Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 1.exe
- Size 3.1MB
- Sample260823-apfevagh57
- SHA256 124cf79f222ef8b88f4d0e2e474378c5a7ab8a3c513d2434037ef0acfd79c984
- MD5 ff1b216b6ef02dceda621ca45ed4f0c3
- SHA1 c23d33b86e22f305fd600145f27f6a9522e29cc0
- SHA512 27d8a4977614083b006f628f2b3b2678e0584950890e4686914c8eff387f7912218fd01bf91421725fa7cd635eb40d23bfaaf4c4fe0a0ec34aff0d62e96084c8
- SSDEEP 49152:VbXJAziaUp62zIVATR/jSu7UR4Sh9YQd1u2oiVK/:VbZaFwTUu7UOPQdUd
- TLSH T132E57C877CA108F6C4AA95318932E6667B61BC480F2153D72ED0BE3A3FB6BE05D75704
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Detects SvcStealer Payload 6 IoCs
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
resource yara_rule behavioral1/memory/1660-0-0x00007FF7C6770000-0x00007FF7C68BA000-memory.dmp family_svcstealer behavioral1/memory/1660-12-0x00007FF7C6770000-0x00007FF7C68BA000-memory.dmp family_svcstealer behavioral1/memory/1660-11-0x00007FF7C6770000-0x00007FF7C68BA000-memory.dmp family_svcstealer behavioral1/memory/1660-6-0x00007FF7C6770000-0x00007FF7C68BA000-memory.dmp family_svcstealer behavioral1/memory/1660-13-0x00007FF7C6770000-0x00007FF7C68BA000-memory.dmp family_svcstealer behavioral1/memory/1660-15-0x00007FF7C6770000-0x00007FF7C68BA000-memory.dmp family_svcstealer - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3284 set thread context of 1660 3284 1.exe 86 - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2124 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3284 1.exe 3284 1.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe 1660 helpPane.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3284 wrote to memory of 1660 3284 1.exe 86 PID 3284 wrote to memory of 1660 3284 1.exe 86 PID 3284 wrote to memory of 1660 3284 1.exe 86 PID 3284 wrote to memory of 1660 3284 1.exe 86 PID 3284 wrote to memory of 1660 3284 1.exe 86 PID 3284 wrote to memory of 1660 3284 1.exe 86 PID 3284 wrote to memory of 1660 3284 1.exe 86 PID 3284 wrote to memory of 1660 3284 1.exe 86 PID 1660 wrote to memory of 2124 1660 helpPane.exe 88 PID 2124 wrote to memory of 3348 2124 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\netsh.exenetsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"4⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3348
-
-
-