f9a9f2a00d2b34450b2bac5e25f23bd1789354d29b1227efd2190cad6a4108ba

Analysis

max time kernel
149s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
investigate.exe
Size 204.0MB
Sample261023-3kshtsv13l
SHA256 f9a9f2a00d2b34450b2bac5e25f23bd1789354d29b1227efd2190cad6a4108ba
MD5 7472fb7037b0a59dde776ec06e26c1b6
SHA1 5f87a47688fb8f6bb7d7d69db59d8a320baa2b6b
SHA512 5c71529a14c40132f7f5fe73e7b6951fc062cde95124bb1b53b6c53db4ca152a4a99439500b70c9930bd1451c6c030237b6b79f8163868c93c7f7cb7a987ce97
SSDEEP 1572864:kUA5i06ZdKezyhS+0geqdEPz9utcH1jZuSbWOTTpuHeAsBeBtCWo7lBJaxzSt+RK:nyU+QNnEcI7K
TLSH
T1EAA88C03E29A41D9C01DD175575A9233FEB1B80A4B24B7DF2B9447522F66EF82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2544	investigate.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
1572	WMIC.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
1936	WMIC.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1904	cmd.exe
916	cmd.exe
1592	cmd.exe
1712	cmd.exe
4328	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	investigate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	investigate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	investigate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	investigate.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	investigate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	investigate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	investigate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	investigate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	investigate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	investigate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	investigate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	investigate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	investigate.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
3816	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2664	WMIC.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3816	WMIC.exe
Token: SeSecurityPrivilege	3816	WMIC.exe
Token: SeTakeOwnershipPrivilege	3816	WMIC.exe
Token: SeLoadDriverPrivilege	3816	WMIC.exe
Token: SeSystemProfilePrivilege	3816	WMIC.exe
Token: SeSystemtimePrivilege	3816	WMIC.exe
Token: SeProfSingleProcessPrivilege	3816	WMIC.exe
Token: SeIncBasePriorityPrivilege	3816	WMIC.exe
Token: SeCreatePagefilePrivilege	3816	WMIC.exe
Token: SeBackupPrivilege	3816	WMIC.exe
Token: SeRestorePrivilege	3816	WMIC.exe
Token: SeShutdownPrivilege	3816	WMIC.exe
Token: SeDebugPrivilege	3816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3816	WMIC.exe
Token: SeRemoteShutdownPrivilege	3816	WMIC.exe
Token: SeUndockPrivilege	3816	WMIC.exe
Token: SeManageVolumePrivilege	3816	WMIC.exe
Token: 33	3816	WMIC.exe
Token: 34	3816	WMIC.exe
Token: 35	3816	WMIC.exe
Token: 36	3816	WMIC.exe
Token: SeShutdownPrivilege	672	investigate.exe
Token: SeCreatePagefilePrivilege	672	investigate.exe
Token: SeIncreaseQuotaPrivilege	3816	WMIC.exe
Token: SeSecurityPrivilege	3816	WMIC.exe
Token: SeTakeOwnershipPrivilege	3816	WMIC.exe
Token: SeLoadDriverPrivilege	3816	WMIC.exe
Token: SeSystemProfilePrivilege	3816	WMIC.exe
Token: SeSystemtimePrivilege	3816	WMIC.exe
Token: SeProfSingleProcessPrivilege	3816	WMIC.exe
Token: SeIncBasePriorityPrivilege	3816	WMIC.exe
Token: SeCreatePagefilePrivilege	3816	WMIC.exe
Token: SeBackupPrivilege	3816	WMIC.exe
Token: SeRestorePrivilege	3816	WMIC.exe
Token: SeShutdownPrivilege	3816	WMIC.exe
Token: SeDebugPrivilege	3816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3816	WMIC.exe
Token: SeRemoteShutdownPrivilege	3816	WMIC.exe
Token: SeUndockPrivilege	3816	WMIC.exe
Token: SeManageVolumePrivilege	3816	WMIC.exe
Token: 33	3816	WMIC.exe
Token: 34	3816	WMIC.exe
Token: 35	3816	WMIC.exe
Token: 36	3816	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2664	WMIC.exe
Token: SeSecurityPrivilege	2664	WMIC.exe
Token: SeTakeOwnershipPrivilege	2664	WMIC.exe
Token: SeLoadDriverPrivilege	2664	WMIC.exe
Token: SeSystemProfilePrivilege	2664	WMIC.exe
Token: SeSystemtimePrivilege	2664	WMIC.exe
Token: SeProfSingleProcessPrivilege	2664	WMIC.exe
Token: SeIncBasePriorityPrivilege	2664	WMIC.exe
Token: SeCreatePagefilePrivilege	2664	WMIC.exe
Token: SeBackupPrivilege	2664	WMIC.exe
Token: SeRestorePrivilege	2664	WMIC.exe
Token: SeShutdownPrivilege	2664	WMIC.exe
Token: SeDebugPrivilege	2664	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2664	WMIC.exe
Token: SeRemoteShutdownPrivilege	2664	WMIC.exe
Token: SeUndockPrivilege	2664	WMIC.exe
Token: SeManageVolumePrivilege	2664	WMIC.exe
Token: 33	2664	WMIC.exe
Token: 34	2664	WMIC.exe
Token: 35	2664	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
672	investigate.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 2544	672	investigate.exe	80
PID 672 wrote to memory of 2544	672	investigate.exe	80
PID 672 wrote to memory of 2424	672	investigate.exe	81
PID 672 wrote to memory of 1712	672	investigate.exe	82
PID 1712 wrote to memory of 2616	1712	cmd.exe	84
PID 2616 wrote to memory of 4536	2616	net.exe	85
PID 672 wrote to memory of 4328	672	investigate.exe	86
PID 4328 wrote to memory of 3816	4328	cmd.exe	88
PID 672 wrote to memory of 1904	672	investigate.exe	90
PID 1904 wrote to memory of 2664	1904	cmd.exe	92
PID 672 wrote to memory of 916	672	investigate.exe	93
PID 916 wrote to memory of 1572	916	cmd.exe	95
PID 672 wrote to memory of 1592	672	investigate.exe	96
PID 1592 wrote to memory of 1936	1592	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\investigate.exe
"C:\Users\Admin\AppData\Local\Temp\investigate.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:672
- C:\Users\Admin\AppData\Local\Temp\investigate.exe
  "C:\Users\Admin\AppData\Local\Temp\investigate.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\investigate" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1720,i,2082640760412225897,7127800073826535938,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - Network Service Discovery
  PID:2544
- C:\Users\Admin\AppData\Local\Temp\investigate.exe
  "C:\Users\Admin\AppData\Local\Temp\investigate.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\investigate" --field-trial-handle=1720,i,2082640760412225897,7127800073826535938,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2156 /prefetch:11
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get size /value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Collects information from the system
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name /value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get manufacturer,product /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get manufacturer,product /value
    3⤵
    - Uses WMI to collect hardware manufacturer information
    - Reads the TCP/IP host and domain name from the registry
    PID:1572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber,version /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber,version /value
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Roaming\investigate\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 33afa4dc1c24bd0205e0eab08121ac9e7227619ecaa0af70ebb44013df58cf27
MD5 fc8ace3167168249d4622f186b3c3254
SHA1 a5be6e67d47333e6acc525e2ad42e0b4594c904e
SHA512 cedf15d343e980a5dc66c10a613536df1bbc0bcf0324b020d20fc2824dabad98e6b392630f352ac97d15fbcd79d53057a66561dc92d3eeac5e7cc0218ac57a9c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\investigate\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/2544-16-0x0000021044D10000-0x000002104528A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads