57c189aed8f238d97429ade67068307cdd17d1bc997e0bd27225e24b345d173c

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57c189aed8f238d97429ade67068307cdd17d1bc997e0bd27225e24b345d173c.exe
Size 695KB
Sample260826-nl2qkacq21
SHA256 57c189aed8f238d97429ade67068307cdd17d1bc997e0bd27225e24b345d173c
MD5 5eaa98c151c0cd0255a811cb084693e3
SHA1 47ed35829ced570341624e1c9368fc06d9994e17
SHA512 3eec0c3e5e9d074e7db54b4420c0b82ac8ec52d44124e0cb0c5b9e00df42189dd1c0b8a95da69ff2161fc0b54c37a4b719f34a1abaaedd0dd2dfed162cb2921e
SSDEEP 12288:XfOfuCG3hKZipyufZ3V8Jly0I2L2U+k9frs6Eu5gWFjddx/JKpPgpn6mMREDR42:XfOUnyGZ3wQz2Tps65dRKUzMR4H
TLSH
T11BE412157AD4C872D57208324AE4DBB1A9B9FD768F344E4B37C04F7E6BB0080627DA66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
876	im197X.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gefhacchlpdbilckjighmfabdeiijnkf\1.1\manifest.json	im197X.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gefhacchlpdbilckjighmfabdeiijnkf\1.1\manifest.json	im197X.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gefhacchlpdbilckjighmfabdeiijnkf\1.1\manifest.json	im197X.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gefhacchlpdbilckjighmfabdeiijnkf\1.1\manifest.json	im197X.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gefhacchlpdbilckjighmfabdeiijnkf\1.1\manifest.json	im197X.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57c189aed8f238d97429ade67068307cdd17d1bc997e0bd27225e24b345d173c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	im197X.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 876	4224	57c189aed8f238d97429ade67068307cdd17d1bc997e0bd27225e24b345d173c.exe	86

C:\Users\Admin\AppData\Local\Temp\57c189aed8f238d97429ade67068307cdd17d1bc997e0bd27225e24b345d173c.exe
"C:\Users\Admin\AppData\Local\Temp\57c189aed8f238d97429ade67068307cdd17d1bc997e0bd27225e24b345d173c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\584b5bae\im197X.exe
  "C:\Users\Admin\AppData\Local\Temp/584b5bae/im197X.exe"
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - System Location Discovery: System Language Discovery
  PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

K7tg3qI.js

Path C:\Users\Admin\AppData\Local\Temp\584b5bae\gefhacchlpdbilckjighmfabdeiijnkf\K7tg3qI.js
Size 26KB
SHA256 b24750d3d758119b5383ac8e305335ccad06735e990b71abf9a6d0c02da508c6
MD5 1c0d58e5bb2d5d8fcb4d844cbe9c0fc9
SHA1 bb9108762854708e0bc967bac047f8d4d04395a7
SHA512 7a7065b5b7212d8d243d1b3ae754e678d30626b2d72f4808c39a25a128e87157c177d7f55dc917f4b7b0a14eb3898c2a605b3ebd15fbadff7f7b001b0636d91d
SSDEEP 768:AO9OQYCGKvS16i6KUMATsI14b2M5pPw4vRb2srtd:AO9OQO+66i6MATsI14bF5pPw8b2srj
TLSH
T1F8C2C97F374AF78D0915DBB8B5478446D06A28DB271A828CB20BDDD2FC503B8DAD7960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\584b5bae\gefhacchlpdbilckjighmfabdeiijnkf\background.html
Size 144B
SHA256 3aff4f766665d8ab8bba772ee04135d7fe0aec1a7e49940d64a079cc79d09fbd
MD5 9468c32c0079c983c51300c1d1a2dbea
SHA1 ff0a757bfcfca0522c60c6082b7555dc9420d1a2
SHA512 634ddb34b34ba6dd10cae1fb9ca255a4bb240ffff8c245de03cbd5872d361a1f404265f00d85250c4f21a2c61084884a14da11f502f2ef775c6ebc4304395489
TLSH
T1EDC02BD9BC40802CAA103CCC4CF0F20C4C4C8408B890CE3808F8303805813ADCC232C1
MD5 SHA1 SHA512 TLSH

