e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/09/2026, 20:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
Size 6.1MB
Sample260920-zsys2a1cnf
SHA256 e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6
MD5 75832960e9de561cdb7bba716d71c060
SHA1 9dca93b06a7b667f32014dd5df6242a5671fa86a
SHA512 16b21420302c7dd989b44f34ccd719a1459baddfea8a3c30776f221513f80f9d652b79f1ab202aadea024a1e5fbb384072234c44a537e582a75344d171ad4974
SSDEEP 49152:la4h0CFKQbHeouLwq/LymImZxFY7vdhMUvhO8GQwGzY6q4T7RA2:U60CFKQb9uNxFY7vdCkhO/GzXj
TLSH
T11B565A076D4941DDD4AAEB3CC5BB0362BB357848DB313BD72E8472B42E267D0AA76704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4988	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
Token: SeDebugPrivilege	2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4012	2964	e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe	98
PID 4012 wrote to memory of 4540	4012	msedge.exe	99
PID 4012 wrote to memory of 4988	4012	msedge.exe	100
PID 4012 wrote to memory of 5024	4012	msedge.exe	101
PID 4012 wrote to memory of 5024	4012	msedge.exe	101
PID 4012 wrote to memory of 5024	4012	msedge.exe	101
PID 4012 wrote to memory of 3208	4012	msedge.exe	102
PID 4012 wrote to memory of 3208	4012	msedge.exe	102
PID 4012 wrote to memory of 4440	4012	msedge.exe	104
PID 4012 wrote to memory of 4440	4012	msedge.exe	104
PID 4012 wrote to memory of 4440	4012	msedge.exe	104
PID 4012 wrote to memory of 4864	4012	msedge.exe	105
PID 4012 wrote to memory of 4864	4012	msedge.exe	105
PID 4012 wrote to memory of 4864	4012	msedge.exe	105
PID 4012 wrote to memory of 4252	4012	msedge.exe	106
PID 4012 wrote to memory of 4252	4012	msedge.exe	106
PID 4012 wrote to memory of 4252	4012	msedge.exe	106
PID 4012 wrote to memory of 2872	4012	msedge.exe	107
PID 4012 wrote to memory of 2872	4012	msedge.exe	107
PID 4012 wrote to memory of 2872	4012	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe
"C:\Users\Admin\AppData\Local\Temp\e6ead975285de8e7c0532069d9c4cb6f6d49acc59b21542b7347b40150430ff6.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" about:blank --disable-gpu
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaec04c188,0x7ffaec04c194,0x7ffaec04c1a0
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,6266340548877462129,12378748470819558290,524288 --field-trial-handle=2324,i,5709533127673793388,11059190168098907135,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1796,i,8171507138065222817,6816175934102872964,262144 --field-trial-handle=2324,i,5709533127673793388,11059190168098907135,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,15678289806685508069,9473470653404196142,524288 --field-trial-handle=2324,i,5709533127673793388,11059190168098907135,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,17476851266543162407,12592728480120399547,2097152 --field-trial-handle=2324,i,5709533127673793388,11059190168098907135,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,16766384431217438839,8349093633760483571,2097152 --field-trial-handle=2324,i,5709533127673793388,11059190168098907135,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,6759548451075226567,15562815576587571788,2097152 --field-trial-handle=2324,i,5709533127673793388,11059190168098907135,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,12793726724755910270,7644936511391786778,2097152 --field-trial-handle=2324,i,5709533127673793388,11059190168098907135,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:2
    3⤵
    PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

15816651-f029-45e0-90bc-2343c786c399.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15816651-f029-45e0-90bc-2343c786c399.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6724014889f5a8a728efa11bf6fd4c603fa8908bc2c4735b303fb3dc64023b44
MD5 c3fc462b663fa665d918c4e8d47baee8
SHA1 1d1c87d15f326f980af13aa26da5d40982928bc5
SHA512 3e698809e3fd39943c9ad05cea912775f5aa67adcb718337c79d6033905dbcb0d71a14bf978757392921864cdd5d10edd558e7b01e3bf1c0d15b5d979dcf7c41
SSDEEP 96:KqONkFQsjpfbUmjH5ih/cIPURHl8h4otop5UaD6BKP4v+Y1xf//ojd2xyY5qsoT3:BONh6JUm0QmiUyVqso//oTpBColU6
TLSH
T11D02D739BC78ACBB8EE3AE45B0477B239FA4106B96916F84DAD96E1D01D715C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eaca61836a006f34c4f8ff2368051ff5031406711002413474ded480892a5fe2
MD5 cce2082a7afab4a1be913190e9f54934
SHA1 ce2c1954e3198bbb4787bb141b14095effd0d3f7
SHA512 a3d36f9f6ef57e6ed4225546b9992fd0809d6f56effb5b216fb92e96e9d5a7fb373b5a326a390429f65f63c8a843a1a2f07b389ae20e6089fafb92bedf5b1f50
SSDEEP 192:BONs6JUfQmiUy4qdo//oT5VeqNNxG/U3U6:BONs6+h6do//oT5Ve+3U6
TLSH
T1D3120835B868FC7B5D93A580F08336239EA4417BDB856F94D6DD2B2C06DE1AC9307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2964-3-0x0000000140000000-0x000000014006D000-memory.dmp

Download

memory/2964-23-0x0000000140000000-0x000000014006D000-memory.dmp

Download

memory/2964-24-0x0000000140000000-0x000000014006D000-memory.dmp

Download

memory/2964-22-0x0000000140000000-0x000000014006D000-memory.dmp

Download

memory/2964-9-0x0000000140000000-0x000000014006D000-memory.dmp

Download

memory/2964-4-0x0000000140000000-0x000000014006D000-memory.dmp

Download

memory/2964-0-0x0000000140000000-0x000000014006D000-memory.dmp

Download

memory/2964-2-0x0000000140000000-0x000000014006D000-memory.dmp

Download

memory/2964-1-0x0000000140000000-0x000000014006D000-memory.dmp

Download

memory/2964-63-0x0000000140000000-0x000000014006D000-memory.dmp

Download