49a5b6740d175fb131138ab772a1f3757c5774cbc1d491ba8702c61c3ae6ff6d

Analysis

user interaction
yes
max time kernel
38s
max time network
35s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/10/2026, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1guil.exe
Size 1.2MB
Sample261017-n4faaaew3p
SHA256 49a5b6740d175fb131138ab772a1f3757c5774cbc1d491ba8702c61c3ae6ff6d
MD5 1cc562dadc537d52237ddc4813ab99e8
SHA1 59412e3c32692a83d65a1783860ce48d33724ce8
SHA512 1aadf7adcd0bb71f3379f4832f127b765f97a5676a0c00773c13a4b07fb7a130def6a049cda6b88c7ab4bf97061b096b7757cdad56bf5c9c4fd9fb694cb179f4
SSDEEP 24576:5WrI/3lYB8LISmmcOxqwozg7uvuw5Rs9epoOGfCFLNbe0kJP2JP90uMJ:p/i8VmMxF6CgVEik4JP90uMJ
TLSH
T144459E42FB8381B1F5CA00B5106B6BF7AD362521872598D3E7C01DB599252D27B3FB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1guil.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3836	1guil.exe
3836	1guil.exe
3836	1guil.exe
3836	1guil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3836	1guil.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3836	1guil.exe

C:\Users\Admin\AppData\Local\Temp\1guil.exe
"C:\Users\Admin\AppData\Local\Temp\1guil.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads