56e25bff1587bb278f048a1ae5f74e2286946f1cbaf59aaa03d3cea070a462ae

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer/DW/dw.exe
Size 3.6MB
Sample260825-rbttrazvg1
SHA256 56e25bff1587bb278f048a1ae5f74e2286946f1cbaf59aaa03d3cea070a462ae
MD5 c503cb2ca43594f1ac72d5c9c3b9bc27
SHA1 67a9b5a371f806be8e8009bc37153165e42f7b23
SHA512 a655b257a8bcd3ecbc56f11573320bd2024a4f1842e2b1223997b146c703d38fa1b864a07373fd20f2b0e3b3bc6a3032232df1d3fe6d689d62c991724de8c699
SSDEEP 49152:sYxgaLCN+0v/2rdPm/jUJu75vfX7WMsf1SgibezD1BT:cNc+U
TLSH
T114062707389411E0C8EB9A35E1BA1262AB247C8DC73473E36E5167702F667C13EF9B59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1564	chrome.exe
4620	chrome.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dw.exe
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3268	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
4388	taskkill.exe
4160	taskkill.exe
3604	taskkill.exe
4116	taskkill.exe
860	taskkill.exe
2840	taskkill.exe
764	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2064	dw.exe
2064	dw.exe
2064	dw.exe
2064	dw.exe
2064	dw.exe
2064	dw.exe
4620	chrome.exe
4620	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	764	taskkill.exe
Token: SeDebugPrivilege	3604	taskkill.exe
Token: SeDebugPrivilege	4160	taskkill.exe
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	860	taskkill.exe
Token: SeDebugPrivilege	2840	taskkill.exe
Token: SeDebugPrivilege	4116	taskkill.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4388	2064	dw.exe	86
PID 2064 wrote to memory of 4160	2064	dw.exe	87
PID 2064 wrote to memory of 3604	2064	dw.exe	88
PID 2064 wrote to memory of 764	2064	dw.exe	89
PID 2064 wrote to memory of 2840	2064	dw.exe	90
PID 2064 wrote to memory of 860	2064	dw.exe	91
PID 2064 wrote to memory of 4116	2064	dw.exe	92
PID 2064 wrote to memory of 1564	2064	dw.exe	101
PID 1564 wrote to memory of 4484	1564	chrome.exe	102
PID 2064 wrote to memory of 4620	2064	dw.exe	105
PID 4620 wrote to memory of 944	4620	chrome.exe	106
PID 4620 wrote to memory of 2540	4620	chrome.exe	109
PID 4620 wrote to memory of 2540	4620	chrome.exe	109
PID 4620 wrote to memory of 3268	4620	chrome.exe	110
PID 4620 wrote to memory of 1824	4620	chrome.exe	111
PID 4620 wrote to memory of 1824	4620	chrome.exe	111
PID 4620 wrote to memory of 2360	4620	chrome.exe	112
PID 4620 wrote to memory of 2360	4620	chrome.exe	112
PID 4620 wrote to memory of 552	4620	chrome.exe	113
PID 4620 wrote to memory of 552	4620	chrome.exe	113

