Analysis
- user interaction
yes - max time kernel
25s - max time network
39s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
28/09/2026, 12:07
General
- Target wave spoofer/Wave Spoofer CRACKED.exe
- Size 18.4MB
- Sample260928-pag3fsshqf
- SHA256 fc4713f4dcc5658899c9eb2b2e492d3837f56e1154f13f7dfb5b2ff89857fe71
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 64 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\wave spoofer\Wave Spoofer CRACKED.exe"C:\Users\Admin\AppData\Local\Temp\wave spoofer\Wave Spoofer CRACKED.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" Win32_OperatingSystem delete2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" Win32_Process delete2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" Win32_Service delete2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" Win32_LogicalDisk delete2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" Win32_NetworkAdapter delete2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" Win32_PnPEntity delete2⤵
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" interface set interface "Ethernet" disable2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/1924-11-0x00000000067F0000-0x0000000006806000-memory.dmp
memory/1924-3-0x00000000068E0000-0x0000000006DA8000-memory.dmp
memory/1924-19-0x00000000067A0000-0x00000000067A8000-memory.dmp
memory/1924-16-0x00000000067A0000-0x00000000067A8000-memory.dmp
memory/1924-15-0x0000000006850000-0x000000000687A000-memory.dmp
memory/1924-12-0x0000000006850000-0x000000000687A000-memory.dmp
memory/1924-7-0x00000000067C0000-0x00000000067F0000-memory.dmp
memory/1924-4-0x00000000067C0000-0x00000000067F0000-memory.dmp
memory/1924-35-0x0000000006620000-0x0000000006628000-memory.dmp
memory/1924-32-0x0000000006620000-0x0000000006628000-memory.dmp
memory/1924-31-0x0000000006600000-0x0000000006605000-memory.dmp
memory/1924-28-0x0000000006600000-0x0000000006605000-memory.dmp
memory/1924-27-0x00000000065D0000-0x00000000065D6000-memory.dmp
memory/1924-24-0x00000000065D0000-0x00000000065D6000-memory.dmp
memory/1924-23-0x00000000065E0000-0x00000000065F7000-memory.dmp
memory/1924-20-0x00000000065E0000-0x00000000065F7000-memory.dmp
memory/1924-1-0x00000000068E0000-0x0000000006DA8000-memory.dmp
memory/1924-8-0x00000000067F0000-0x0000000006806000-memory.dmp
memory/1924-43-0x00000000068A0000-0x00000000068B6000-memory.dmp
memory/1924-40-0x00000000068A0000-0x00000000068B6000-memory.dmp
memory/1924-39-0x0000000006660000-0x000000000666B000-memory.dmp
memory/1924-37-0x0000000006660000-0x000000000666B000-memory.dmp
memory/1924-47-0x0000000006790000-0x000000000679B000-memory.dmp
memory/1924-44-0x0000000006790000-0x000000000679B000-memory.dmp
memory/1924-51-0x00000000067B0000-0x00000000067BC000-memory.dmp
memory/1924-48-0x00000000067B0000-0x00000000067BC000-memory.dmp
memory/1924-52-0x0000000006890000-0x000000000689F000-memory.dmp
memory/1924-55-0x0000000006890000-0x000000000689F000-memory.dmp
memory/1924-56-0x0000000008F40000-0x0000000008FA1000-memory.dmp
memory/1924-63-0x0000000008AA0000-0x0000000008AB0000-memory.dmp
memory/1924-60-0x0000000008AA0000-0x0000000008AB0000-memory.dmp
memory/1924-59-0x0000000008F40000-0x0000000008FA1000-memory.dmp
memory/1924-64-0x0000000008AF0000-0x0000000008AFE000-memory.dmp
memory/1924-71-0x0000000008AE0000-0x0000000008AE8000-memory.dmp
memory/1924-68-0x0000000008AE0000-0x0000000008AE8000-memory.dmp
memory/1924-67-0x0000000008AF0000-0x0000000008AFE000-memory.dmp
memory/1924-72-0x0000000008FD0000-0x0000000008FE1000-memory.dmp
memory/1924-79-0x0000000009240000-0x0000000009269000-memory.dmp
memory/1924-76-0x0000000009240000-0x0000000009269000-memory.dmp
memory/1924-75-0x0000000008FD0000-0x0000000008FE1000-memory.dmp
memory/1924-11-0x00000000067F0000-0x0000000006806000-memory.dmp
memory/1924-3-0x00000000068E0000-0x0000000006DA8000-memory.dmp
memory/1924-19-0x00000000067A0000-0x00000000067A8000-memory.dmp
memory/1924-16-0x00000000067A0000-0x00000000067A8000-memory.dmp
memory/1924-15-0x0000000006850000-0x000000000687A000-memory.dmp
memory/1924-12-0x0000000006850000-0x000000000687A000-memory.dmp
memory/1924-7-0x00000000067C0000-0x00000000067F0000-memory.dmp
memory/1924-4-0x00000000067C0000-0x00000000067F0000-memory.dmp
memory/1924-35-0x0000000006620000-0x0000000006628000-memory.dmp
memory/1924-32-0x0000000006620000-0x0000000006628000-memory.dmp
memory/1924-31-0x0000000006600000-0x0000000006605000-memory.dmp
memory/1924-28-0x0000000006600000-0x0000000006605000-memory.dmp
memory/1924-27-0x00000000065D0000-0x00000000065D6000-memory.dmp
memory/1924-24-0x00000000065D0000-0x00000000065D6000-memory.dmp
memory/1924-23-0x00000000065E0000-0x00000000065F7000-memory.dmp
memory/1924-20-0x00000000065E0000-0x00000000065F7000-memory.dmp
memory/1924-1-0x00000000068E0000-0x0000000006DA8000-memory.dmp
memory/1924-8-0x00000000067F0000-0x0000000006806000-memory.dmp
memory/1924-43-0x00000000068A0000-0x00000000068B6000-memory.dmp
memory/1924-40-0x00000000068A0000-0x00000000068B6000-memory.dmp
memory/1924-39-0x0000000006660000-0x000000000666B000-memory.dmp
memory/1924-37-0x0000000006660000-0x000000000666B000-memory.dmp
memory/1924-47-0x0000000006790000-0x000000000679B000-memory.dmp
memory/1924-44-0x0000000006790000-0x000000000679B000-memory.dmp
memory/1924-51-0x00000000067B0000-0x00000000067BC000-memory.dmp
memory/1924-48-0x00000000067B0000-0x00000000067BC000-memory.dmp
memory/1924-52-0x0000000006890000-0x000000000689F000-memory.dmp
memory/1924-55-0x0000000006890000-0x000000000689F000-memory.dmp
memory/1924-56-0x0000000008F40000-0x0000000008FA1000-memory.dmp
memory/1924-63-0x0000000008AA0000-0x0000000008AB0000-memory.dmp
memory/1924-60-0x0000000008AA0000-0x0000000008AB0000-memory.dmp
memory/1924-59-0x0000000008F40000-0x0000000008FA1000-memory.dmp
memory/1924-64-0x0000000008AF0000-0x0000000008AFE000-memory.dmp
memory/1924-71-0x0000000008AE0000-0x0000000008AE8000-memory.dmp
memory/1924-68-0x0000000008AE0000-0x0000000008AE8000-memory.dmp
memory/1924-67-0x0000000008AF0000-0x0000000008AFE000-memory.dmp
memory/1924-72-0x0000000008FD0000-0x0000000008FE1000-memory.dmp
memory/1924-79-0x0000000009240000-0x0000000009269000-memory.dmp
memory/1924-76-0x0000000009240000-0x0000000009269000-memory.dmp
memory/1924-75-0x0000000008FD0000-0x0000000008FE1000-memory.dmp