Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 08:47
General
- Target 7ea63f0a9c27e5b8d51a06133028c29a8616b32ad8ffa6fc5a524090b99988c1.exe
- Size 4.5MB
- Sample261102-kpv6eaef26
- SHA256 7ea63f0a9c27e5b8d51a06133028c29a8616b32ad8ffa6fc5a524090b99988c1
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ea63f0a9c27e5b8d51a06133028c29a8616b32ad8ffa6fc5a524090b99988c1.exe"C:\Users\Admin\AppData\Local\Temp\7ea63f0a9c27e5b8d51a06133028c29a8616b32ad8ffa6fc5a524090b99988c1.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Windows Defender\3cc1b69100720fbd\ZillberReleyHost.exe"C:\ProgramData\Windows Defender\3cc1b69100720fbd\ZillberReleyHost.exe" /c1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Windows Defender\3cc1b69100720fbd\ZillberReleyHost.exe"C:\ProgramData\Windows Defender\3cc1b69100720fbd\ZillberReleyHost.exe" --monitor 4428 /c2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ZillberReleyHost.exe
memory/4428-1540-0x00000000063D0000-0x00000000063E0000-memory.dmp
memory/4428-1541-0x0000000006260000-0x00000000062D4000-memory.dmp
memory/4428-1542-0x00000000063D0000-0x00000000063E0000-memory.dmp
memory/4428-1543-0x00000000063D0000-0x00000000063E0000-memory.dmp
memory/4428-1544-0x0000000001AA0000-0x0000000001ABE000-memory.dmp
memory/4428-1545-0x0000000006340000-0x0000000006376000-memory.dmp
memory/4428-1546-0x0000000001AC0000-0x0000000001ACC000-memory.dmp
memory/4428-1547-0x0000000006940000-0x00000000069A6000-memory.dmp
memory/4428-1548-0x00000000063D0000-0x00000000063E0000-memory.dmp
memory/4428-1551-0x0000000007120000-0x00000000071B2000-memory.dmp
memory/4428-1552-0x0000000007770000-0x0000000007D14000-memory.dmp
memory/4428-1553-0x0000000008710000-0x0000000008812000-memory.dmp
memory/4428-1571-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1607-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1605-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1623-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1671-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1673-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1669-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1667-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1665-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1663-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1661-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1659-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1657-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1655-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1653-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1651-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1649-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1647-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1645-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1643-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1641-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1639-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1637-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1635-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1633-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1631-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1629-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1627-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1625-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1621-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1619-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1617-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1615-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1613-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1611-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1609-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1604-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1601-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1599-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1597-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1595-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1593-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1589-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1587-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1585-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1591-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1584-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1581-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1579-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1577-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1575-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1573-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1569-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1567-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1565-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1563-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1561-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1559-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1557-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1555-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1554-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1675-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1679-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-1677-0x0000000008710000-0x000000000880D000-memory.dmp
memory/4428-4688-0x00000000095F0000-0x0000000009C08000-memory.dmp
memory/4428-4689-0x0000000001620000-0x000000000162A000-memory.dmp