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dw.exe

C:\Users\Admin\AppData\Local\Temp\Installer\DW\dw.exe
"C:\Users\Admin\AppData\Local\Temp\Installer\DW\dw.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:2064
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3604
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x198,0x19c,0x1a0,0xd8,0x1a4,0x7ffd88cdc728,0x7ffd88cdc734,0x7ffd88cdc740
    3⤵
    PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd88cdc728,0x7ffd88cdc734,0x7ffd88cdc740
    3⤵
    PID:944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,8030060289923611455,17078592547754506581,262144 --field-trial-handle=2036,i,15348071577919357462,1742569335666454291,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:2
    3⤵
    PID:2540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,16113284403841595833,5381567480776588312,524288 --field-trial-handle=2036,i,15348071577919357462,1742569335666454291,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,376322579713672443,12068297034511376638,524288 --field-trial-handle=2036,i,15348071577919357462,1742569335666454291,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
    3⤵
    PID:1824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,11979244257553487670,4488042722791145932,2097152 --field-trial-handle=2036,i,15348071577919357462,1742569335666454291,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,17940003593081423522,8899759857270560033,2097152 --field-trial-handle=2036,i,15348071577919357462,1742569335666454291,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3096 /prefetch:1
    3⤵
    PID:552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 ecd252b3f1c5f339086245da7090a285db79f6bdbaf05efc407e533763b1cd9d
MD5 9e8a968ddefd4d013e51d21d82cf1104
SHA1 2fbcd2f941dcb366be77993bac70c4e59d25de29
SHA512 5c8f8e39a186c5f1aa266b589b30bd1126d6f7e74860b3db3e5e427f28c5b8e9beec691dfaed35f96d0998833be844518bee7e0a64b8ccb4dde37e161d1c26c8
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7d38b5d0cc1f35fbd394da11987e7eb03b6a4e82d09e703df5a0bd0b3699ed29
MD5 f4c91b5f3b3a04525f27d60b638602ea
SHA1 842a51cb046c225b9c3bf39ee10fa7df8e2da104
SHA512 30c930130d35109f9bfbdac88c3f02965b9b9391b6c740ad325e15bb36299050106a680d479a0fc5187397c878ce7df8a7156761e75b3090207d331a96d5539e
SSDEEP 3072:6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMT:dm7Rkm1tYpBeh2BAoT
TLSH
T15CC3123B5D65E9375D79A71EB48E0B1E1EF24DA6C930DE42C8D86A0437FA7CC1904A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
TLSH
T175A02407C473C00FFC144051C45C034134F4C047011DD4015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

abe_key_1564.txt

Path C:\Users\Admin\AppData\Local\Temp\abe_key_1564.txt
Size 64B
SHA256 4ac045479686a8d3222224ce3140d49965088f4f3df92314781c756e1f794772
MD5 8d14260cbdd4f3791e7b7b7fa4e8eaea
SHA1 34590391f25df3689e6b2182d66306c3688f29fd
SHA512 495a0d5bdae86d745a54c296a15c5c8bb72a24701ccee5aaf643a0ff1047413cdb8d5cc97e739722913cdbc9e83b6a1a1ab0bec8d4e5875745388617aa16c5c7
TLSH
T192A002601B94341B4139947568AB26256B8D1E0459F28F7549D848D109B1595A41D528
MD5 SHA1 SHA512 TLSH

Submit Download

kmd_abe_1564.dll

Path C:\Users\Admin\AppData\Local\Temp\kmd_abe_1564.dll
Size 18KB
SHA256 015807e7ccf44cd9fa4eba831970ebcbfe58234696c2135ec684c8e1dd687f09
MD5 9906b7f01ee4a2a914da39905755b4a1
SHA1 3ae7918b376b74ab528a64c82f9283ca81c66ab4
SHA512 bced436b176083a6f579a99d7463312fc1effe994c51dca8a27dca33b6e97e286323eda4c3afecc38f03cda9137524b4f2b2a00fbed9bb8071ef3d997a123b78
SSDEEP 384:cZCEQMnwXECSuRbVoWzqoDufTsJoqgh9PUZ:cr6BSIzqWufI9yc
TLSH
T1ED82080E774208EDCD6AC23889FF57BEF2F1740162693B2E1A68D2361E51B34567A5CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2064-34-0x0000000140000000-0x000000014003D000-memory.dmp

Download

memory/2064-35-0x0000000140000000-0x000000014003D000-memory.dmp

Download

memory/2064-33-0x0000000140000000-0x000000014003D000-memory.dmp

Download

memory/2064-37-0x0000000140000000-0x000000014003D000-memory.dmp

Download

memory/2064-28-0x0000000140000000-0x000000014003D000-memory.dmp

Download

memory/2064-0-0x0000000140000000-0x000000014003D000-memory.dmp

Download

memory/2064-9-0x0000000140000000-0x000000014003D000-memory.dmp

Download

memory/2064-97-0x0000000140000000-0x000000014003D000-memory.dmp

Download

memory/2064-99-0x0000000140000000-0x000000014003D000-memory.dmp

Download

memory/2064-102-0x0000000140000000-0x000000014003D000-memory.dmp

Download