psychedelic | 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90

Analysis

max time kernel
148s
max time network
7s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
Size 275KB
Sample261027-g3rtcsby8q
SHA256 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90
MD5 ae5450f32bcb533c5b592c77a7861553
SHA1 85e01bdb2aee0217932e108535691c898b138a80
SHA512 5cd8929d374d5064ca7d47a4b468d983bdeff34354b7924a049cf8e52d366d2479fc5c0687527648b4e8227811f94ef13f6df99272b49541ccf3f514e348a13e
SSDEEP 6144:fheWYL+ZPJIYjK9GZLBpdPGq1Kq0CGpNMm:fHPZCYjK9GZdPGqd+NM
TLSH
T132545C57E25364ECC167D2388697A732B932786201747E6B3A1CC6727F21E60A73EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery psychedelic persistence ransomware spyware stealer

Malware Config

Signatures

Family: Psychedelic,Lunex
description: Psychedelic is a multi-stage Windows stealer targeting browser credentials and crypto wallets.
stealer psychedelic

Detects Psychedelic/Lunex Stealer 1 IoCs

resource	yara_rule
behavioral2/memory/1844-271-0x00007FF65E890000-0x00007FF65E8DD000-memory.dmp	family_psychedelic_stealer

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 4708	1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe	90
PID 1844 wrote to memory of 4708	1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe	90
PID 1844 wrote to memory of 4176	1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe	92
PID 1844 wrote to memory of 4176	1844	06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe
"C:\Users\Admin\AppData\Local\Temp\06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

content.ts-B6XGI__y.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\A5DB02C5D5EA83B7D5676A68A9B95AA1A9F8247DFAF7664B4361F400A977BE90\e0\assets\content.ts-B6XGI__y.js
Size 8KB
SHA256 3953b8ae3399c1c34ff9b2200e8a9f103f4a0df9291b46c3c1bd6c588e4e6496
MD5 28aae7de4ce3fbf0da4f709210b707cc
SHA1 0d5f93917c40c731fa28716bc5aa8963db022b63
SHA512 d00f2353014e32efece5b4141e7a73b2240753c0be464bc083371e472b55a430de418346227c08ed3ec96999f65cd9884e42b5a8f561a8c9a9b8b957f90e93c7
SSDEEP 192:FOab7oijjnaCb8eY6imcpQDzrbWpjQilnWPvOA117amSbrfW5y5Co09UkD:Qab7LjnaC8b/ZpQDzrbCjQilnWIrf15A
TLSH
T186022F077BC02912375BBDE37B33A085E409A819398A549EF624BE293C62571FB91771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csp-strip.ts-DrI45pKU.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\A5DB02C5D5EA83B7D5676A68A9B95AA1A9F8247DFAF7664B4361F400A977BE90\e0\assets\csp-strip.ts-DrI45pKU.js
Size 4KB
SHA256 9e792f7e6b594cf08cc9efee161938bd01bd199531e49a34f5bf6c10f4bdc914
MD5 f8e5277f45307f781a9a18af66d03358
SHA1 6a8f2e1228cb4c5a3e9177074229ec4b27f57c78
SHA512 b384b81f6d4cecc07bd07e761eb8abebcfaa63a96207ab50043c1a670a1e818a38234355bef788a0e51e97f2558427c322c1e90dff7c46a631a73f1f587f8b3e
SSDEEP 96:AntL5Xsg6cEA0au3ivnqML8mqjfIzkvs3T5/kgsgmW6Ujot:AN5X2A0abnjLcjAok3T5/kZW6Ujot
TLSH
T1DD91456A3F803E41376E4F7B1127B0E0F6159E1E76794E86C8383DD92986D71DAC2634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\A5DB02C5D5EA83B7D5676A68A9B95AA1A9F8247DFAF7664B4361F400A977BE90\e0\icons\128.png
Size 6KB
SHA256 e83f6f9df6e7cb64ebb80ee0063e40e0f3beca3b965595e88ab56f56e061ed5a
MD5 f8dbd8e9ee75e1b9f0d2a19772be1a11
SHA1 cd9d65ccbdd711079655d9eb00c1b4059a6e2428
SHA512 31ea9dc129b304f0157485d2e6b2d8119b461ac6dc1978a5111241f76955a24ff5de1b4387b06e07e45cd71afa3f46e2744f5e7f4612b507058cdff1ea26acfb
SSDEEP 192:QlG05FSSG7qwTakYyea85wm2lTr0uG5MyT7/XwrDf:QljTrG1TBYyeavIB5rTz0D
TLSH
T1E1E1BF8C53EC98BBF1C50D9E42680D369FEBF256129C900ED853D04C4B104F20CBE796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\A5DB02C5D5EA83B7D5676A68A9B95AA1A9F8247DFAF7664B4361F400A977BE90\e0\icons\16.png
Size 367B
SHA256 b9161cfe56788270293cb27c5583044561cd1dffdefc9a3e3056362a36176460
MD5 cfae6f76443a6640ce5b42865affdcc2
SHA1 44cf55216e6a558eba90049c85c96856eb2c17c0
SHA512 7c4363f69dccb00b5ee3f0d05134d950c4a4fd383f8cc237885974602aefd1522379617c9518814c415639652c895958d76c4962522baa4b99d71f86b2995cca
TLSH
T158E0CAF65109681BCF98132749E0D0FD655A5D5D03415CD46003056E28EB3C20FFC572
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\A5DB02C5D5EA83B7D5676A68A9B95AA1A9F8247DFAF7664B4361F400A977BE90\e0\icons\32.png
Size 961B
SHA256 44ad298142dd2efba958e313b21fe2368b796cbc8a2f14a01c2fa3c8c5bb5c08
MD5 a3db47a537eda71d186fedf219cdec3f
SHA1 8ee4319809a88e5c4f8552087813b9e0cd504af2
SHA512 6643bb0f5051d240dbde6ce6c751e819f13af3b3832047a24ad4e38899e51b2a669c28d8385b312ea8ca48a861bb98aed3c086c55a1dc3c8d133c22e2cc32e5b
TLSH
T16311C871173549B20C812E6E40E5E27D5AD21FB0272D02B8B4C1F395427D801C5DC3CB
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\A5DB02C5D5EA83B7D5676A68A9B95AA1A9F8247DFAF7664B4361F400A977BE90\e0\icons\48.png
Size 1KB
SHA256 edd6483665880f3c323f11e9217e6c935fdc14cee32b60a9df573440b2919c2c
MD5 3fcde1c2c715ac587242b9c91e5e2e5b
SHA1 5a5fad7996176ae7044563f456b6d4bc7d227029
SHA512 fa14fb9360c20dd97d538cc0d3d9960038f63dca32e6bc5d8710147eca7e0dbae4d4fe794a45b7a2077250d212aa2395b6060f0422aa65ece1ad44bca975c762
TLSH
T1213109D537052D4FCBC9AA6056B31163E80105A513CD72498F6FC096D9183AB7492381
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\A5DB02C5D5EA83B7D5676A68A9B95AA1A9F8247DFAF7664B4361F400A977BE90\e0\manifest.json
Size 2KB
SHA256 c10b5833016bc7d444395c11bb1729268858ab594d3f79f2e30002aaf6c0879d
MD5 2730856ddee4b2fb494b9e397931eb1e
SHA1 417cbe076d3ef31c6257d35c250c89c20b655b04
SHA512 8bd095109168dcf60c2797c7dc6de1a455a4e47a9380499a840880f39eb87bc304287c15244be38f7c29378f61673678ec43f549ddf554f8f96e4ae4f73b98e5
TLSH
T1C141DD25D9684CBB02DCA7346CBA5A8369140A878D907C1C77DD800C8F7D21F42B6B9D
MD5 SHA1 SHA512 TLSH

Submit Download

strip_csp.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\A5DB02C5D5EA83B7D5676A68A9B95AA1A9F8247DFAF7664B4361F400A977BE90\e0\rules\strip_csp.json
Size 750B
SHA256 530ac7abda5efeaa370b60521bd615b0695a6c968f240bd21bd7f9e997852baa
MD5 197a5c91db8dfd3aea9295c61b155dc8
SHA1 777f0cefca0a109c21ecaee04a53b26792ebae0f
SHA512 da59e796602b90c6d484ca3bb2059493015e077e1b086faf3fe3401ffda14085a99e469c6fe198479acb170b4bf156a86b3ed3dc4748e52103f192db8b589fbf
TLSH
T15301D6B7CC96EC2702F1A325E1659619F170530F9750011F3A7C459D9FF9360578AB4D
MD5 SHA1 SHA512 TLSH

Submit Download

service-worker-loader.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\A5DB02C5D5EA83B7D5676A68A9B95AA1A9F8247DFAF7664B4361F400A977BE90\e0\service-worker-loader.js
Size 1KB
SHA256 54a2047da6c8d455fe152afb1ffc06adfa5f1b3ad72b7502410672c2312062d8
MD5 4ddbf93bc68fe858b03972eb29092f96
SHA1 d623af091ebc30cab454ad95a2326d0035f284d4
SHA512 99cd9e6c8c67db531568da5c01e82d713b9c4a47a9fd959649bb669727057ce13c0590a3301c95561b34fb110c6019e90ed2f13af0dca72803ff64b5522f8304
TLSH
T1A941212AB792A74C13DF5F832B3F30D1D42ADD6F2AC70C0E0616F991AE58550F2A5274
MD5 SHA1 SHA512 TLSH

Submit Download

ck_1844_240778281.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_1844_240778281.bin
Size 32B
SHA256 52a652aff2158502abd9667f83f8ce19c8a7bdbc57e2d3d4e8890d44add063b8
MD5 3d22371db8ddcb73723201686986576b
SHA1 2664b8f4563cf5730deccef92cfaa9bdc145ee5e
SHA512 abe753f8dfa52f1de119a9d1d6e1aae19b862f1914a35f9f618a605a1375c6dbc7728ca3bf0ea938ce57a27fbb48eaa608bf6da9a0f3dbc57ea0104d0be57721
MD5 SHA1 SHA512

Submit Download

extEF38.tmp.zip

Path C:\Users\Admin\AppData\Local\Temp\extEF38.tmp.zip
Size 45KB
SHA256 bdefc03a38d9bf51a5d5388a0ac517b6428cb448a80b6a89cb517d31e9e4704b
MD5 e6fd959586df9bd9d3b933b91bff1df3
SHA1 727b3913469bfc911f564d3bd5e9b92a1961db23
SHA512 1ca269879f85e6ef3e722840f28eb3e9f0a81608d1a6b754eee0e503ce66a8f90131bdf6925635b2f970e39dc80eba42742e7f11fdb4e60b568c11cfc5a87e6f
SSDEEP 768:HNuUnGsTvPRVvkzIv6Bv2x1NTwePepQITBYoIB5rTXITBYoIB5rT5zhj/2:tuaG0zWICBOxPTtBH1rbH1rNzh/2
TLSH
T12523F1595790483FD7DB597C40268E34CE9F79B0028D509FC967F48C9A068A32BE6BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1844-271-0x00007FF65E890000-0x00007FF65E8DD000-memory.dmp

Download