641ef754912d882d2cedebffbc74539c128ed8ae433e713d4effe792c47345f1

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.0MB
Sample261022-ps5apsct5x
SHA256 641ef754912d882d2cedebffbc74539c128ed8ae433e713d4effe792c47345f1
MD5 14138916c72ba54ed4b89b3e63ea2fb8
SHA1 5be9170d278a9e1c9097b7acc0159da0cb5afb43
SHA512 31533d0bb168f903975eb35a994124f4baa848a767a1c81d1570c9a305d622e9067bd177022564ab6c2799957be00281552482d4654ea21367e53a2eb6c2643b
SSDEEP 12288:MBuIeju8YbVIrR9YF/zbDYZGy97Bd/sxuLSNISboxMIeUzAsqJusjDMWYr:jju8Y55xSbddkxuL6Ijx7bcsqr3MWYr
TLSH
T15F35E016F7C94FF9F02E947476151922DA6178440FE1B6EB128C5B2B4E229D0CEFEB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86
PID 3256 set thread context of 1348	3256	Explorer.EXE	86

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\lairs\rynuiantly.inf	file.exe
File opened for modification	C:\Program Files (x86)\deportment\octsoon.pdf	file.exe
File opened for modification	C:\Program Files\ploughs\iwneiand.dat	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
636	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
1348	chrome.exe
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3256	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	3256	Explorer.EXE
Token: SeCreatePagefilePrivilege	3256	Explorer.EXE

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4668	file.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 3256	4668	file.exe	56
PID 1348 wrote to memory of 4660	1348	chrome.exe	87
PID 1348 wrote to memory of 4960	1348	chrome.exe	88
PID 1348 wrote to memory of 4960	1348	chrome.exe	88
PID 1348 wrote to memory of 636	1348	chrome.exe	89
PID 1348 wrote to memory of 3500	1348	chrome.exe	90
PID 1348 wrote to memory of 3500	1348	chrome.exe	90
PID 1348 wrote to memory of 3468	1348	chrome.exe	91
PID 1348 wrote to memory of 3700	1348	chrome.exe	92
PID 1348 wrote to memory of 3468	1348	chrome.exe	91
PID 1348 wrote to memory of 3700	1348	chrome.exe	92
PID 1348 wrote to memory of 4752	1348	chrome.exe	93
PID 1348 wrote to memory of 4752	1348	chrome.exe	93
PID 1348 wrote to memory of 1440	1348	chrome.exe	95
PID 1348 wrote to memory of 1440	1348	chrome.exe	95

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3256
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff855f7c728,0x7ff855f7c734,0x7ff855f7c740
    3⤵
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,3458930735211540605,9898211323804617127,262144 --field-trial-handle=2012,i,1277808421742857206,9250371893387764878,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:4960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,4701355879658267531,5482013209774602907,524288 --field-trial-handle=2012,i,1277808421742857206,9250371893387764878,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - System Time Discovery
    PID:636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,16716063853087677114,4581307330765470644,524288 --field-trial-handle=2012,i,1277808421742857206,9250371893387764878,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:8
    3⤵
    PID:3500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,15844663126261493537,12186901962013851044,2097152 --field-trial-handle=2012,i,1277808421742857206,9250371893387764878,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:3468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,15122654760778688665,9778254356210690519,2097152 --field-trial-handle=2012,i,1277808421742857206,9250371893387764878,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:3700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4168,i,7189216218153488084,11195311897029655265,2097152 --field-trial-handle=2012,i,1277808421742857206,9250371893387764878,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4184 /prefetch:2
    3⤵
    PID:4752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4528,i,9645340157176047705,7322769112396892145,2097152 --field-trial-handle=2012,i,1277808421742857206,9250371893387764878,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3772 /prefetch:1
    3⤵
    PID:1440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5fba95f1-4594-4476-ac6e-a192d43431d3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5fba95f1-4594-4476-ac6e-a192d43431d3.tmp
Size 130KB
SHA256 d660f56bb0798b80968f3916e077166eb101f59a2f712eaedf0c102536b0afa5
MD5 70283fae240ed9e535681d028a3bc1c1
SHA1 c57b54ecffd65d870ffcfdb889f5dccd47bfe90f
SHA512 25a7d56abf822858b4b46b52c681bcf07c0b5c2d7b677523d59df04f502cc274476ffd395e561e347fa6fcbcd030024954790f8e5ad36c58f8fb3133b2cef258
SSDEEP 3072:N+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:N+hFD+7t56OD9ZfSAppr2
TLSH
T154D31232AA95D8BBC9BC6541B157A300DE72ACED81DE3A0944495F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b764166c-cb8e-44b5-8c6b-bc2d01ef1dda.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b764166c-cb8e-44b5-8c6b-bc2d01ef1dda.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

memory/3256-21-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-34-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-2-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-0-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-1-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-8-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-15-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-31-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-28-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-27-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-26-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-33-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-25-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-24-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-23-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-22-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-19-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-6-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-3-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-20-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-16-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-35-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-17-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-18-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-13-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-12-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-11-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-10-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-9-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-38-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-4-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-5-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-56-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-59-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-58-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-7-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-60-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-74-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download

memory/3256-75-0x0000000002DD0000-0x0000000002E71000-memory.dmp

Download