319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa.exe
Size 4.5MB
Sample260910-3ytm2sztcs
SHA256 319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa
MD5 bba2570a642bb08881e8a9c44744c621
SHA1 481c3aa22cb5a7c42a8162bcf44263402e80e094
SHA512 edf90171fdc9c25bd074c73f3406761fee59eb8d86f649a7964df2fc93f243c96ac9062a47bd20846b93db2f9d8ab8fa4432127ae31bd1eaf361d58946a698b8
SSDEEP 49152:zvBpREoKui1aUorEZYz3h1h5XEVWWAf4HKa5q4qhrSivfXwUIL85eFGTK6URIg0Z:zv/yjHkd/YtqhrSqfYL8EfD0Z
TLSH
T1DE269E07ECA108F9C0AAA37189B296577B75BC481B3263DB2E60B6782F737D05D79314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4184	319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa.exe
4184	319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa.exe
4184	319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa.exe
4184	319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa.exe

C:\Users\Admin\AppData\Local\Temp\319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa.exe
"C:\Users\Admin\AppData\Local\Temp\319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads