milleniumrat | f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982.exe
Size 2.6MB
Sample260824-sxt73sea68
SHA256 f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982
MD5 885ad4ae2e27aff33a17c9a3200297ca
SHA1 e519dfb09d527cc694d7a77f9aef2e5772b3eeec
SHA512 341b8f8d45969312ce66151798c80663f9c2fcece47ab01df6e736376a86b5a6560a1941010ff5e7fe291237769e509c3318fbd86d995ec952719098d535d6b0
SSDEEP 49152:/5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUn9KTnUVz:ETrVI4dGOgGpYHCO
TLSH
T170D59D62F782D0B2E4D201B151BEABF75D787635537584CBE3C01E6A49206C2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery milleniumrat rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000245dc-2.dat	family_milleniumrat

Uses browser remote debugging 2 TTPs 1 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3824	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
2816	svchost.exe
4560	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	raw.githubusercontent.com
27	raw.githubusercontent.com
46	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12	ip-api.com

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00080000000245dc-2.dat	suspicious_telegram_bot

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1748	msedge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4560	svchost.exe
4560	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
2816	svchost.exe
2816	svchost.exe
4560	svchost.exe
4560	svchost.exe
4560	svchost.exe
2816	svchost.exe
4560	svchost.exe
2816	svchost.exe
2816	svchost.exe
4560	svchost.exe
4560	svchost.exe
2816	svchost.exe
2816	svchost.exe
4560	svchost.exe
2816	svchost.exe
4560	svchost.exe
4560	svchost.exe
2816	svchost.exe
4560	svchost.exe
2816	svchost.exe
2816	svchost.exe
4560	svchost.exe
2816	svchost.exe
4560	svchost.exe
2816	svchost.exe
4560	svchost.exe
2816	svchost.exe
4560	svchost.exe
2816	svchost.exe
4560	svchost.exe
4560	svchost.exe
2816	svchost.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
2816	svchost.exe
4560	svchost.exe
4560	svchost.exe
2816	svchost.exe
2816	svchost.exe
4560	svchost.exe
2816	svchost.exe
4560	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	svchost.exe
Token: SeDebugPrivilege	2816	svchost.exe
Token: SeDebugPrivilege	2816	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3824	msedge.exe
868	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
868	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4560	svchost.exe
2816	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2816	2880	f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982.exe	85
PID 2816 wrote to memory of 3824	2816	svchost.exe	96
PID 3824 wrote to memory of 868	3824	msedge.exe	97
PID 3824 wrote to memory of 1748	3824	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982.exe
"C:\Users\Admin\AppData\Local\Temp\f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Roaming\TsSXHX\svchost.exe
  "C:\Users\Admin\AppData\Roaming\TsSXHX\svchost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffa03b3c188,0x7ffa03b3c194,0x7ffa03b3c1a0
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1900,i,3471702118367829578,14938534010217293091,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:3
      4⤵
      System Time Discovery
      PID:1748

C:\Users\Admin\AppData\Roaming\TsSXHX\svchost.exe
C:\Users\Admin\AppData\Roaming\TsSXHX\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

