7c6a00f7bdd2ce7704bb6e923ec6d6ff76f10e66903c5b5c015df9bc7060113d

Analysis

user interaction
yes
max time kernel
60s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stealer_obf.exe
Size 24.7MB
Sample261107-mcp5qsct5m
SHA256 7c6a00f7bdd2ce7704bb6e923ec6d6ff76f10e66903c5b5c015df9bc7060113d
MD5 78de65411bb4f76383b60d6c433bfd25
SHA1 4e17fc0ae7c7bac5409227960226a4465c4b8e05
SHA512 2fddd3f885fbcdc9e9ff1860862a690b1a2b131f567bf7f80db9528f8c038604290adfaf3e48b460f372b044ed19d46c968d271dea2da968e0d93d859c77f34a
SSDEEP 393216:Ko7WDarSbLtvn9Ca/4tCi1CPwDvt3uFhCu1SVlfJVojB:xCDarmd
TLSH
T1A6476C0277B441A5F466E17888234207E371BC19A721A3DB35AAF62E1F377D18B7D788
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
3852	stealer_obf.exe
3852	stealer_obf.exe
3852	stealer_obf.exe
3852	stealer_obf.exe
3852	stealer_obf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	stealer_obf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	stealer_obf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	stealer_obf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	stealer_obf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	stealer_obf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	stealer_obf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3852	1484	stealer_obf.exe	90

C:\Users\Admin\AppData\Local\Temp\stealer_obf.exe
"C:\Users\Admin\AppData\Local\Temp\stealer_obf.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\stealer_obf.exe
  C:\Users\Admin\AppData\Local\Temp\stealer_obf.exe
  2⤵
  - Loads dropped DLL
  PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1484_312802_ADpXY_O5WWc\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1484_312802_ADpXY_O5WWc\_sqlite3.pyd
Size 121KB
SHA256 ff25bdbeef34d2aa420a79d3666c2660e7e3e96259d1f450f1af5268553380ec
MD5 cee93c920951c1169b615cb6330cedda
SHA1 ef2abf9f760db2de0bd92afe8766a0b798cf8167
SHA512 999d324448bb39793e4807432c697f01f8922b0aba4519a21d5dc4f4fc8e9e4737d7e104b205b931af753eda65f61d0c744f12be84446f9c6cb3c2a5b35b773c
SSDEEP 3072:fZIPlR6TxhNO7/9CO4w5yIFGcXcpVNIGOQyl:RjFHO7kC56cXuo
TLSH
T140C34A67635400AAE9F751B9C4630A17DB75F822537083DF4290C68A1F337C7AE3AB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1484_312802_ADpXY_O5WWc\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
TLSH
T1C3667C26B758D0A9C9669074CC23C2DAE7717C51BF10530F30EAB31E2F7779256AA788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1484_312802_ADpXY_O5WWc\sqlite3.dll
Size 1.4MB
SHA256 8aa8b909a39fcc33d1ec2ad51eac6714a318c6efd04f963d21b75d8f64809ad6
MD5 82ea0259009ff75bba817bd8c15c7588
SHA1 04c49687d8241b43ae61a6c59299255ef09a7b39
SHA512 1f8b3343898462e385d25e1820a3d7d971d633933e482ea9ffc596e7e1f902f5657a9f2c104cf320eeef34cce814261304e2e1c063be4c6a807adc9b75f3e670
SSDEEP 24576:95WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lY8ore60hH:9b0yVKMyjWR6nofQm7U59HWKYY8
TLSH
T12D658D4BB2B800ADC0ABD179C61B571BEBB2740517709BDB55D4CA692F13FE216BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_obf.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1484_312802_ADpXY_O5WWc\stealer_obf.dll
Size 9.3MB
SHA256 58e90e02049a1377030e369bcc00ee879cb6feaf44ed76a4c7d7211450df3fbc
MD5 037b1cbd34b63bffe3ba6163d61dab89
SHA1 e739144f5d1c8789b488a62b6530b3c0691cf24a
SHA512 4922f10570963e2aec3f0b77643268c11e067624f12e9dac38dfeffebd02f4c9d0b307251b9f563c9eef1591edc4e377abd431dfdd7aafe851f33d8baea41f92
SSDEEP 98304:qLGPoe6r/VOVVDaAy5QOhQ/wOOlq+lp6KgGlH95:lo77VOVVDazd
TLSH
T1F8A6174227B492A2F845F2BD44220607D231B42CF716B3A73ABEC52E6F46751CB697DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads