b11845b992a05a24e2c233afa58492a7c3968dcd04424b14c28eb2107231142a

Resubmissions

30/08/2026, 22:00

260830-1w2jrsam9w7

30/08/2026, 21:52

260830-1rdxxade527

Analysis

user interaction
yes
max time kernel
28s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 21:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ReShadeInstaller.exe
Size 89KB
Sample260830-1rdxxade52
SHA256 b11845b992a05a24e2c233afa58492a7c3968dcd04424b14c28eb2107231142a
MD5 9cc11f2acb2a1a1447b6787017483db6
SHA1 355c258ae312d88eb893693827afd178d68c0fcc
SHA512 5c03e9abbd3e05d747f000d0a3ad542aea0651ca97c16479e15e3cd609048a80b5b743a7bc83a4bbf914d4d6edff0908466bae962bfdb91820ce4f0d133f76d0
SSDEEP 1536:/7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIf4wt5OM:z7DhdC6kzWypvaQ0FxyNTBf48t
TLSH
T1C7936D41F3E202F7E6F2053100A6726FD73663389764A8DBC74C2D529913AD5A63D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReShadeInstaller.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4356	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 728	5564	ReShadeInstaller.exe	90
PID 728 wrote to memory of 4356	728	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\ReShadeInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\ReShadeInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5951.tmp\5952.tmp\5953.bat C:\Users\Admin\AppData\Local\Temp\ReShadeInstaller.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5953.bat

Path C:\Users\Admin\AppData\Local\Temp\5951.tmp\5952.tmp\5953.bat
Size 79B
SHA256 3ca8e87f7f48d141d8a305dc00a9a6b1e5b60ee8db4122f9be80ddaefe92ddfb
MD5 bf1401e1882d7a762de81c527019a74c
SHA1 0e888fc49ddcc60e01d9a67f2019f7ebf2e7368b
SHA512 8e9f1a5429a936f2fe4ec6c15922ee208a97d5bf5484d1cc486e5394c16a6e29d8dbeec6d92e965f6dfa76900ed984e83377b5b1903d571d311e0ead689998e9
TLSH
T1ABA01203300919212E5118549DED104E24AB404356039AC03112411485030FA00455C5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5564-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download