Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 12:33
General
- Target EUR%201704.90%201850-0267395.js
- Size 7.3MB
- Sample260925-prjydastbz
- SHA256 268261ca8e1e4a37ad013377c97638f8900581a9bc2b4fc29b2860bd435bc70b
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\EUR%201704.90%201850-0267395.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\KPAWRHUPIPTUNTMK.exe"C:\Users\Admin\Documents\KPAWRHUPIPTUNTMK.exe" C:\Users\Admin\Documents\KPAWRHUPIPTUNTMK.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- outlook_office_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
KPAWRHUPIPTUNTMK.exe
KPAWRHUPIPTUNTMK.ttf
memory/5476-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-18-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-12-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-9-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5476-2959-0x0000000028ED0000-0x0000000028FC7000-memory.dmp
memory/5476-2962-0x0000000028ED0000-0x0000000028FC7000-memory.dmp
memory/5476-2963-0x0000000028ED0000-0x0000000028FC7000-memory.dmp