c3d315a8f46b2dc29a5cb12a5fbe6fa4340cf13fa720bf9d7f54470f7a29b182

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
taker.exe
Size 147KB
Sample261030-rtp9aacy6x
SHA256 c3d315a8f46b2dc29a5cb12a5fbe6fa4340cf13fa720bf9d7f54470f7a29b182
MD5 a271872ad7995de96628f3a2fc216774
SHA1 14998fc0da6d0c26509adb0a062468956964e8a6
SHA512 2f8b2fe35b7ac0ca161d040701541f2fa0411d2acb1f4bbf3eaf7b83d966bdde4edca3763c4974c92092edddb5559d15628e6faf2e3547d9ab63f7431dc6015f
SSDEEP 1536:k48GmEIcBVheKGbY6OUIVcLamYcbUIppCokSu30hH+70YQqI/i0:k48GXheKnOamY4pgos0V+709Z1
TLSH
T148E33A03DA95C0F6C46BE175CEDBA23AE172B44556B67A4BBB84CF232F50B34671C209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
6	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
4	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5132	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	taker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	taker.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5832	PING.EXE
5132	cmd.exe
5332	PING.EXE
5732	PING.EXE
3492	PING.EXE
2736	PING.EXE
2564	PING.EXE
4720	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4072	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taker.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
4720	PING.EXE
5832	PING.EXE
5332	PING.EXE
5732	PING.EXE
3492	PING.EXE
2736	PING.EXE
2564	PING.EXE

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe
912	taker.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	taker.exe
Token: SeDebugPrivilege	912	taker.exe
Token: SeBackupPrivilege	912	taker.exe
Token: SeDebugPrivilege	912	taker.exe
Token: SeDebugPrivilege	912	taker.exe
Token: SeDebugPrivilege	912	taker.exe
Token: SeDebugPrivilege	912	taker.exe
Token: SeDebugPrivilege	912	taker.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4072	912	taker.exe	90
PID 912 wrote to memory of 5132	912	taker.exe	92
PID 5132 wrote to memory of 5332	5132	cmd.exe	94
PID 5132 wrote to memory of 5732	5132	cmd.exe	95
PID 5132 wrote to memory of 3492	5132	cmd.exe	96
PID 5132 wrote to memory of 2736	5132	cmd.exe	97
PID 5132 wrote to memory of 2564	5132	cmd.exe	98
PID 5132 wrote to memory of 4720	5132	cmd.exe	99
PID 5132 wrote to memory of 5832	5132	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\taker.exe
"C:\Users\Admin\AppData\Local\Temp\taker.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 127.0.0.1 -n 16 > nul & for /l %i in (1,1,6) do (del /f /q "C:\Users\Admin\AppData\Local\Temp\taker.exe" 2>nul & ping 127.0.0.1 -n 2 > nul)
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 16
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5332
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5732
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3492
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2736
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2564
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4720
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rat.log

Path C:\Users\Admin\AppData\Local\Temp\rat.log
Size 110B
SHA256 6ef789c7385bebcafbcce816f5e82630313565a2367d38df6ad6d31d13945135
MD5 4d09f49998dde712979a028a87b79fe9
SHA1 6337939b0733b11c3ed262e2714f30e02da85d01
SHA512 069ea12d3b706bc3d614469210379ea51d90ef39539901560e514b83b7e35bccbec7a217a3486cb407c155a8b48459d909e65acd386a227010e945676ab29a1a
TLSH
T1AFB0920CE8EC0C3E2C804D8469592308F3C0282E070440305C09F5E00E1BD00E0040A2
MD5 SHA1 SHA512 TLSH

Submit Download

rat.log

Path C:\Users\Admin\AppData\Local\Temp\rat.log
Size 301B
SHA256 d1b708c07dbd5ce5ef8a8de7a2c90bbf5e3f2f21a0eb76739953c05d0b7ff12e
MD5 c2068e0788feec69065b4b41bcae0461
SHA1 13fadb06461d9b5f29c377ac4e524440054afefb
SHA512 5656c77051c36695209dc742b584f96e3d138038aa42dc5485d37d48781b9e9fc79c46a15226f13d7bf699299c4971cf868ae14d7a70f213aec7ecf4841f8933
TLSH
T1F5E0421DB9EC4D3E69814C48AE6C7719F2E46E2E52499439AC0CF5A40FABE46F448063
MD5 SHA1 SHA512 TLSH

Submit Download

rat.log

Path C:\Users\Admin\AppData\Local\Temp\rat.log
Size 434B
SHA256 578d2ca12673b93b6bd1f25aa165b95c2ed54b9fb4e5cdbbda0cbe31f9db60fb
MD5 cfe07940211aa42b77f08d3d3785853b
SHA1 601113bcc5d516b8336529482af86578834a2570
SHA512 147d32d66cdc916900e34b25fa1340d130eb33446ee68807ba0225333d8f51efd737b9ea5f7ca686e0b18ec81e46547a404845e2a5645a4ba38ed84882d446b9
TLSH
T186E06D1CB9DC4D3D29804C58EABC3319F3D42A2E4205A438AD0CF4680E6BE06F508273
MD5 SHA1 SHA512 TLSH

Submit Download

rat.log

Path C:\Users\Admin\AppData\Local\Temp\rat.log
Size 848B
SHA256 ff0f4d2de7bb8629241832ba8c19ad58a8384155c9ddc26e63f5f43c789ed250
MD5 6b0f15e614888dad3ed80c135dc4e62b
SHA1 c5171d7238393080fd60d7c0f0e0e12a7de09797
SHA512 526791031d6a3e1b0812cead4b37d9abd65fa5f8962463d198e9632c0908d8d6d28ed50b661183ca660bb482a960178ea548adae6c5cd037cbf227159ca7f490
TLSH
T193016B1C9B9C8D3C19E8AD84A8BC736DF3E406180A8AB4689D08FC784E9AE42B505217
MD5 SHA1 SHA512 TLSH

Submit Download

rat.log

Path C:\Users\Admin\AppData\Local\Temp\rat.log
Size 1KB
SHA256 00df68ffe868f55b7a568eea294f6433c504526d5e08ec3f400af02ad8e08e4d
MD5 ef04a5ae9ff523d1d6454c450968b7cd
SHA1 fd1f4b0981d91964725e506a79333dbda8f8962d
SHA512 72803a1aa54baf3e97e5883fae397d4c2f5880cc9986da886cdb523a311c6f6eef553e1e6f17e4ae60615a5dcfa81af68f41ce259d4ca9c4579664c5478218d9
TLSH
T184215E2C5A9C8C7C59D99DC4A8BC73ADF6E406080AC664699D08FC7D4E9AF82B502617
MD5 SHA1 SHA512 TLSH

Submit Download

ratdb240712703_History

Path C:\Users\Admin\AppData\Local\Temp\ratdb240712703_History
Size 224KB
SHA256 faad576265b7aa771efac6fe497f858970e447816045a553ae37750eff157d39
MD5 1f018c800525ec31c392407bb8f1014a
SHA1 8deaef41ee4453bb7a571d930cc62b25f1720567
SHA512 4ad0ecb095a1490d0d4e373a8b23457c89f1db0a5c9631f29e54385f71f5166ab7f24e925f1190ccb47b44bf8a310ace13035608b1ce274d8136c0e2ebd21d44
SSDEEP 96:bCjFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:bJH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T18A24EF0E5F343722CDBD913669E644A35C7CF03F8B5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ratdb240712703_History

Path C:\Users\Admin\AppData\Local\Temp\ratdb240712703_History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-0-0x00007FF937920000-0x00007FF937B83000-memory.dmp

Download

memory/912-85-0x00007FF6CD410000-0x00007FF6CD438000-memory.dmp

Download