Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/09/2026, 12:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
qygt3qbac6ueasrm.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
qygt3qbac6ueasrm.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target qygt3qbac6ueasrm.exe
- Size 759KB
- Sample260922-pgdnlssxe1
- SHA256 f034e0899c7abd0e857fa04ba699a9c68f332311392eae4e6087515c0bf8c306
- MD5 e46ce917efacd33309e6831c9f7abe7e
- SHA1 c8c025ae7fce748cf0e6b96547745883f28d3847
- SHA512 ab934b31642587b86a382377cc9697f5e407b53212c3c8ffdcd7d11f4d60dd6bf615685d42867693aa3652f761bf5dab47f5dedac6bedb4165e2cdbf8bd85bf3
- SSDEEP 12288:rVzWk+oPtqUS+fYbW8cE8zr+2Afy5VDWQ:gkVSUoLcEsr+mVDWQ
- TLSH T10DF4F7257B949E11D940193E92BE2608D73260F323126B43374BF7A14D45AFEEE6C3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 qygt3qbac6ueasrm.exe Key opened \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 qygt3qbac6ueasrm.exe Key opened \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 qygt3qbac6ueasrm.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 6 api.ipify.org 28 icanhazip.com - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 qygt3qbac6ueasrm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier qygt3qbac6ueasrm.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe 5944 qygt3qbac6ueasrm.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5944 qygt3qbac6ueasrm.exe Token: SeIncBasePriorityPrivilege 5944 qygt3qbac6ueasrm.exe Token: SeSecurityPrivilege 5892 msiexec.exe - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 qygt3qbac6ueasrm.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 qygt3qbac6ueasrm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qygt3qbac6ueasrm.exe"C:\Users\Admin\AppData\Local\Temp\qygt3qbac6ueasrm.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:5944
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5892
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1