4b371a0b9936b53786685156ae141afb95cbe22e138a93d818c7c50bcbe5ddb6

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
omx.exe
Size 56.6MB
Sample260820-e3wffazbmf
SHA256 4b371a0b9936b53786685156ae141afb95cbe22e138a93d818c7c50bcbe5ddb6
MD5 52c4a68cff93bd5cc84ad72ff44e4788
SHA1 341a3aec2e08095ce2d5b38087e98892a4bc2b21
SHA512 98a99ddfcbb88b9dc78b30f0bc4fb6b418f0c31639c258799f480cb376ddcdac3c90e1a231ce26f90a357163aee9cc22a0b8bd6644ba6b1ba936745ed1177808
SSDEEP 98304:WsRPTHUIN5GYt+LxXAzpE4qLrYVSt4Ytn+xAf1B:V5GYItXAzpGLoStxUAf1B
TLSH
T17CD7B43E00AA3DF7D184A19C92F36979FB30590AEF6C77E112AB447D4D19DA5083E21B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipapi.co
1	ip-api.com
5	ipapi.co

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2284	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2184	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5816	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2828	wmic.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5568	ipconfig.exe

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
3336	taskkill.exe
2292	taskkill.exe
5404	taskkill.exe
5708	taskkill.exe
3208	taskkill.exe
5828	taskkill.exe
5992	taskkill.exe
4180	taskkill.exe
5392	taskkill.exe
5436	taskkill.exe
5656	taskkill.exe
4592	taskkill.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5200	wmic.exe
5200	wmic.exe
5200	wmic.exe
5200	wmic.exe
5976	wmic.exe
5976	wmic.exe
5976	wmic.exe
5976	wmic.exe
2828	wmic.exe
2828	wmic.exe
2828	wmic.exe
2828	wmic.exe
4824	wmic.exe
4824	wmic.exe
4824	wmic.exe
4824	wmic.exe
1864	wmic.exe
1864	wmic.exe
1864	wmic.exe
1864	wmic.exe
5272	omx.exe
5272	omx.exe
5272	omx.exe
5272	omx.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5272	omx.exe
Token: SeDebugPrivilege	3336	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5200	wmic.exe
Token: SeSecurityPrivilege	5200	wmic.exe
Token: SeTakeOwnershipPrivilege	5200	wmic.exe
Token: SeLoadDriverPrivilege	5200	wmic.exe
Token: SeSystemProfilePrivilege	5200	wmic.exe
Token: SeSystemtimePrivilege	5200	wmic.exe
Token: SeProfSingleProcessPrivilege	5200	wmic.exe
Token: SeIncBasePriorityPrivilege	5200	wmic.exe
Token: SeCreatePagefilePrivilege	5200	wmic.exe
Token: SeBackupPrivilege	5200	wmic.exe
Token: SeRestorePrivilege	5200	wmic.exe
Token: SeShutdownPrivilege	5200	wmic.exe
Token: SeDebugPrivilege	5200	wmic.exe
Token: SeSystemEnvironmentPrivilege	5200	wmic.exe
Token: SeRemoteShutdownPrivilege	5200	wmic.exe
Token: SeUndockPrivilege	5200	wmic.exe
Token: SeManageVolumePrivilege	5200	wmic.exe
Token: 33	5200	wmic.exe
Token: 34	5200	wmic.exe
Token: 35	5200	wmic.exe
Token: 36	5200	wmic.exe
Token: SeIncreaseQuotaPrivilege	5200	wmic.exe
Token: SeSecurityPrivilege	5200	wmic.exe
Token: SeTakeOwnershipPrivilege	5200	wmic.exe
Token: SeLoadDriverPrivilege	5200	wmic.exe
Token: SeSystemProfilePrivilege	5200	wmic.exe
Token: SeSystemtimePrivilege	5200	wmic.exe
Token: SeProfSingleProcessPrivilege	5200	wmic.exe
Token: SeIncBasePriorityPrivilege	5200	wmic.exe
Token: SeCreatePagefilePrivilege	5200	wmic.exe
Token: SeBackupPrivilege	5200	wmic.exe
Token: SeRestorePrivilege	5200	wmic.exe
Token: SeShutdownPrivilege	5200	wmic.exe
Token: SeDebugPrivilege	5200	wmic.exe
Token: SeSystemEnvironmentPrivilege	5200	wmic.exe
Token: SeRemoteShutdownPrivilege	5200	wmic.exe
Token: SeUndockPrivilege	5200	wmic.exe
Token: SeManageVolumePrivilege	5200	wmic.exe
Token: 33	5200	wmic.exe
Token: 34	5200	wmic.exe
Token: 35	5200	wmic.exe
Token: 36	5200	wmic.exe
Token: SeDebugPrivilege	5392	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5976	wmic.exe
Token: SeSecurityPrivilege	5976	wmic.exe
Token: SeTakeOwnershipPrivilege	5976	wmic.exe
Token: SeLoadDriverPrivilege	5976	wmic.exe
Token: SeSystemProfilePrivilege	5976	wmic.exe
Token: SeSystemtimePrivilege	5976	wmic.exe
Token: SeProfSingleProcessPrivilege	5976	wmic.exe
Token: SeIncBasePriorityPrivilege	5976	wmic.exe
Token: SeCreatePagefilePrivilege	5976	wmic.exe
Token: SeBackupPrivilege	5976	wmic.exe
Token: SeRestorePrivilege	5976	wmic.exe
Token: SeShutdownPrivilege	5976	wmic.exe
Token: SeDebugPrivilege	5976	wmic.exe
Token: SeSystemEnvironmentPrivilege	5976	wmic.exe
Token: SeRemoteShutdownPrivilege	5976	wmic.exe
Token: SeUndockPrivilege	5976	wmic.exe
Token: SeManageVolumePrivilege	5976	wmic.exe
Token: 33	5976	wmic.exe
Token: 34	5976	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1328	msiexec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5272 wrote to memory of 3336	5272	omx.exe	88
PID 5272 wrote to memory of 2184	5272	omx.exe	89
PID 5272 wrote to memory of 5200	5272	omx.exe	92
PID 5272 wrote to memory of 5392	5272	omx.exe	95
PID 5272 wrote to memory of 5976	5272	omx.exe	97
PID 5272 wrote to memory of 2292	5272	omx.exe	99
PID 5272 wrote to memory of 2828	5272	omx.exe	101
PID 5272 wrote to memory of 5404	5272	omx.exe	103
PID 5272 wrote to memory of 5708	5272	omx.exe	105
PID 5272 wrote to memory of 4824	5272	omx.exe	107
PID 5272 wrote to memory of 5436	5272	omx.exe	109
PID 5272 wrote to memory of 5568	5272	omx.exe	111
PID 5272 wrote to memory of 1864	5272	omx.exe	113
PID 5272 wrote to memory of 2284	5272	omx.exe	117
PID 5272 wrote to memory of 3208	5272	omx.exe	119
PID 5272 wrote to memory of 5828	5272	omx.exe	121
PID 5272 wrote to memory of 5656	5272	omx.exe	123
PID 5272 wrote to memory of 4592	5272	omx.exe	125
PID 5272 wrote to memory of 5992	5272	omx.exe	127
PID 5272 wrote to memory of 4180	5272	omx.exe	129
PID 5272 wrote to memory of 5816	5272	omx.exe	131

