Overview

overview

8

Static

static

3

TrackCord ...ER.bat

windows11-ltsc_2024-x64

3

TrackCord ...UP.exe

windows11-ltsc_2024-x64

4

TrackCord ...er.exe

windows11-ltsc_2024-x64

7

TrackCord ...rn.exe

windows11-ltsc_2024-x64

8

Analysis

  • geolocation tags

    eueuropefrfrance
  • max time kernel
    900s
  • max time network
    479s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/10/2026, 18:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TrackCord Grabber/TrackCord Grabber/Setup Grabber.exe
  • Size 10.8MB
  • Sample261029-w74faad15t
  • SHA256 03f7986da7b9aeb56e0765bb06163aba356caa0d45fe259247c739c5ab06747f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 49 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TrackCord Grabber\TrackCord Grabber\Setup Grabber.exe
    "C:\Users\Admin\AppData\Local\Temp\TrackCord Grabber\TrackCord Grabber\Setup Grabber.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Users\Admin\AppData\Local\Temp\TrackCord Grabber\TrackCord Grabber\Setup Grabber.exe
      "C:\Users\Admin\AppData\Local\Temp\TrackCord Grabber\TrackCord Grabber\Setup Grabber.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1312
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:1188
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:4000

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\VCRUNTIME140.dll
            • Size 106KB
            • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\_bz2.pyd
            • Size 82KB
            • SHA256 ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\_ctypes.pyd
            • Size 120KB
            • SHA256 b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _decimal.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\_decimal.pyd
            • Size 247KB
            • SHA256 c70f05f6bc564fe400527b30c29461e9642fb973f66eec719d282d3d0b402f93
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\_hashlib.pyd
            • Size 63KB
            • SHA256 241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\_lzma.pyd
            • Size 155KB
            • SHA256 f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\_queue.pyd
            • Size 31KB
            • SHA256 ac177cd84c12e03e3a68bca30290bc0b8f173eee518ef1fa6a9dce3a3e755a93
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\_socket.pyd
            • Size 77KB
            • SHA256 eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _sqlite3.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\_sqlite3.pyd
            • Size 117KB
            • SHA256 1d4e17237a10b68d16634fc9698edf342b40478d92fa15d574d212c7a44b05bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\_ssl.pyd
            • Size 157KB
            • SHA256 680ad2de8a6cff927822c1d7dd22112a3e8a824e82a7958ee409a7b9ce45ec70
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\base_library.zip
            • Size 1.4MB
            • SHA256 34a489e119ed6f40f4573ad3820ca32707e771490f02027ee357b2a48c1bd116
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ascii.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\ascii.cp311-win_amd64.pyd
            • Size 10KB
            • SHA256 c453c98eccff641cf36e4180ff0de4ff9fd56646391b5e7ca39b18a03863eff5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ascii__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\ascii__mypyc.cp311-win_amd64.pyd
            • Size 33KB
            • SHA256 f8a988f557deecfdd984a391106b2c514b20b2b15b7774fa9dfc94082afb52aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            escape__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\escape__mypyc.cp311-win_amd64.pyd
            • Size 61KB
            • SHA256 2ab3482fa17db4bd8d4ca8ec9485c6da6d760e4a4acb52742dd92067c1b201ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            language__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\language__mypyc.cp311-win_amd64.pyd
            • Size 44KB
            • SHA256 211e963a123ea336a3a7de83a893efb6199945216fc9807cb7225c87b77d9412
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            magic__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\magic__mypyc.cp311-win_amd64.pyd
            • Size 59KB
            • SHA256 c020d17801fcf858ab8b37b06b5624a35bbf53c0d330b0365b827bde3aaa9ca3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            orchestrator.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\orchestrator.cp311-win_amd64.pyd
            • Size 10KB
            • SHA256 2d5742a79b35b7212b723a8ca039f8a392787b7ac60c1e40101f68041c514621
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            orchestrator__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\orchestrator__mypyc.cp311-win_amd64.pyd
            • Size 88KB
            • SHA256 2d3cea14bb7b602039c13f9c5b2cae20d910d68f1dac5943ef4547cbe87c1bca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            postprocess__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\postprocess__mypyc.cp311-win_amd64.pyd
            • Size 83KB
            • SHA256 899f4c7a14176cbb6c529da346bd3289042880981650eeb1d820296fe2610ba5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            statistical__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\statistical__mypyc.cp311-win_amd64.pyd
            • Size 84KB
            • SHA256 719ab6059fa79549d092494990373992ae188fd99e86bc3fd9c62c4c024c6933
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            structural__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\structural__mypyc.cp311-win_amd64.pyd
            • Size 80KB
            • SHA256 1ba0561dd97247fd822652e04bd2dcb8dd16b257873b89e75c32d3b9418e4e3f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            utf1632__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\utf1632__mypyc.cp311-win_amd64.pyd
            • Size 57KB
            • SHA256 94bb4d9e2728c8f69f5f59bbe04db9c653dcca1793eb1d7e36f3b450bcac2b26
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            utf8__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\utf8__mypyc.cp311-win_amd64.pyd
            • Size 38KB
            • SHA256 8a9640e554a92c96c965264ec85951e76cb5aa114f5c5cef9db4129abafa6138
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            validity__mypyc.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\chardet\pipeline\validity__mypyc.cp311-win_amd64.pyd
            • Size 33KB
            • SHA256 67a580dcadef98e07b76655538343eef112f6e29fef6674eb41a5f330a12f156
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\libssl-1_1.dll
            • Size 688KB
            • SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python311.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\python311.dll
            • Size 5.5MB
            • SHA256 c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pywintypes311.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\pywin32_system32\pywintypes311.dll
            • Size 132KB
            • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\select.pyd
            • Size 29KB
            • SHA256 13e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sqlite3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\sqlite3.dll
            • Size 1.4MB
            • SHA256 919572560c314e46b1dba56418bbb50e1620c0af328aec394eaff580c58f2fc5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\unicodedata.pyd
            • Size 1.1MB
            • SHA256 e36d14cf49ca2af44fae8f278e883341167bc380099dac803276a11e57c9cfa1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            win32crypt.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008102\win32\win32crypt.pyd
            • Size 122KB
            • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download