ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226.exe
Size 123KB
Sample260827-m965hstdma
SHA256 ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226
MD5 f3d2d4a17faf200c3d5975f679d23207
SHA1 c3a98dd6f752366c0f537578bffebe79a6f1f8a6
SHA512 1ca88e357e8aa0957e2af2b65314084391a3a13be144e800ac274bad0c177ca593b541da41c1a673828e5c6cf9778dee56a6e561398135df54c04e144abc70b7
SSDEEP 3072:SKcWmjRrz3ZKcWmjRrz3HFUHcgQFnhzcWldUQOSVcJPy:hGyGlUHcjlcWoxS+6
TLSH
T153C3F12CFB8B1E3DDB91507B346E4A6D5D35C63B448E525B623B70D3ECB22BC54A2224
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3432	nY30rJpBpCxm9UJ.exe
4360	CTS.exe
728	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4004-0-0x0000000000360000-0x0000000000377000-memory.dmp	upx
behavioral1/files/0x000700000002453e-6.dat	upx
behavioral1/memory/4004-9-0x0000000000360000-0x0000000000377000-memory.dmp	upx
behavioral1/memory/4360-7-0x0000000000B20000-0x0000000000B37000-memory.dmp	upx
behavioral1/files/0x00050000000215cf-14.dat	upx
behavioral1/memory/728-39-0x0000000000B20000-0x0000000000B37000-memory.dmp	upx
behavioral1/memory/728-40-0x0000000000B20000-0x0000000000B37000-memory.dmp	upx
behavioral1/memory/4360-42-0x0000000000B20000-0x0000000000B37000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226.exe
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nY30rJpBpCxm9UJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226.exe
Token: SeDebugPrivilege	4360	CTS.exe
Token: SeDebugPrivilege	728	CTS.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3432	4004	ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226.exe	85
PID 4004 wrote to memory of 4360	4004	ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226.exe	86

C:\Users\Admin\AppData\Local\Temp\ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226.exe
"C:\Users\Admin\AppData\Local\Temp\ff0dabb993875bd4874791c3a9e830d87703d61e6b0f80861c34862b3bfff226.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\nY30rJpBpCxm9UJ.exe
  C:\Users\Admin\AppData\Local\Temp\nY30rJpBpCxm9UJ.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3432
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4360

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 61KB
SHA256 befcc9ec5bf6f2280b18ca2f18631d0eb95582998be9bb40a8d2806864bece2c
MD5 c9537fe1fa0ee4b02919c406e1ad3ec1
SHA1 d9a08bd0cb255e93c0a18275f8ae6f35dd4fff7b
SHA512 437a639b23b94bed7d010b198e54ed0b7c5e45064b8743c9da1bb97796bc2f0fe0cd125950fd7f51e35e2fec90b13d4c7b8d8a780e17ff16f8a34f5b0178ab0b
SSDEEP 768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFGocAX3LKew369lp2z3e:SKcR4mjD9r823FHKcR4mjD9r823F0y
TLSH
T1C653E17CFB8E0E3ADB92A13F35FA5A1D6955D637418D534B212B7083B9A13BC24C3624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nY30rJpBpCxm9UJ.exe

Path C:\Users\Admin\AppData\Local\Temp\nY30rJpBpCxm9UJ.exe
Size 64KB
SHA256 75f12ea2f30d9c0d872dade345f30f562e6d93847b6a509ba53beec6d0b2c346
MD5 a32a382b8a5a906e03a83b4f3e5b7a9b
SHA1 11e2bdd0798761f93cce363329996af6c17ed796
SHA512 ec87dd957be21b135212454646dcabdd7ef9442cf714e2c1f6b42b81f0c3fa3b1875bde9a8b538e8a0aa2190225649c29e9ed0f25176e7659e55e422dd4efe4c
SSDEEP 768:2jfnJFqNSkejOy27eW2Vef/7yX3jFICnFfvoUs49RsS98Pu4TNz14GAeRgxQ:ufnLq01weW5yX3jFxv49Nu4GhQ
TLSH
T134537C21B981C073C446107A592DC6B19F7BBC312675C983BB961BBB9F313D1E72E24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 59KB
SHA256 6028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74
MD5 5efd390d5f95c8191f5ac33c4db4b143
SHA1 42d81b118815361daa3007f1a40f1576e9a9e0bc
SHA512 720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d
SSDEEP 768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFGocAX3LKew369lp2z3:SKcR4mjD9r823FHKcR4mjD9r823F
TLSH
T12543E17CFBCA0E39DBD2613F35EA591E6955D63B418E524B213B7083B9A13BC24C3624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-39-0x0000000000B20000-0x0000000000B37000-memory.dmp

Download

memory/728-40-0x0000000000B20000-0x0000000000B37000-memory.dmp

Download

memory/4004-0-0x0000000000360000-0x0000000000377000-memory.dmp

Download

memory/4004-9-0x0000000000360000-0x0000000000377000-memory.dmp

Download

memory/4360-7-0x0000000000B20000-0x0000000000B37000-memory.dmp

Download

memory/4360-42-0x0000000000B20000-0x0000000000B37000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads