Analysis
- max time kernel
898s - max time network
526s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/09/2026, 00:32
Behavioral task
behavioral1
Sample
WebBrowserPassView.chm
Resource
win10v2004-20260513-en
1 signatures
900 seconds
General
- Target WebBrowserPassView.exe
- Size 361KB
- Sample260905-av2v2azzft
- SHA256 cb29097bc5b9ff161d0457b271dd3a49b5b916f82e2c1f16ece96383981285d6
- MD5 09078828931a04c2a3f95db7641ce805
- SHA1 32f91aae5803d710b398eacf57eedce6e2047f29
- SHA512 d7f99a057a27a23128a992bb82abcdc2a34ff72ec1cdc723cb89bca9f01191fc2a647ec818d997f6f7609f4bae049e7d78ed2fa5c958fb28a0a537ae279b8b9f
- SSDEEP 6144:6l3F4O8iCSPnDmDvbXGFtv9cVs68ZV6kjEGTjX93eIb1AtcGkihvn:aFXpDmDLDX86kj/NuQMk6n
- TLSH T1A074AF53F3E18036D4F7057006AB5B32EEF9BE201635895797D41C4DAEB06E1AA3A70B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WebBrowserPassView.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe 812 WebBrowserPassView.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 812 WebBrowserPassView.exe