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\584b5bae\gefhacchlpdbilckjighmfabdeiijnkf\lsdb.js
Size 9KB
SHA256 30cf4b768894f2ff6ac9468542f796e514f0f05427cc42dbdddb31e49dcc2e41
MD5 550444752785cbdb545d2bb40338f0c9
SHA1 d1e9ee2286b033412608d2aa4a0e0bbd5bef32a8
SHA512 0b09a4108e17f96005fe41d1c14101377dd9352554d2cb6c2e9aa77b907b42471d06460c5d4120e647ffa2919eff8ec6d660dfea769ddd0668b49448dd6b56c6
SSDEEP 192:pnd4whp06P3/6Y84IZcQONH7SDwxaQBVkmHqi5syb43zAsIW:1506v/6Y844cQONnaQB1T5so4jA6
TLSH
T15F22B54F39CD5C52560AD7B87687D4E6D5A22CC45AB0874CB32BDCA1DDD08B0E29AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\584b5bae\gefhacchlpdbilckjighmfabdeiijnkf\manifest.json
Size 500B
SHA256 95e26bd27f2f9df9a6aee139372865d6b3dc68243e2e92e2c828f225882893df
MD5 d40f7c7205c5dbd24674b3e138054776
SHA1 d98cef006d029963c6a5a2a45694277ed83fd76f
SHA512 29e289e42b49665f98dc690b222fab592fbc1542265bdd16a424145088f30d214c819778d483641924b04c51f9177e336bd4138533598e4ddfce86f2f3e42201
TLSH
T1EDF02773FC44483626F8EF6528B46243FA621B8F24D00C4FB57E645C0FB0AB61062328
MD5 SHA1 SHA512 TLSH

Submit Download

im197X.dat

Path C:\Users\Admin\AppData\Local\Temp\584b5bae\im197X.dat
Size 1KB
SHA256 7a33c737fe38d9ae988654dc9dfa9caaf489aa1beb0a2902f6dae5f44f64f623
MD5 2050d7666d10e2e0cf272afaa1aeca15
SHA1 c472155c4af321e004568faf627c4346c3e6dc2a
SHA512 81187e60785bdfe1a637dcdf565ef763fb210c4d4e8216392da37b0aae9e71cd1c3a49efa703de686525bbd688904aa1444c20149e4abc4b50362e6d16a49eef
TLSH
T18621B787D6B4C918F20A457FA2346D0444A43B3DB383EB8A9A220393EB36206A061D67
MD5 SHA1 SHA512 TLSH

