2a234f7de3ce7e7da0d567da423a6ff51bb8e295e3995c1385a9e0b14594de77

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boot_1793143305099.exe
Size 17KB
Sample261027-3cfjasgx2x
SHA256 2a234f7de3ce7e7da0d567da423a6ff51bb8e295e3995c1385a9e0b14594de77
MD5 da9377d5467bb7c4b3c9b0cdf0dda73a
SHA1 bc66fc2eda7ff57408dfbf9148c0635cd26ab180
SHA512 2216856fe968dacb55d45a6d3e779bccb474bcb1ca88bba0f41c539799b01ebc9eec0b8dbe6275f0263e024aa324f029861f3ab413c84596907769ca6aa873a8
SSDEEP 384:+fmlrWtXkZ02kB6H5iM5IIUWRPt+zWwZW:tlhvkB6H5iM5IbWpI
TLSH
T14C82C64A775354EDC62AD574C1FB4F36A971FC024EE18B3E4270DAB20D30BA56E2A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file 4 IoCs

flow	pid	Process
14	3840	st.exe
10	3840	st.exe
11	3840	st.exe
13	3840	st.exe

Executes dropped EXE 5 IoCs

pid	Process
3840	st.exe
3820	3.exe
4784	1.exe
5028	2.exe
5056	1.exe

Loads dropped DLL 4 IoCs

pid	Process
1748	chrome.exe
4612	msedge.exe
3564	chrome.exe
5740	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4664	wscript.exe
2552	wscript.exe
3916	wscript.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c549-25.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 3840	5124	boot_1793143305099.exe	90
PID 3840 wrote to memory of 3820	3840	st.exe	91
PID 3840 wrote to memory of 2552	3840	st.exe	92
PID 3840 wrote to memory of 4664	3840	st.exe	93
PID 3820 wrote to memory of 6060	3820	3.exe	94
PID 4664 wrote to memory of 4784	4664	wscript.exe	96
PID 4784 wrote to memory of 1748	4784	1.exe	97
PID 4784 wrote to memory of 4612	4784	1.exe	100
PID 2552 wrote to memory of 5028	2552	wscript.exe	101
PID 5028 wrote to memory of 1368	5028	2.exe	103
PID 5028 wrote to memory of 1368	5028	2.exe	103
PID 5028 wrote to memory of 2256	5028	2.exe	106
PID 5028 wrote to memory of 2256	5028	2.exe	106
PID 3840 wrote to memory of 3916	3840	st.exe	107
PID 3916 wrote to memory of 5056	3916	wscript.exe	108
PID 5056 wrote to memory of 3564	5056	1.exe	109
PID 5056 wrote to memory of 5740	5056	1.exe	112

C:\Users\Admin\AppData\Local\Temp\boot_1793143305099.exe
"C:\Users\Admin\AppData\Local\Temp\boot_1793143305099.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Users\Admin\AppData\Roaming\loader\st.exe
  C:\Users\Admin\AppData\Roaming\loader\st.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Users\Admin\AppData\Roaming\loader\3.exe
    "C:\Users\Admin\AppData\Roaming\loader\3.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Windows\system32\reg.exe
      "reg" query HKEY_CURRENT_USER\Software\JavaSoft\Prefs\minecraft /v refreshToken
      4⤵
      PID:6060
- - C:\Windows\system32\wscript.exe
    "wscript" C:\Users\Admin\AppData\Roaming\loader\run2.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Users\Admin\AppData\Roaming\loader\2.exe
      "C:\Users\Admin\AppData\Roaming\loader\2.exe" all
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2256
- - C:\Windows\system32\wscript.exe
    "wscript" C:\Users\Admin\AppData\Roaming\loader\run1.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Users\Admin\AppData\Roaming\loader\1.exe
      "C:\Users\Admin\AppData\Roaming\loader\1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        5⤵
        Loads dropped DLL
        
        PID:1748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        5⤵
        Loads dropped DLL
        
