2a234f7de3ce7e7da0d567da423a6ff51bb8e295e3995c1385a9e0b14594de77

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boot_1793143305099.exe
Size 17KB
Sample261027-3cfjasgx2x
SHA256 2a234f7de3ce7e7da0d567da423a6ff51bb8e295e3995c1385a9e0b14594de77
MD5 da9377d5467bb7c4b3c9b0cdf0dda73a
SHA1 bc66fc2eda7ff57408dfbf9148c0635cd26ab180
SHA512 2216856fe968dacb55d45a6d3e779bccb474bcb1ca88bba0f41c539799b01ebc9eec0b8dbe6275f0263e024aa324f029861f3ab413c84596907769ca6aa873a8
SSDEEP 384:+fmlrWtXkZ02kB6H5iM5IIUWRPt+zWwZW:tlhvkB6H5iM5IbWpI
TLSH
T14C82C64A775354EDC62AD574C1FB4F36A971FC024EE18B3E4270DAB20D30BA56E2A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file 4 IoCs

flow	pid	Process
10	3012	st.exe
11	3012	st.exe
12	3012	st.exe
13	3012	st.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 5 IoCs

pid	Process
3012	st.exe
1212	3.exe
5104	2.exe
4404	1.exe
4028	1.exe

Loads dropped DLL 4 IoCs

pid	Process
776	chrome.exe
2732	msedge.exe
1788	chrome.exe
3764	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
1740	wscript.exe
3740	wscript.exe
1152	wscript.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024389-26.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3012	3872	boot_1793143305099.exe	83
PID 3012 wrote to memory of 1212	3012	st.exe	88
PID 3012 wrote to memory of 3740	3012	st.exe	89
PID 3012 wrote to memory of 1740	3012	st.exe	90
PID 1212 wrote to memory of 2084	1212	3.exe	91
PID 3740 wrote to memory of 5104	3740	wscript.exe	93
PID 1740 wrote to memory of 4404	1740	wscript.exe	95
PID 4404 wrote to memory of 776	4404	1.exe	96
PID 5104 wrote to memory of 216	5104	2.exe	99
PID 5104 wrote to memory of 216	5104	2.exe	99
PID 4404 wrote to memory of 2732	4404	1.exe	100
PID 5104 wrote to memory of 680	5104	2.exe	103
PID 5104 wrote to memory of 680	5104	2.exe	103
PID 3012 wrote to memory of 1152	3012	st.exe	104
PID 1152 wrote to memory of 4028	1152	wscript.exe	105
PID 4028 wrote to memory of 1788	4028	1.exe	106
PID 4028 wrote to memory of 3764	4028	1.exe	109

C:\Users\Admin\AppData\Local\Temp\boot_1793143305099.exe
"C:\Users\Admin\AppData\Local\Temp\boot_1793143305099.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Roaming\loader\st.exe
  C:\Users\Admin\AppData\Roaming\loader\st.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Users\Admin\AppData\Roaming\loader\3.exe
    "C:\Users\Admin\AppData\Roaming\loader\3.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\system32\reg.exe
      "reg" query HKEY_CURRENT_USER\Software\JavaSoft\Prefs\minecraft /v refreshToken
      4⤵
      PID:2084
- - C:\Windows\system32\wscript.exe
    "wscript" C:\Users\Admin\AppData\Roaming\loader\run2.vbs
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Users\Admin\AppData\Roaming\loader\2.exe
      "C:\Users\Admin\AppData\Roaming\loader\2.exe" all
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:680
- - C:\Windows\system32\wscript.exe
    "wscript" C:\Users\Admin\AppData\Roaming\loader\run1.vbs
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Users\Admin\AppData\Roaming\loader\1.exe
      "C:\Users\Admin\AppData\Roaming\loader\1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        5⤵
        Loads dropped DLL
        
        PID:776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        5⤵
        Loads dropped DLL
        
        PID:2732
- - C:\Windows\system32\wscript.exe
    "wscript" C:\Users\Admin\AppData\Roaming\loader\run1.vbs
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Users\Admin\AppData\Roaming\loader\1.exe
      "C:\Users\Admin\AppData\Roaming\loader\1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        5⤵
        Loads dropped DLL
        
        PID:1788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        5⤵
        Loads dropped DLL
        
        PID:3764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ckE088.tmp

Path C:\Users\Admin\AppData\Local\Temp\ckE088.tmp
Size 20KB
SHA256 334906fd31008f2d84315a8c9920fa831deccbede7d18910f64e36d4147725e5
MD5 d5659e042c795e653356aa7dae5d31a2
SHA1 c911e6247279a4b1bd135583b7d08731d7b9d83b
SHA512 df50af51f95e21968600958f72f8e69508283607bcd1b829e7519cd79745896fdb1dd2a4f5d2561a6ce37f5cc35dadb4365492d63cbe91f0dfc7f2642dafc05d
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBb+d5wTxzsqKnKVxsZG8ltcj:TeW9aw/aHLopFMavU1iBKHox4ZnKv0ti
TLSH
T1AB92DD8E1F303215C0F88B32EDC209971EBD111C9313AA9AAE1464F3CE9259FF5061A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

key.json

Path C:\Users\Admin\AppData\Local\WeedHack\key.json
Size 35B
SHA256 c1cc96ebe9a25428ffa8fe012db326dce59205665e656817f3d2ca5dae1c077e
MD5 9562f201d970b2d685962f243441de76
SHA1 6bd3322154e7a4768599511872b4254258335c18
SHA512 a8614e5fe66eccf6eba28d9a222e1fdd1bf6aa75ab722c27bb5598a4eb6d750d4b413eec37ce5c28fb1213c4aebf9d42ac309fee4dadd0c9224feda2b1817e9d
MD5 SHA1 SHA512

Submit Download

1.exe

Path C:\Users\Admin\AppData\Roaming\loader\1.exe
Size 1.2MB
SHA256 8c564856d4b723c2148a70a9726d0a2c8bb30fba8fd7d07fa4785fc13b2835b5
MD5 88717952b1daa29cd1098a466a3b75d9
SHA1 a3436933b7169c05f544526aadeb19a17d745184
SHA512 3867f6e6d3fd75d46e537b61a6e4487443f03854a570d0ec966bc5b5fde0c217d7b37ddfd6676af75834ca2c0f78e46bd8c5cc2e973d6a6e77f5125b1a5e7a66
SSDEEP 24576:9NN9FrdOppuf9pIWwsM6mGh3eXsscqNEiOeRs30KLy4yv:9/9FApuf92rsM6mGhOXsnqSL0KL
TLSH
T114558E07A3B940EDD06BC1798506561BFBB1B4051324ABDB5794CE6A3F13EE16BBE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2.exe

Path C:\Users\Admin\AppData\Roaming\loader\2.exe
Size 1.4MB
SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
MD5 1d04536714bb22a3e909525a7dd627f0
SHA1 affc166fa1874ff3ec0e42646e008cec972b76ab
SHA512 ec2028983c8c5939545c572f13e1d24e730ca1601c6a8840769d1a6b28b8e12d7c9bd1850007ec0be8abc7c44e12bafcd64dc5b4c842155b75a70d8c71769166
SSDEEP 24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd
TLSH
T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3.exe

Path C:\Users\Admin\AppData\Roaming\loader\3.exe
Size 1.4MB
SHA256 412fd6edfd69d297d41da2de2fbfa85cde4cf44e3e54f0e6aede40249beb1267
MD5 7bf214ed17bc9c839eba5709855230c9
SHA1 4d4716102f3c34e6a5d5f7d985b52b702006fa11
SHA512 b52dc9e78f34b3e0335e9357cac4d7fe22e5d121c59c24436d2db8a602055795a1512bb6456ab449bf0cd4771efb6453eaa75363b80c91afb00183ff234365ae
SSDEEP 24576:qKbq8DOw7UOeMWtr3p4LrJul2QdbeIigIsoDkSc61D3OjrqB3Bgt4SH:zb5CBUAr3pE/UqB3Bgt4
TLSH
T102655C03E25148FED7DAC0B4CF4AD636A722784D0BF6757A3690DAE03E26A507B1DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chrome_Default_cookies.txt

Path C:\Users\Admin\AppData\Roaming\loader\cookies\Chrome_Default_cookies.txt
Size 261B
SHA256 4920a180b246ba8773554afc3bf4d02cce21090738d4201811e0ca9ec01fe3cf
MD5 9b0db6186eff327b8492c802caf1434f
SHA1 340b7c8253ff9d57bb53bfc74e0948882b88bb6c
SHA512 f537f3139526cc33e459683c07c666663a55f8b5955bc70f607f9975907eaad6250eec16471b84e77860d466b38800bcd73f5c172e1bc9ecbf510567577b035a
TLSH
T10CD02B4BA993F1835F21D0E419600C0F84004A3C641BEE886D8402E058BABA19684B8D
MD5 SHA1 SHA512 TLSH

Submit Download

crmodule.dll

Path C:\Users\Admin\AppData\Roaming\loader\crmodule.dll
Size 119KB
SHA256 0d9ee7cee8af1684200a1e9784670dd743510d673fb746769145ab0a0ff5f486
MD5 1dc9d7be4342dc0ac77a752ec81e0a76
SHA1 43400e71b57c2c34beff9a84e15bcdf6075249fe
SHA512 ef3c643fa56c2bf8c89cbdd87e2dd44016e2045d8d40b0c072a5480f854b8b0fa6a7de2b25ed40207c405193080df3ef9fef20c321ca0daa52fd27f09da838a0
SSDEEP 3072:C2Ixjd7b9bGZ895IgSVqIaxzybuJYhqhxa/:fI9d5SZ89ygIkwghi
TLSH
T157C3129BB3D9426BEF531239B552696030C2361767CB8A15BF9331E02764CF20D46BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run1.vbs

Path C:\Users\Admin\AppData\Roaming\loader\run1.vbs
Size 134B
SHA256 cc7c70ba42ca2e573f497509f8152d897efdfa971aef414e05af9a95a92c78fb
MD5 ee8a4c1cd1d64941cd1c31a957070279
SHA1 6aed3abd70cdc80232a48af579d060f9704db986
SHA512 e9827938f2ece5a71066698a9657db2a2016427dba0182546e15c90697b15407321de82d078fa1a38f96bc431fa514642f3a0400de323cc39eb4a684728b83d2
TLSH
T173C02B42F40DEE281C07909002314D4E42A10155309C101F4D148ACC2860084C317403
MD5 SHA1 SHA512 TLSH

Submit Download

run2.vbs

Path C:\Users\Admin\AppData\Roaming\loader\run2.vbs
Size 138B
SHA256 9153376afcba5bcd6523271d8e6fb3112b2e8440fab64d9eac72e5866b1dcdb0
MD5 ed4844cbdb53bfff5ed487d6deed8545
SHA1 ff96a2ad4163c485782eaabca24aee7818bd2c0d
SHA512 7698ce9c63bbc71f5ede774111ffe22a19bacd80a5793bdfd3b8726316850e7d1b9cbd636034394e2ecf651c5352d2983c58b0c88d6e65d65661fb4b2e8535f4
TLSH
T1B1C02B42F40FEE689C07918042314C8E42A14055705C101B4D048ACC38600C4C342403
MD5 SHA1 SHA512 TLSH

Submit Download

st.exe

Path C:\Users\Admin\AppData\Roaming\loader\st.exe
Size 4.3MB
SHA256 ec7ea8c4794e71c48519a18a0d3086736d7209d89495118948ec153a6f09838a
MD5 2254be34c3cb708f5483574f22b45dbe
SHA1 eea0df02ac54c0596b301a96142e2d4ab3b98657
SHA512 745c86ece4ef9bd82e278162b621de443e75f17f604e9c3f22f0022028a473580aecc7ff62bd83397816ac9fa7cf4b0f2bd4df136ffe5db2d6fe5179eb0bf3a8
SSDEEP 49152:KG0DqmMaxYVqd5dSLX4ED6DpY5W+We4vjlNQa37Zen/bBD+UfoRrbre6w48FEIUF:T0GqSVqlYoBv/OQwxL+j
TLSH
T1F9267C03F38591FCC09EC1B8C7879B32AA72B8990920B69F17D497313E69E645F0E759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-52-0x00007FF73B660000-0x00007FF73B7D6000-memory.dmp

Download

memory/1212-55-0x00007FF73B660000-0x00007FF73B7D6000-memory.dmp

Download

memory/1212-63-0x00007FF73B660000-0x00007FF73B7D6000-memory.dmp

Download

memory/1212-72-0x00007FF73B660000-0x00007FF73B7D6000-memory.dmp

Download

memory/1212-73-0x00007FF73B660000-0x00007FF73B7D6000-memory.dmp

Download

memory/3012-51-0x00007FF6ABBF0000-0x00007FF6AC03F000-memory.dmp

Download

memory/3012-61-0x00007FF6ABBF0000-0x00007FF6AC03F000-memory.dmp

Download

memory/3872-50-0x00007FF730CF0000-0x00007FF730CFC000-memory.dmp

Download

memory/3872-62-0x00007FF730CF0000-0x00007FF730CFC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads