06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
psychedeliclove.exe
Size 275KB
Sample260925-w2gdkat12j
SHA256 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90
MD5 ae5450f32bcb533c5b592c77a7861553
SHA1 85e01bdb2aee0217932e108535691c898b138a80
SHA512 5cd8929d374d5064ca7d47a4b468d983bdeff34354b7924a049cf8e52d366d2479fc5c0687527648b4e8227811f94ef13f6df99272b49541ccf3f514e348a13e
SSDEEP 6144:fheWYL+ZPJIYjK9GZLBpdPGq1Kq0CGpNMm:fHPZCYjK9GZdPGqd+NM
TLSH
T132545C57E25364ECC167D2388697A732B932786201747E6B3A1CC6727F21E60A73EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	3652	psychedeliclove.exe

Executes dropped EXE 2 IoCs

pid	Process
4136	1175_neononly.exe
4540	p0r61g3id.sys

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	psychedeliclove.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	psychedeliclove.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1175_neononly.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1175_neononly.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	psychedeliclove.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	psychedeliclove.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe
3652	psychedeliclove.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4136	1175_neononly.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 1696	3652	psychedeliclove.exe	89
PID 3652 wrote to memory of 1696	3652	psychedeliclove.exe	89
PID 3652 wrote to memory of 1048	3652	psychedeliclove.exe	91
PID 3652 wrote to memory of 1048	3652	psychedeliclove.exe	91
PID 3652 wrote to memory of 4136	3652	psychedeliclove.exe	93
PID 4136 wrote to memory of 2320	4136	1175_neononly.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\psychedeliclove.exe
"C:\Users\Admin\AppData\Local\Temp\psychedeliclove.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1048
- C:\Users\Admin\AppData\Local\Packages\Extensions\B3364D14D6DDB84D42564919E089039C2BA97C70E516BCB383BBEE618C959D33-agent\downloads\1175_neononly.exe
  "C:\Users\Admin\AppData\Local\Packages\Extensions\B3364D14D6DDB84D42564919E089039C2BA97C70E516BCB383BBEE618C959D33-agent\downloads\1175_neononly.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SYSTEM32\curl.exe
    curl.exe -s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o "C:\Users\Admin\AppData\Local\Temp\ntkrnlmp_953A8DE880B0818C32DA2DEC1D79C2D91.pdb" "https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/953A8DE880B0818C32DA2DEC1D79C2D91/ntkrnlmp.pdb"
    3⤵
    PID:2320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5552

C:\Users\Public\p0r61g3id.sys
C:\Users\Public\p0r61g3id.sys
1⤵
- Executes dropped EXE
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1175_neononly.exe

Path C:\Users\Admin\AppData\Local\Packages\Extensions\B3364D14D6DDB84D42564919E089039C2BA97C70E516BCB383BBEE618C959D33-agent\downloads\1175_neononly.exe
Size 3.2MB
SHA256 4a91fe012220e4de26c6a875e27d2eca1440fd01926d1adfb9aca42964d8c453
MD5 dbebb5650ddb1010a7eee6abe285e1e7
SHA1 d334437262b6df3c975db616f022f3a60a6ec012
SHA512 52ed9b1f3de2e9c048e8931ff0fcc5b2b12c39ed4ce15daa17a4bccc3fc0b70a8a7771e2417c8e904564fd8f8a5bd44cb560f90ef64904469ccbe05ae7affdb4
SSDEEP 24576:Hg6xW/PhurmRhRmkPCbdnMfJY9PbkxnfY7g1uX/AoLc+Gl97Ku5fbo1Z0xeVXNBd:A6xFmRlqbOY9Eg7auPw+GrBNGZkeAWpL
TLSH
T1DBF58D202CEE7F7AC03B45FAA15C42CBD9C7B955A542A65B77CD006A9FF78C0211A4BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