Submit Download

im197X.exe

Path C:\Users\Admin\AppData\Local\Temp\584b5bae\im197X.exe
Size 451KB
SHA256 2bb5e8923130ec9c6ede9af5e9695e10ad4b90e66c318c6617548b1e1fb8917b
MD5 b1f78e265f3fad9524cef2ba33a612c9
SHA1 92a8bdfc5ea9153758922396a99edc8cf62dad75
SHA512 31bb9cfe61d432f8294aa34cbecb0216759c42447e2cb03241db020ad3a420296b4c2abf185daf24ebc93ba17db237baae74a119e7b0974818cfc52b5c4ecc8f
SSDEEP 6144:GWpoSjgPQpVnHrVywZ069FQtmJOi7VQyA5N39QlY2+g0m:NpdJVnZywZ9Ytm97VQyoNtKmm
TLSH
T1D5A46B31B696E435D0620A749F6FD697143C75362A20491BF3C88AA83AF47D2E731F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\584b5bae\[email protected]\bootstrap.js
Size 2KB
SHA256 6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
MD5 df13f711e20e9c80171846d4f2f7ae06
SHA1 56d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA512 6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
TLSH
T1F951C18BE5FE141004793D646A1FE7E535838672398D4A462BA54284FFE4C9BD782DC8
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\584b5bae\[email protected]\chrome.manifest
Size 26B
SHA256 c5cce64eebe12c62751f6a41fe2608630e174a0db79d433ae34f1ba1453f1e8b
MD5 c7609e768d19fcd42ddf0ebe6d8dc6a7
SHA1 96631aea39704e454fd28df1a332a90238df0314
SHA512 f246cfd620e7b587a7bb98e1e2e9f7196da4a0fec54c9dde47a3a2eaa2926bc7dfdbaca4cdf624377f1143b78ba9d0991524836763a8f8cf8408af395614147a
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\584b5bae\[email protected]\content\bg.js
Size 31KB
SHA256 f3ba87f2a0b75300ca953f93997244c3eea2a96bd34f3a2d188aeacba3831f1b
MD5 789aab9aa538e133f9acf32dcc948812
SHA1 ff329a59cad39829d71d423d131f640208f295b6
SHA512 2e66e0c2a6235fd1192eb5d4e7d8feb111b053c0966dd3174cf8875225ae6950b5473b85f51121f64782a8e38042a18f8ffad468c47867797934af6048965786
SSDEEP 768:IkyipxlNwDSFqttwfsTNuL8g9tUfv/rvIXpuvSS:maleDSAUfwNuL8gjIv/rgXpU
TLSH
T1EBE2E94E67BEA040429EF1A03196BBF6D03627F41A58C2DCE02678A7ED54E7490F58FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\584b5bae\[email protected]\install.rdf
Size 605B
SHA256 46f8e84e9d3269503dd41412b96f7775fc14797be7c512ee7b57209c050e59e2
MD5 b4dfd83783ece885661d5d73070417df
SHA1 ee14d81d5bfca82df2ea7b1e895710a19e5ba0ed
SHA512 6946000fcd8bda503998b6d0d420fe917992b48d47d16cc63048c141ea4835917383e36cfc5670bf2a8fe504c05a3d89cfbddd8693a1636508802b86f23fd46b
TLSH
T121F0F4168E45FE54E1ABCB262CB05104B27417AE85829048FD9F1A134B9C6ED51A7643
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gefhacchlpdbilckjighmfabdeiijnkf\1.1\content.js
Size 6KB
SHA256 f0a6f5ed62d109e7775b472451e71672b33e82da5e8d84b90ea8fc5450081473
MD5 dc4b0d889ba73d7e3fd9f1d470bf48a9
SHA1 7a0c04a0b9b9e5aece32c1e359c9ba16a33c5859
SHA512 83ade5ea8a5b6b4cbc7b393b45569004835916fea6bd65266216e9441a961cc3e0cf4d6d224774def3cd0de7f46eb7c5576dc85be77ad3cfefa6e78d32eb6004
SSDEEP 96:jLeVe46oVZJzC+2c5S23wDIVTCz+W6xfpDc0B6+tSk/Ln5qhJc1tj0LhdS/STU3j:veVJj9hlDW6RlBRqh9k/uUtZLz
TLSH
T167E1B5CF79CCD8564203EAA8C5C6D8E9E1E36DD41C60C38CF5EB6CAADCC4870E599990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsdb.js

Path C:\Users\WDAGUtilityAccount\AppData\Local\Torch\User Data\Default\Extensions\gefhacchlpdbilckjighmfabdeiijnkf\1.1\lsdb.js
Size 9KB
SHA256 168ff81b879d9c1b48a5cbcd449b14f15e92d8b592a590a534fc81b69cb295a9
MD5 b6dfe6f1aaa0f85b74b82caaffcfc9ba
SHA1 12ee70b4f136295f351507214ef8099d8696b766
SHA512 96623981e1a9201e2a2f3571d8d0da376c0d3f8b70e569398e6eebf118eafa19eb0148204e61037ec0117fceaa741d27506144c8294ba7b2ed9a2bdb03e45793
SSDEEP 192:w4whp06P3/6Y84IZcQONH7SDwxaQBVkmHqi5syb43zAsIW:M06v/6Y844cQONnaQB1T5so4jA6
TLSH
T15622C64F35DD5C52D60AD7B87687D4E6D5A22CC41AB0878CB32BDCA1DDD08B0E29AF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads