Analysis
- max time kernel
151s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 20:03
General
- Target stealer.exe
- Size 17.1MB
- Sample261029-ys13qaev7x
- SHA256 84dece07b5c85477f15e44d854312c9f0a6780ba64131d706ec444c56d6c7e83
Malware Config
Signatures
- Loads dropped DLL 28 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\stealer.exe"C:\Users\Admin\AppData\Local\Temp\stealer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\stealer.exe"C:\Users\Admin\AppData\Local\Temp\stealer.exe"2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\whoami.exewhoami /user /fo csv /nh3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "$u = [ADSI]('WinNT://' + $env:COMPUTERNAME + '/' + $env:USERNAME + ',user');Write-Output ($u.FullName);Write-Output ($u.EmailAddress);"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_aes.pyd
_raw_aesni.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_brotli.cp312-win_amd64.pyd
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
base_library.zip
cacert.pem
md.cp312-win_amd64.pyd
md__mypyc.cp312-win_amd64.pyd
top_level.txt
top_level.txt
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.dll
python312.dll
select.pyd
top_level.txt
Lorem ipsum.txt
sqlite3.dll
ucrtbase.dll
unicodedata.pyd
c7b8ad7e489941c2a416ea15bf0b0136.sqlite
ef0ee834fe8f4300b1e5b2d547662fb8.sqlite
memory/5060-203-0x0000020265560000-0x0000020265582000-memory.dmp
memory/5060-207-0x00007FF9200D0000-0x00007FF920A74000-memory.dmp
memory/5060-208-0x00007FF9200D0000-0x00007FF920A74000-memory.dmp
memory/5060-209-0x00007FF9200D0000-0x00007FF920A74000-memory.dmp
memory/5060-210-0x00007FF9200D0000-0x00007FF920A74000-memory.dmp
memory/5060-212-0x00007FF9200D0000-0x00007FF920A74000-memory.dmp
memory/5060-206-0x00007FF9200D0000-0x00007FF920A74000-memory.dmp
memory/5060-205-0x00007FF9200D0000-0x00007FF920A74000-memory.dmp
memory/5060-204-0x00007FF9200D0000-0x00007FF920A74000-memory.dmp
memory/5060-202-0x00007FF9200D0000-0x00007FF920A74000-memory.dmp
memory/5060-199-0x00007FF92025F000-0x00007FF920260000-memory.dmp