Analysis
- max time kernel
149s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 11:57
General
- Target 1c42c646c14671f3804d3d69448e0780a59f5b6eccc88f16c411cc8d16601d9c.exe
- Size 58KB
- Sample260824-n4mdladc39
- SHA256 1c42c646c14671f3804d3d69448e0780a59f5b6eccc88f16c411cc8d16601d9c
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c42c646c14671f3804d3d69448e0780a59f5b6eccc88f16c411cc8d16601d9c.exe"C:\Users\Admin\AppData\Local\Temp\1c42c646c14671f3804d3d69448e0780a59f5b6eccc88f16c411cc8d16601d9c.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/6004-0-0x00007FFBCBD6F000-0x00007FFBCBD70000-memory.dmp
memory/6004-1-0x0000000000D40000-0x0000000000D54000-memory.dmp
memory/6004-3-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/6004-4-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/6004-5-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/6004-6-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/6004-7-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/6004-8-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/6004-9-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/6004-10-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/6004-12-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/6004-14-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp
memory/6004-15-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp