Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 10:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe
- Size 2.9MB
- Sample260910-m2ds1abk8s
- SHA256 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81
- MD5 35b7dfea9acd3a34a075651782085c15
- SHA1 b4c3df5b8872aad70a18da9f6ab4012011585b60
- SHA512 95a785ebe89de5fcc3b76e0753dbe2a35f515bf76f4c246f58484c8ea7479cc28530aa21a98b1d23513f1ecf3464319a9849771797fdd872334912051ca0bc55
- SSDEEP 49152:YJnzUZdz8Nh+JTaDpRH25/bIgN+xLlVDommrkwGp4HBSPVv5EeYPNnc9u5t7+hbb:6ILzeDHEb5NslVDcIH4H42eYPNnc
- TLSH T1A1E523DDBD827472E077D37383A361AE71693B944B790D4E3AD89B006E6242C3C7A359
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4608 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 4996 ProManagerServicedc894.exe 4996 ProManagerServicedc894.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 6020 powershell.exe 6020 powershell.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 6020 powershell.exe 6020 powershell.exe 6020 powershell.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1552 ProManagerServicedc894.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 6020 powershell.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe 1552 ProManagerServicedc894.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3312 wrote to memory of 4608 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 89 PID 3312 wrote to memory of 6020 3312 f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe 93 PID 1552 wrote to memory of 4628 1552 ProManagerServicedc894.exe 97 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe"C:\Users\Admin\AppData\Local\Temp\f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "CheckGuardDaemon_0cee" /tr "C:\Users\Admin\AppData\Roaming\Temp995F\ProManagerServicedc894.exe" /sc minute /mo 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Stop-Process -Force -Id 3312; Start-Sleep -Seconds 3; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\f11fa71ce853b4e63252925c029abaff1e35148c869b234782ba6e72479b4c81.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6020
-
-
C:\Users\Admin\AppData\Roaming\Temp995F\ProManagerServicedc894.exeC:\Users\Admin\AppData\Roaming\Temp995F\ProManagerServicedc894.exe1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4996
-
C:\Users\Admin\AppData\Roaming\Temp995F\ProManagerServicedc894.exe"C:\Users\Admin\AppData\Roaming\Temp995F\ProManagerServicedc894.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\system32\schtasks.exeschtasks /query /tn "CheckGuardDaemon_0cee"2⤵PID:4628
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 1KB
- SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
- MD5 b15dfb1600ace7f0c686862d26b733ad
- SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
- SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
- TLSH T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9764968A551D4734F147738AB1863B84
- Size 383B
- SHA256 02e44c6517d709a4eed8137bfc2c23e2d02339d8bf55b2618c268bf30b1092b1
- MD5 4e7d2e019553766c7db2b4bb021e6f29
- SHA1 3f4dac56960a5d6e094a80f89a3a3fd87f43f7dc
- SHA512 51337b5862a6dc95f0524d00e0e8b89a45f203dc44ccac470751a9b04e064c8e023e4e01691c2caf28f49f6696f916e033d20f7b24be936e60c8c7eddc092d3c
- TLSH T15AE06AC0957422C20370A500DD8CE8071E7DCCC7521FB0080510C31159C3FCDE7492CD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
- Size 528B
- SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
- MD5 047f3e9d21d6b325d592b1959e4362e6
- SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
- SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
- TLSH T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 174B
- SHA256 ab053aec5850be87d80e640ae72b205a446ecc2c7a331a6888db0a1a1547d793
- MD5 5794fb9062f96f5f8a403a0599107239
- SHA1 1c2c8ec2ca6f0f818d83c30742a4bfe1e4d8d35e
- SHA512 b73f6c5634a6aa94ae4cb8c763b444fdcdddb6405d61c36cc7200f3fdbae777e26486f5312c0c54b806a5958a06d0ec962891e04792fe8a16c37b33dfc4da38d
- TLSH T1FFC02B8433300329F0301D3F4492C2404FFED204D94283700FB01118C11CB020CF1D07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9764968A551D4734F147738AB1863B84
- Size 192B
- SHA256 a5223511f00ca7a81a3ed888c9138af27fb95b2ffb187add71315a34da4d77b8
- MD5 06b72893933acc21df9ae63712678018
- SHA1 ec94a4157aeab8b5d17d574ff8b25744acf0fc73
- SHA512 fb894108a94f4efa31d1833a3984c0897a28a86006b483c4df54c855355d7f74bb89871dc2d6a8b9044f945768601cd8af8225044428d252d923e3785af7495c
- TLSH T129C08C0436240A06E1D04B3E4A92722182BAB320C065834C1BB1221CE24C6002CB2E29
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
- Size 170B
- SHA256 f22d77a5066a1b34713467940bcfcc3d1797f1a85c8ce5837e3f563897df7a64
- MD5 e1badda245b3884b2117677d5a2be816
- SHA1 712014f1a244f1bd80ed3c0a69c7f7fc9367889d
- SHA512 97710925618e9b52f1c11e1dfe4d07c6aa76a3cdbafedc6c404244afc65d4b29c1e45b55d5f34e8b053499f768107618e2c7ae13a61a590fe14810fc8ce80d84
- TLSH T1B4C09254B3A9471AF14E253E79E61A069BBA820AF6CAC3154BB81138CA28B410CB2D0D
- MD5 SHA1 SHA512 TLSH