Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 08:47
General
- Target 7ea63f0a9c27e5b8d51a06133028c29a8616b32ad8ffa6fc5a524090b99988c1.exe
- Size 4.5MB
- Sample261102-kpv6eaef26
- SHA256 7ea63f0a9c27e5b8d51a06133028c29a8616b32ad8ffa6fc5a524090b99988c1
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ea63f0a9c27e5b8d51a06133028c29a8616b32ad8ffa6fc5a524090b99988c1.exe"C:\Users\Admin\AppData\Local\Temp\7ea63f0a9c27e5b8d51a06133028c29a8616b32ad8ffa6fc5a524090b99988c1.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Windows Defender\3cc1b69100720fbd\ZillberReleyHost.exe"C:\ProgramData\Windows Defender\3cc1b69100720fbd\ZillberReleyHost.exe" /c1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Windows Defender\3cc1b69100720fbd\ZillberReleyHost.exe"C:\ProgramData\Windows Defender\3cc1b69100720fbd\ZillberReleyHost.exe" --monitor 4608 /c2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ZillberReleyHost.exe
memory/4608-1538-0x00000000730B2000-0x00000000730B3000-memory.dmp
memory/4608-1539-0x0000000006B20000-0x0000000006B94000-memory.dmp
memory/4608-1540-0x00000000730A0000-0x000000007385C000-memory.dmp
memory/4608-1541-0x00000000730A0000-0x000000007385C000-memory.dmp
memory/4608-1542-0x00000000730A0000-0x000000007385C000-memory.dmp
memory/4608-1543-0x00000000730A0000-0x000000007385C000-memory.dmp
memory/4608-1544-0x0000000006AE0000-0x0000000006AFE000-memory.dmp
memory/4608-1545-0x0000000006D00000-0x0000000006D36000-memory.dmp
memory/4608-1546-0x0000000006FC0000-0x0000000006FCC000-memory.dmp
memory/4608-1547-0x00000000073C0000-0x0000000007426000-memory.dmp
memory/4608-1548-0x00000000730B2000-0x00000000730B3000-memory.dmp
memory/4608-1549-0x00000000730A0000-0x000000007385C000-memory.dmp
memory/4608-1552-0x00000000730A0000-0x000000007385C000-memory.dmp
memory/4608-1553-0x00000000079F0000-0x0000000007A82000-memory.dmp
memory/4608-1554-0x0000000008050000-0x000000000860A000-memory.dmp
memory/4608-1555-0x00000000730A0000-0x000000007385C000-memory.dmp
memory/4608-1556-0x0000000008610000-0x0000000008712000-memory.dmp
memory/4608-1561-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1570-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1572-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1574-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1567-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1568-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1564-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1562-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1559-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1557-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1579-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1588-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1587-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1598-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1596-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1600-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1594-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1593-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1591-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1582-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1584-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1581-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1576-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1604-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1606-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1602-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1618-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1620-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1628-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1639-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1650-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1664-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1676-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1674-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1672-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1682-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1680-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1679-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1670-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1658-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1669-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1666-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1663-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1661-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1657-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1654-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1653-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1648-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1647-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1644-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1642-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1640-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1637-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1632-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1622-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1610-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1634-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1631-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1627-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1624-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1616-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1615-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1612-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-1608-0x0000000008610000-0x000000000870D000-memory.dmp
memory/4608-4691-0x0000000008E40000-0x0000000009458000-memory.dmp
memory/4608-4692-0x0000000007C80000-0x0000000007C8A000-memory.dmp