        PID:4612
- - C:\Windows\system32\wscript.exe
    "wscript" C:\Users\Admin\AppData\Roaming\loader\run1.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Users\Admin\AppData\Roaming\loader\1.exe
      "C:\Users\Admin\AppData\Roaming\loader\1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        5⤵
        Loads dropped DLL
        
        PID:3564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        5⤵
        Loads dropped DLL
        
        PID:5740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

key.json

Path C:\Users\Admin\AppData\Local\WeedHack\key.json
Size 35B
SHA256 c1cc96ebe9a25428ffa8fe012db326dce59205665e656817f3d2ca5dae1c077e
MD5 9562f201d970b2d685962f243441de76
SHA1 6bd3322154e7a4768599511872b4254258335c18
SHA512 a8614e5fe66eccf6eba28d9a222e1fdd1bf6aa75ab722c27bb5598a4eb6d750d4b413eec37ce5c28fb1213c4aebf9d42ac309fee4dadd0c9224feda2b1817e9d
MD5 SHA1 SHA512

Submit Download

1.exe

Path C:\Users\Admin\AppData\Roaming\loader\1.exe
Size 1.2MB
SHA256 8c564856d4b723c2148a70a9726d0a2c8bb30fba8fd7d07fa4785fc13b2835b5
MD5 88717952b1daa29cd1098a466a3b75d9
SHA1 a3436933b7169c05f544526aadeb19a17d745184
SHA512 3867f6e6d3fd75d46e537b61a6e4487443f03854a570d0ec966bc5b5fde0c217d7b37ddfd6676af75834ca2c0f78e46bd8c5cc2e973d6a6e77f5125b1a5e7a66
SSDEEP 24576:9NN9FrdOppuf9pIWwsM6mGh3eXsscqNEiOeRs30KLy4yv:9/9FApuf92rsM6mGhOXsnqSL0KL
TLSH
T114558E07A3B940EDD06BC1798506561BFBB1B4051324ABDB5794CE6A3F13EE16BBE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2.exe

Path C:\Users\Admin\AppData\Roaming\loader\2.exe
Size 1.4MB
SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
MD5 1d04536714bb22a3e909525a7dd627f0
SHA1 affc166fa1874ff3ec0e42646e008cec972b76ab
SHA512 ec2028983c8c5939545c572f13e1d24e730ca1601c6a8840769d1a6b28b8e12d7c9bd1850007ec0be8abc7c44e12bafcd64dc5b4c842155b75a70d8c71769166
SSDEEP 24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd
TLSH
T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3.exe

Path C:\Users\Admin\AppData\Roaming\loader\3.exe
Size 1.4MB
SHA256 412fd6edfd69d297d41da2de2fbfa85cde4cf44e3e54f0e6aede40249beb1267
MD5 7bf214ed17bc9c839eba5709855230c9
SHA1 4d4716102f3c34e6a5d5f7d985b52b702006fa11
SHA512 b52dc9e78f34b3e0335e9357cac4d7fe22e5d121c59c24436d2db8a602055795a1512bb6456ab449bf0cd4771efb6453eaa75363b80c91afb00183ff234365ae
SSDEEP 24576:qKbq8DOw7UOeMWtr3p4LrJul2QdbeIigIsoDkSc61D3OjrqB3Bgt4SH:zb5CBUAr3pE/UqB3Bgt4
TLSH
T102655C03E25148FED7DAC0B4CF4AD636A722784D0BF6757A3690DAE03E26A507B1DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crmodule.dll

Path C:\Users\Admin\AppData\Roaming\loader\crmodule.dll
Size 119KB
SHA256 0d9ee7cee8af1684200a1e9784670dd743510d673fb746769145ab0a0ff5f486
MD5 1dc9d7be4342dc0ac77a752ec81e0a76
SHA1 43400e71b57c2c34beff9a84e15bcdf6075249fe
SHA512 ef3c643fa56c2bf8c89cbdd87e2dd44016e2045d8d40b0c072a5480f854b8b0fa6a7de2b25ed40207c405193080df3ef9fef20c321ca0daa52fd27f09da838a0
SSDEEP 3072:C2Ixjd7b9bGZ895IgSVqIaxzybuJYhqhxa/:fI9d5SZ89ygIkwghi
TLSH
T157C3129BB3D9426BEF531239B552696030C2361767CB8A15BF9331E02764CF20D46BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run1.vbs

Path C:\Users\Admin\AppData\Roaming\loader\run1.vbs
Size 134B
SHA256 cc7c70ba42ca2e573f497509f8152d897efdfa971aef414e05af9a95a92c78fb
MD5 ee8a4c1cd1d64941cd1c31a957070279
SHA1 6aed3abd70cdc80232a48af579d060f9704db986
SHA512 e9827938f2ece5a71066698a9657db2a2016427dba0182546e15c90697b15407321de82d078fa1a38f96bc431fa514642f3a0400de323cc39eb4a684728b83d2
TLSH
T173C02B42F40DEE281C07909002314D4E42A10155309C101F4D148ACC2860084C317403
MD5 SHA1 SHA512 TLSH

Submit Download

run2.vbs

Path C:\Users\Admin\AppData\Roaming\loader\run2.vbs
Size 138B
SHA256 9153376afcba5bcd6523271d8e6fb3112b2e8440fab64d9eac72e5866b1dcdb0
MD5 ed4844cbdb53bfff5ed487d6deed8545
SHA1 ff96a2ad4163c485782eaabca24aee7818bd2c0d
SHA512 7698ce9c63bbc71f5ede774111ffe22a19bacd80a5793bdfd3b8726316850e7d1b9cbd636034394e2ecf651c5352d2983c58b0c88d6e65d65661fb4b2e8535f4
TLSH
T1B1C02B42F40FEE689C07918042314C8E42A14055705C101B4D048ACC38600C4C342403
MD5 SHA1 SHA512 TLSH

Submit Download

st.exe

Path C:\Users\Admin\AppData\Roaming\loader\st.exe
Size 4.3MB
SHA256 ec7ea8c4794e71c48519a18a0d3086736d7209d89495118948ec153a6f09838a
MD5 2254be34c3cb708f5483574f22b45dbe
SHA1 eea0df02ac54c0596b301a96142e2d4ab3b98657
SHA512 745c86ece4ef9bd82e278162b621de443e75f17f604e9c3f22f0022028a473580aecc7ff62bd83397816ac9fa7cf4b0f2bd4df136ffe5db2d6fe5179eb0bf3a8
SSDEEP 49152:KG0DqmMaxYVqd5dSLX4ED6DpY5W+We4vjlNQa37Zen/bBD+UfoRrbre6w48FEIUF:T0GqSVqlYoBv/OQwxL+j
TLSH
T1F9267C03F38591FCC09EC1B8C7879B32AA72B8990920B69F17D497313E69E645F0E759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3820-62-0x00007FF6101C0000-0x00007FF610336000-memory.dmp

Download

memory/3820-44-0x00007FF6101C0000-0x00007FF610336000-memory.dmp

Download

memory/3820-47-0x00007FF6101C0000-0x00007FF610336000-memory.dmp

Download

memory/3820-64-0x00007FF6101C0000-0x00007FF610336000-memory.dmp

Download

memory/3820-54-0x00007FF6101C0000-0x00007FF610336000-memory.dmp

Download

memory/3820-55-0x00007FF6101C0000-0x00007FF610336000-memory.dmp

Download

memory/3840-43-0x00007FF6CAAD0000-0x00007FF6CAF1F000-memory.dmp

Download

memory/3840-52-0x00007FF6CAAD0000-0x00007FF6CAF1F000-memory.dmp

Download

memory/5124-42-0x00007FF600930000-0x00007FF60093C000-memory.dmp

Download

memory/5124-53-0x00007FF600930000-0x00007FF60093C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads