milleniumrat | e724b8417dc081196b9892e5f7c8b30b06be04916fc05f887ccc080e5ba8f5af

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update2.exe
Size 2.4MB
Sample260930-al4y2aae67
SHA256 e724b8417dc081196b9892e5f7c8b30b06be04916fc05f887ccc080e5ba8f5af
MD5 d9d8c27d9ff894854b58d011d3290a97
SHA1 11cd95a1f8e992b5bb4bee17cd1d01964edb35bc
SHA512 3c08a954d9425327b0ca5810bdc31bf947e9f17cf68f402b126b8b84e30aabbe786cd8cdebade240a9af96b6499ca20b787c58915fa0f1d211d52c4480523ad7
SSDEEP 49152:ofC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MNIMnMznc2:FoLr9DITjJG0boO1pH
TLSH
T1BCC59E22FB8290B2E4D601B062BE6BF75D787234532558CBE3C01D6A59206D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution milleniumrat rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024377-2.dat	family_milleniumrat

Uses browser remote debugging 2 TTPs 1 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4952	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1064	vshost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
28	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
25	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4264	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vshost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vshost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3068	msedge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4048	timeout.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe
1064	vshost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	vshost.exe
Token: SeDebugPrivilege	1064	vshost.exe
Token: SeDebugPrivilege	1064	vshost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4040	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4040	msedge.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1064	2464	update2.exe	87
PID 1064 wrote to memory of 4952	1064	vshost.exe	96
PID 4952 wrote to memory of 4040	4952	msedge.exe	97
PID 4952 wrote to memory of 3068	4952	msedge.exe	101
PID 1064 wrote to memory of 4264	1064	vshost.exe	116
PID 4264 wrote to memory of 4048	4264	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\update2.exe
"C:\Users\Admin\AppData\Local\Temp\update2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\8cVToaPU\vshost.exe
  "C:\Users\Admin\AppData\Local\Temp\\8cVToaPU\vshost.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff8c3ecc188,0x7ff8c3ecc194,0x7ff8c3ecc1a0
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2172,i,2766089232723456474,13899710490603423991,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:3
      4⤵
      System Time Discovery
      PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\8cVToaPU"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6f0936b3-4af6-40b0-81cf-bc0ff9341d72.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\6f0936b3-4af6-40b0-81cf-bc0ff9341d72.dmp
Size 7.2MB
SHA256 4b99286f2a531adcabb13823bed9b55a384948a48c465e224b806b44890b72f9
MD5 9bb5bee6d687c8ee54fab834822cca7c
SHA1 4281c58ef6a3fe75f19b39718fd3db4c418ca0b5
SHA512 ed476610cccb0c82589be77de51e5a7a3f19010d6fb5cdee1ffb287ae43f32f8f2a8d2b32fdb9a05b624f22a97cfc0561c06ab2debc68a8fc2c2ee3957a74457
SSDEEP 24576:4zV89i80e9Rb7Tm4u8CnJyrRoYSUfcQh/DJk+orERODw4g2X9:E18r37UnJyrRoYNf1h+vE6w4gk
TLSH
T16776D6A5B385CA96F01942B06482F7B6F7F6FCE07A818307B221735D4CB73585F65A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac558356-5a28-460f-abb3-7908e026b9fd.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ac558356-5a28-460f-abb3-7908e026b9fd.dmp
Size 6.0MB
SHA256 f5fb863ff59ca0e0ee881592d5bb44a5dcb109d8e010b165110bcc0ba66a1ef3
MD5 2b086574caff6b355993ef2f8de76034
SHA1 a63b61511a38751827617eb2d19fae3b59f76b98
SHA512 7a8d119f230d439088db55c75e79d8866adcd28f697251ebffa43077dacaa2857470a1404b5098f2aa646c43313cc318fa3677803869dde09de69fc4ba37c2f7
SSDEEP 24576:KEMBi80e9Rb7Tm4u8Cne0B4G4FuIrarZ22bw4QoS:Kg8r37Une0B4G4Fujd2gw4Q9
TLSH
T1F256F6A5B386CA96F01942B15582F7B6F7F6FCA079818317B121735C4CB73885F26B88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d1fa56d5966cd92e2b2cfa253782fb109f6ee14342160a357a3cb837a380cea
MD5 db59da74e3d0d0da2319f50e45e8fd3c
SHA1 866e46e10283c617b4bb7711ba8a07aa5ec1075d
SHA512 3f0f2924c416089dd7df91f36ab77cf25e3e56aec9afa2ff49fe32c91b05f0cd9ae6e443f79d08c2ceb74ce6992ed9154641d1cff0019e642d626530a90e4f9f
TLSH
T1A3D012287F615E51D40141710530A6042493CC17419014060836980748101C61305890
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

edge_shutdown_crash.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\temp\edge_shutdown_crash.txt
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 02cad3591c076be5904924e8e54097d0068f42f0d32f03493c3602c35c2667a7
MD5 9377448ed90217d18f8cdfec000f1c8f
SHA1 5bce1c690c7234467bee451255306a9f3bf88093
SHA512 2bf26dab45ea9f2683719e141f669c6fb44e7a88ec5194bf2c4683aa21b54e43feebefaed31466ba942acaf5f492e4a70c6ff3e04fa323df9bd57bd4b39b1bc9
SSDEEP 192:LONU6AmwprQmiUypK6siX5FPjzorE3O+JiiBU6:LONU6ipd36siX5FX8E3OryU6
TLSH
T10702FB35BC786C7F8AF2AE45B5473713AFA5116BEA942F94C9E81B2C01D764C1306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 20d89d99f971f774fa006b32fa768e5f8153f633b80b3c49542b4610872e3400
MD5 251c958b98eb7086a300825f95c88b0c
SHA1 ee593e889fe7f837f832696ad2458493002fa5d0
SHA512 8cb2dba50d95f576a4a4731487a7b17f5ac77008c5eeb3d0ce7b5533c663fb5f1c5ce9a91423167d41b275bcc332049a3a9e309286e88fb02e05b80db8ac5196
SSDEEP 192:LONH6Amwp3QmiUzZKosiX5FPjzorE3OzXCSJrNlRy1JU6:LONH6ipZ4osiX5FX8E3OzXdJrVwU6
TLSH
T12C12F936B9B8AC7F5ED2B585B4473113AEA54117EB887F94C6EC1B2C01DB69C530A832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vshost.exe

Path C:\Users\Admin\AppData\Local\Temp\8cVToaPU\vshost.exe
Size 2.4MB
SHA256 e724b8417dc081196b9892e5f7c8b30b06be04916fc05f887ccc080e5ba8f5af
MD5 d9d8c27d9ff894854b58d011d3290a97
SHA1 11cd95a1f8e992b5bb4bee17cd1d01964edb35bc
SHA512 3c08a954d9425327b0ca5810bdc31bf947e9f17cf68f402b126b8b84e30aabbe786cd8cdebade240a9af96b6499ca20b787c58915fa0f1d211d52c4480523ad7
SSDEEP 49152:ofC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MNIMnMznc2:FoLr9DITjJG0boO1pH
TLSH
T1BCC59E22FB8290B2E4D601B062BE6BF75D787234532558CBE3C01D6A59206D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download