448c1119-7569-4a90-abc8-ee6882f22f8b.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\448c1119-7569-4a90-abc8-ee6882f22f8b.dmp
Size 7.3MB
SHA256 7a627091ae3d72d1461502712bd822963d75837f98a049349624eff29c9a39f4
MD5 635eae47d6bf5ea9e68d159176eb44b9
SHA1 81ac411a47d976b099d2f36f27b51df4e7cd8a24
SHA512 4ce7f49a1dc53332cb3f056ac8db273651f50f22d4e949a844a3f85aca8e7fe2b47e41df2ce065ae1b1250171d387302a8c38c673860e688016d4e38d0a86fbe
SSDEEP 98304:6r37WpPQM1111111111111111111111111111111111111115RQ6+/Pb:Sq1ub
TLSH
T15F76B47BE359465BF20952B0A796B766E7F3ECA04A868307771033ADEC776085F19B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d530c44a-f92c-4d47-b13b-9a0f5dfd3f8a.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d530c44a-f92c-4d47-b13b-9a0f5dfd3f8a.dmp
Size 6.0MB
SHA256 097c68f3cccc948d1595b3d85527b919dda6fcf9b88fc905c2566cc6f5258beb
MD5 6ab24ea17ab6e500749bed037ecaa777
SHA1 bac2241afb38b833a9cbca8859ccf9867c58b04d
SHA512 c8d801d53b08033bbe622b2c8a650ff43349a6bfd5c9c39a9b9e5b9af3e2045e9ff0a923901be5a8d35208f26e63ce45693f0c2646126b67fba059ca81597e75
SSDEEP 98304:Cr379EYwM1111111111111111111111111111111111111113XW144:qJ/8h
TLSH
T1DE56C477E35E425BF209527097A6B666EAF3FCA05A8683173710339DEC776085F1AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 62cd7b16e740e10a659492abf5cd888f94454339886da46d1c1939ddd797c31d
MD5 933de9f8525eacda4cab17cf2025fc3d
SHA1 54a5168c09dbb02bc3fb4e0829cc383a0b7f72fc
SHA512 43f52ec38f4fb8109274e248c01061ad94b5acb2e193821d3a9ca398b831699e21f5eaff1a785e48b20edad8dfdb5cdca8b2f8f650684624f1956d7fcb691d2c
TLSH
T1CBD08023771D7186F35B81B59053D702591680757463B701B326D51C9A741C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2dbfb9bb40bab45f80bf4028c40d0109f56ac92ec480ac335bf6a43c2c847c66
MD5 8221041b8c0537dd1595767e23094bb8
SHA1 f981eecb6e46c2f53609f3654b88b67d2444c27c
SHA512 efd1d27bf1d3f6969d3402888128dc7c24c31f4f17869c8b3ac289a2583eb77495a2cdd2228ab43e3a9abf5775c2c8661dda9912d8659d3d9cf6fefefc62acc0
SSDEEP 192:tON16JkRtQmiUyVoW+RNNOmz+ih32RIU6:tON16UrlW+RNNOE+6dU6
TLSH
T16B02D9356D382C7B9EF26E09B58B27175FA8203BB9856F80D6E81F1D01D765C234B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4c41a6e72d545b3bfcd44b28af35a734e3565671efc57f875a00427090f4822a
MD5 2d6b1594023ca37dc25fd6ddedf5d448
SHA1 a01747ecf3517feaeb3bb4eef17c9ef0ec36fe0b
SHA512 83bb97dd722703020f8a2f38fb1ef3a2f983c82179e59f2862941bdf3dd66b948ea5d2399fd19da52137258d5d3e46fbb50c5bd5302070f8ec6dcdcd8ca30831
SSDEEP 192:1ONG6JkRGQmiUzbo7+RNNOmz+7R9R+2SVcf1NsU6:1ONG6UiQ7+RNNOE+l9R+21wU6
TLSH
T197121B3179285C775EE26545F48B35174FA95037EB8A6F90D1EC1E1C02DFA6C234F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7db9d02e-f0f5-4a4f-8187-2f8d3ba1e87d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7db9d02e-f0f5-4a4f-8187-2f8d3ba1e87d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\TsSXHX\svchost.exe
Size 2.6MB
SHA256 f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982
MD5 885ad4ae2e27aff33a17c9a3200297ca
SHA1 e519dfb09d527cc694d7a77f9aef2e5772b3eeec
SHA512 341b8f8d45969312ce66151798c80663f9c2fcece47ab01df6e736376a86b5a6560a1941010ff5e7fe291237769e509c3318fbd86d995ec952719098d535d6b0
SSDEEP 49152:/5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUn9KTnUVz:ETrVI4dGOgGpYHCO
TLSH
T170D59D62F782D0B2E4D201B151BEABF75D787635537584CBE3C01E6A49206C2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download