9e278f70acd106ec131683744cbb4e7bd197afa30309723f54e96a6a295933e0

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 04:31

Target
FSB-Connect-718 (1).exe
Size 34KB
Sample260821-e5e68sw1bt
SHA256 9e278f70acd106ec131683744cbb4e7bd197afa30309723f54e96a6a295933e0
MD5 55143929a5f87c566335ec47e4f9af5f
SHA1 438b3fc1ebf75ccb4baab42694dd3deed9575f01
SHA512 74cc9939171eb826df4bcf40305db54c372d0ee91b238e914c42d9a374a7573a0298fceaf336ef59e7500d556faa8f1e2e9a7d2d6b52503feeca226501d0ade1
SSDEEP 768:mQbWXizoL7kv5DaUVS4s3OFb9IeGQHj/bdwK:mQiXizMoauNFb/zD/5wK
TLSH
T121F21A846BED8617E67F8A7EA9F141110331A5279917EB8F0DCC64DC28E3B404A14BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2112	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	FSB-Connect-718 (1).exe
Token: SeDebugPrivilege	4284	FSB-Connect-718 (1).exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2364	FSB-Connect-718 (1).exe
4284	FSB-Connect-718 (1).exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4284	2364	FSB-Connect-718 (1).exe	88
PID 2364 wrote to memory of 4880	2364	FSB-Connect-718 (1).exe	89
PID 2364 wrote to memory of 2112	2364	FSB-Connect-718 (1).exe	91
PID 4284 wrote to memory of 3952	4284	FSB-Connect-718 (1).exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FSB-Connect-718 (1).exe
"C:\Users\Admin\AppData\Local\Temp\FSB-Connect-718 (1).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\FSB-Connect-718 (1).exe
  "C:\Users\Admin\AppData\Local\Temp\FSB-Connect-718 (1).exe" --watchdog
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /query /tn "MicrosoftUpdate718"
    3⤵
    PID:3952
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /query /tn "MicrosoftUpdate718"
  2⤵
  PID:4880
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "MicrosoftUpdate718" /tr "C:\Users\Admin\AppData\Local\Temp\FSB-Connect-718 (1).exe" /sc onlogon /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2112