivilege	3288	wmic.exe
Token: SeUndockPrivilege	3288	wmic.exe
Token: SeManageVolumePrivilege	3288	wmic.exe
Token: 33	3288	wmic.exe
Token: 34	3288	wmic.exe
Token: 35	3288	wmic.exe
Token: 36	3288	wmic.exe
Token: SeIncreaseQuotaPrivilege	3288	wmic.exe
Token: SeSecurityPrivilege	3288	wmic.exe
Token: SeTakeOwnershipPrivilege	3288	wmic.exe
Token: SeLoadDriverPrivilege	3288	wmic.exe
Token: SeSystemProfilePrivilege	3288	wmic.exe
Token: SeSystemtimePrivilege	3288	wmic.exe
Token: SeProfSingleProcessPrivilege	3288	wmic.exe
Token: SeIncBasePriorityPrivilege	3288	wmic.exe
Token: SeCreatePagefilePrivilege	3288	wmic.exe
Token: SeBackupPrivilege	3288	wmic.exe
Token: SeRestorePrivilege	3288	wmic.exe
Token: SeShutdownPrivilege	3288	wmic.exe
Token: SeDebugPrivilege	3288	wmic.exe
Token: SeSystemEnvironmentPrivilege	3288	wmic.exe
Token: SeRemoteShutdownPrivilege	3288	wmic.exe
Token: SeUndockPrivilege	3288	wmic.exe
Token: SeManageVolumePrivilege	3288	wmic.exe
Token: 33	3288	wmic.exe
Token: 34	3288	wmic.exe
Token: 35	3288	wmic.exe
Token: 36	3288	wmic.exe
Token: SeIncreaseQuotaPrivilege	5012	wmic.exe
Token: SeSecurityPrivilege	5012	wmic.exe
Token: SeTakeOwnershipPrivilege	5012	wmic.exe
Token: SeLoadDriverPrivilege	5012	wmic.exe
Token: SeSystemProfilePrivilege	5012	wmic.exe
Token: SeSystemtimePrivilege	5012	wmic.exe
Token: SeProfSingleProcessPrivilege	5012	wmic.exe
Token: SeIncBasePriorityPrivilege	5012	wmic.exe
Token: SeCreatePagefilePrivilege	5012	wmic.exe
Token: SeBackupPrivilege	5012	wmic.exe
Token: SeRestorePrivilege	5012	wmic.exe
Token: SeShutdownPrivilege	5012	wmic.exe
Token: SeDebugPrivilege	5012	wmic.exe
Token: SeSystemEnvironmentPrivilege	5012	wmic.exe
Token: SeRemoteShutdownPrivilege	5012	wmic.exe
Token: SeUndockPrivilege	5012	wmic.exe
Token: SeManageVolumePrivilege	5012	wmic.exe
Token: 33	5012	wmic.exe
Token: 34	5012	wmic.exe
Token: 35	5012	wmic.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4656	3868	omx.exe	87
PID 3868 wrote to memory of 1776	3868	omx.exe	88
PID 3868 wrote to memory of 3288	3868	omx.exe	91
PID 3868 wrote to memory of 5012	3868	omx.exe	94
PID 3868 wrote to memory of 3472	3868	omx.exe	96
PID 3868 wrote to memory of 2608	3868	omx.exe	98
PID 3868 wrote to memory of 1192	3868	omx.exe	100
PID 3868 wrote to memory of 2568	3868	omx.exe	102
PID 3868 wrote to memory of 636	3868	omx.exe	104
PID 3868 wrote to memory of 3676	3868	omx.exe	106
PID 3868 wrote to memory of 1820	3868	omx.exe	108
PID 3868 wrote to memory of 4828	3868	omx.exe	110
PID 3868 wrote to memory of 2136	3868	omx.exe	112
PID 3868 wrote to memory of 5036	3868	omx.exe	121
PID 3868 wrote to memory of 568	3868	omx.exe	127
PID 3868 wrote to memory of 2392	3868	omx.exe	129
PID 3868 wrote to memory of 4684	3868	omx.exe	131
PID 3868 wrote to memory of 4316	3868	omx.exe	133
PID 3868 wrote to memory of 1256	3868	omx.exe	135
PID 3868 wrote to memory of 1832	3868	omx.exe	137
PID 3868 wrote to memory of 1672	3868	omx.exe	139

C:\Users\Admin\AppData\Local\Temp\omx.exe
"C:\Users\Admin\AppData\Local\Temp\omx.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Windows\system32\cmd.exe
  "cmd" /C ver
  2⤵
  - Executes a command shell one-liner
  PID:1776
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get totalphysicalmemory
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:3472
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:2608
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:1192
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  PID:2568
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" logicaldisk get name,size,freespace
  2⤵
  PID:636
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  PID:3676
- C:\Windows\system32\ipconfig.exe
  "ipconfig" /all
  2⤵
  - Gathers network information
  PID:1820
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  PID:4828
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" product get name
  2⤵
  PID:2136
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:5036
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:568
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:2392
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:4684
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  PID:4316
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  PID:1256
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  PID:1832
- C:\Windows\system32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d095e1cce59a4c5e.tmp

Path C:\Users\Admin\AppData\Local\Temp\d095e1cce59a4c5e.tmp
Size 415KB
SHA256 a9f729693df458da3a15d702135514a60950353a8d13a635d530ff148e399226
MD5 e6b308b6b59932adf7539f28f2ebb48e
SHA1 2991e7fab04f9f4a8dfd988d61eeb546121c2dcf
SHA512 e3212aeb60b4a801f9d398132919592f1699677f743ced0bfab95dfb54669e0a291e066413d3ad88edf273b1bf322c71843a8317bb251c6987370ca3d5828032
SSDEEP 6144:1WFUmxjk0+xW370JjcReOtciXfpXBuDIFewsDMgMvu93XYqFZStUwO0b147jQSOk:1y5Lz70yeIc2fpxuhws4gUQYqCZKQlk
TLSH
T1369423F7533383488103DCD0F4A966F8EB99F78999F9F58F52B88A626287035C45F249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gt_1291631918.db

Path C:\Users\Admin\AppData\Local\Temp\gt_1291631918.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gt_3136556821.db

Path C:\Users\Admin\AppData\Local\Temp\gt_3136556821.db
Size 138KB
SHA256 8557f90c38f7d05792217c45dae6269a0f753e652f283c29ad5a574de99ef36b
MD5 236fbfbdd9c6b4e447334ed529e2f41f
SHA1 7341860176b9eeb92ac86bb5d90509bb315e60ce
SHA512 f09ef426354f3f2b92a0993c152dfc665a3314e4cc7c0814afb76138e661c1dd5d502e4b3bdd71c7a3852457985c347cdbc3b9c54107e1b3ceb7c44c0088ad84
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O3HVumTny4a4:FnbZeMrv/hGt3/ny4X
TLSH
T19FD3974B3A743002EDE59A722CF051BB5D3CB16D4F51A5D428B620688EF2863B63D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download