24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe
Size 9.4MB
Sample260820-vafsaaee68
SHA256 24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8
MD5 d44a85470021670bc9fea8ae31e9bc3a
SHA1 c056e616dfb23ae26e342e1c5b45a5830461deaa
SHA512 9b261242c617eda86eeb161133ec042926b993ae4a8b717e5a5ea7901019d6703efeffddc138c25d6043cf09dbfb7fa964ab99fbd9f6d62446bb72efff89f803
SSDEEP 98304:Ni0MdnxV0CKFA0WvkFUjr1KDBGYklYKnmYhUwpz8tlU8QdmjJiML7EC:C30CKFAjvrlKDBGYgSFgelLKC
TLSH
T1EAA63840EEDB51F6F943197141ABB27F23341D098F28DB97EB417F6AE8776921832206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	reagentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	reagentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reagentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
5944	taskkill.exe
3500	taskkill.exe
5984	taskkill.exe
5768	taskkill.exe
3420	taskkill.exe
5136	taskkill.exe
3532	taskkill.exe
5828	taskkill.exe
5688	taskkill.exe
5244	taskkill.exe
4812	taskkill.exe
2872	taskkill.exe
1344	taskkill.exe
412	taskkill.exe
2300	taskkill.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	5688	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeDebugPrivilege	1344	taskkill.exe
Token: SeDebugPrivilege	5768	taskkill.exe
Token: SeDebugPrivilege	412	taskkill.exe
Token: SeDebugPrivilege	3420	taskkill.exe
Token: SeDebugPrivilege	2300	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	5944	taskkill.exe
Token: SeDebugPrivilege	3500	taskkill.exe
Token: SeDebugPrivilege	4812	taskkill.exe
Token: SeDebugPrivilege	5828	taskkill.exe
Token: SeSystemEnvironmentPrivilege	5588	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 5688	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	89
PID 4636 wrote to memory of 3532	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	92
PID 4636 wrote to memory of 5984	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	94
PID 4636 wrote to memory of 2872	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	96
PID 4636 wrote to memory of 5244	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	98
PID 4636 wrote to memory of 1344	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	100
PID 4636 wrote to memory of 5768	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	102
PID 4636 wrote to memory of 412	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	104
PID 4636 wrote to memory of 3420	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	106
PID 4636 wrote to memory of 2300	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	108
PID 4636 wrote to memory of 5136	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	110
PID 4636 wrote to memory of 5944	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	112
PID 4636 wrote to memory of 3500	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	114
PID 4636 wrote to memory of 4812	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	116
PID 4636 wrote to memory of 5828	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	118
PID 4636 wrote to memory of 2712	4636	24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe	120

C:\Users\Admin\AppData\Local\Temp\24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe
"C:\Users\Admin\AppData\Local\Temp\24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5688
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3532
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5984
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM kometa.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5244
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM orbitum.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM centbrowser.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5768
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM 7star.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM sputnik.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3420
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM epicprivacybrowser.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5944
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM uran.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM yandex.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM iridium.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5828
- C:\Windows\SysWOW64\reagentc.exe
  reagentc.exe /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads