Analysis
- max time kernel
300s - max time network
306s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
03/09/2026, 12:09
General
- Target Setup.exe
- Size 10.5MB
- Sample260903-pbtsmsgm6v
- SHA256 72208131742dbaf6871f648e297a054c8ad58cd318e4391772cdf4db34989a39
Malware Config
Extracted
-
acrstealer
-
4.3.8-alpha2
-
sync.canyonmere.cc
-
cdnjs.cloudflare.com
-
ddrs
https://telegra.ph/C-Introduction-08-21
-
guids
01a034f4-51c1-7e0e-a650-137d7032a680
f1575b64-8492-4e8b-b102-4d26e8c70371
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36
Signatures
- Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
- Detects ACRStealer V4.x 14 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4088-0-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-2-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-4-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-8-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-5-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-3-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-40-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-46-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-52-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-58-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-106-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-100-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-94-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4088-62-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4536-24-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-33-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-16-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-17-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-18-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-19-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-20-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-21-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-22-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-23-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-14-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-25-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-26-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-27-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-28-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-29-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-30-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-31-0x000001B7FDD40000-0x000001B7FDD41000-memory.dmp
memory/4536-32-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-15-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-34-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-35-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-36-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-37-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-38-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-43-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-44-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-49-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-13-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-12-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-11-0x00000000008FD000-0x00000000008FE000-memory.dmp
memory/4536-55-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-104-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-6-0x000001B7FDD40000-0x000001B7FDD41000-memory.dmp
memory/4536-109-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-112-0x00000000008E0000-0x000000000144B000-memory.dmp
memory/4536-113-0x00000000008E0000-0x000000000144B000-memory.dmp