executed_tasks.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\B3364D14D6DDB84D42564919E089039C2BA97C70E516BCB383BBEE618C959D33-agent\executed_tasks.json
Size 19B
SHA256 1bc776df2b744cdac7ec62e1be738c5601216aabf226da4d05fa8207a705c046
MD5 a6105eb17da5c687bf88e81a261483e1
SHA1 74ad46f868d762891aeebc615587458f9dfd6624
SHA512 91c4bef05972f246c5066d2afbcaebaf39b4bb006967691f24563c4f5a1cf8004d3bff1620dd84fe27f3ffc3bf3ab66e40cc87c9a410dae32cbd44bd29633bee
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\B3364D14D6DDB84D42564919E089039C2BA97C70E516BCB383BBEE618C959D33\e0\icons\128.png
Size 6KB
SHA256 e83f6f9df6e7cb64ebb80ee0063e40e0f3beca3b965595e88ab56f56e061ed5a
MD5 f8dbd8e9ee75e1b9f0d2a19772be1a11
SHA1 cd9d65ccbdd711079655d9eb00c1b4059a6e2428
SHA512 31ea9dc129b304f0157485d2e6b2d8119b461ac6dc1978a5111241f76955a24ff5de1b4387b06e07e45cd71afa3f46e2744f5e7f4612b507058cdff1ea26acfb
SSDEEP 192:QlG05FSSG7qwTakYyea85wm2lTr0uG5MyT7/XwrDf:QljTrG1TBYyeavIB5rTz0D
TLSH
T1E1E1BF8C53EC98BBF1C50D9E42680D369FEBF256129C900ED853D04C4B104F20CBE796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\B3364D14D6DDB84D42564919E089039C2BA97C70E516BCB383BBEE618C959D33\e0\manifest.json
Size 2KB
SHA256 c10b5833016bc7d444395c11bb1729268858ab594d3f79f2e30002aaf6c0879d
MD5 2730856ddee4b2fb494b9e397931eb1e
SHA1 417cbe076d3ef31c6257d35c250c89c20b655b04
SHA512 8bd095109168dcf60c2797c7dc6de1a455a4e47a9380499a840880f39eb87bc304287c15244be38f7c29378f61673678ec43f549ddf554f8f96e4ae4f73b98e5
TLSH
T1C141DD25D9684CBB02DCA7346CBA5A8369140A878D907C1C77DD800C8F7D21F42B6B9D
MD5 SHA1 SHA512 TLSH

Submit Download

ck_3652_240741500.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_3652_240741500.bin
Size 32B
SHA256 34e54ed4704f24a13360823e5c7c5966e670b0a1381336e788278591e654bd45
MD5 49adb858c75111b132d46acbe1de477f
SHA1 6f42acfb0c23bf638b858b8959f78c193a49c20e
SHA512 0ae12399e514bdf3160852c577f6c7a5fb5dc23e61fd90b7fcf81bde17539a91394050b476e065ef791d6467568f19340c87584d189f48122f77c3538c9a285c
MD5 SHA1 SHA512

Submit Download

ext5BC2.tmp.zip

Path C:\Users\Admin\AppData\Local\Temp\ext5BC2.tmp.zip
Size 45KB
SHA256 bdefc03a38d9bf51a5d5388a0ac517b6428cb448a80b6a89cb517d31e9e4704b
MD5 e6fd959586df9bd9d3b933b91bff1df3
SHA1 727b3913469bfc911f564d3bd5e9b92a1961db23
SHA512 1ca269879f85e6ef3e722840f28eb3e9f0a81608d1a6b754eee0e503ce66a8f90131bdf6925635b2f970e39dc80eba42742e7f11fdb4e60b568c11cfc5a87e6f
SSDEEP 768:HNuUnGsTvPRVvkzIv6Bv2x1NTwePepQITBYoIB5rTXITBYoIB5rT5zhj/2:tuaG0zWICBOxPTtBH1rbH1rNzh/2
TLSH
T12523F1595790483FD7DB597C40268E34CE9F79B0028D509FC967F48C9A068A32BE6BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntkrnlmp_953A8DE880B0818C32DA2DEC1D79C2D91.pdb

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp_953A8DE880B0818C32DA2DEC1D79C2D91.pdb
Size 10.5MB
SHA256 e987244cfdc33cb195c34231d8905d9e87019b36f199d17ab0638187ce0aaf7f
MD5 566f8135567a80ba945eee5ce9be4f69
SHA1 26008b593f2deacd27d6c55220cbcacfeaeb1a37
SHA512 86bfd6689da02d75e8323b6420c35fc86c487906d82827ec595d6d308e9f32fb23aca9b2c72f071fab77ed78b3997b8fae5034bc105e1109f2e3df32c5603829
SSDEEP 49152:R85MWAL/kNIUlMy+1sA3w9QnZcaDkFAjcLU3I67bX3V/lxKPmng+Y99+1lM8faZJ:R85rADkNl63pnR7fDgf
TLSH
T150B60615BA937EF6DC5A457FA0160329F6F596CA03A947E33D46B3A90DC2212CF2E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p0r61g3id.sys

Path C:\Users\Public\p0r61g3id.sys
Size 78KB
SHA256 6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1
MD5 b96d75a000367c200958089728fc5cb8
SHA1 f329ae0fdf1e198bea6ba787e59cb73f90714002
SHA512 60fb02287aff7b7d7b7057be6f0a828c702a0ba9653fd4079d0e5bea3b476dc06cae4f27292684c9235ed21a498403bbf4bc6609c0d9c3c2de920e981ef1df17
SSDEEP 1536:Qn8/+PtpHLPxNn1szNYeYVxRqx+g1JOE7ubt6INPXWmT6A5+KA:5/yTxNKOesx8xIh6AGLA5I
TLSH
T1C173E0D1162CA4C2ED879D31A2C8D623BC70B3911E62D6F391A5D1790E867C16F2C9AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3652-276-0x00007FF6F62D0000-0x00007FF6F631D000-memory.dmp

Download