C:\Users\Admin\AppData\Local\Temp\omx.exe
"C:\Users\Admin\AppData\Local\Temp\omx.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5272
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3336
- C:\Windows\system32\cmd.exe
  "cmd" /C ver
  2⤵
  - Executes a command shell one-liner
  PID:2184
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5200
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get totalphysicalmemory
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5976
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:2292
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:2828
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  PID:5404
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  PID:5708
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" logicaldisk get name,size,freespace
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  PID:5436
- C:\Windows\system32\ipconfig.exe
  "ipconfig" /all
  2⤵
  - Gathers network information
  PID:5568
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" product get name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:2284
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:3208
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:5828
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:5656
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  PID:4592
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  PID:5992
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  PID:4180
- C:\Windows\system32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5816

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of SetWindowsHookEx
PID:1328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f77df090daf66507.tmp

Path C:\Users\Admin\AppData\Local\Temp\f77df090daf66507.tmp
Size 353KB
SHA256 e361c8839b80c83149177c6b790679fc895fa7c4b747faff1f547e484abacd7b
MD5 d7b705648404c7eaf3688d23c47c1f68
SHA1 0f726a33771d260a5757cff3dc618c51ba9ad3f1
SHA512 95f587ea570bd6ab5f61a04a991bdb221d7f21d633af1ea838a26ecda9560f03d4ecc53221ee7896646cf95ba64e58a56e4b95f26ffa0361770b021816864c4a
SSDEEP 6144:1Lr+3FYVLmF5Gr6IomXxBZc+VvvJTRnMTV1NyUsACUOGEx+kI+XOLmBU7:1+3FsmF5a6/ixxhTRnqdt2x+kI+Vg
TLSH
T16A7423C3C8403788CE0B6560C675FED2808D574B4666F1B28542ABBACE3BD26D631FD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download