6e284821f90aa0419cf4638a2b77d6bfd40cc19bf6bf6e5e4ffb5c30864f6a3c

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e284821f90aa0419cf4638a2b77d6bfd40cc19bf6bf6e5e4ffb5c30864f6a3c.exe
Size 83KB
Sample261107-rssm1syyf1
SHA256 6e284821f90aa0419cf4638a2b77d6bfd40cc19bf6bf6e5e4ffb5c30864f6a3c
MD5 c1f6ca3f6c9dd02df142f6b0af0b5074
SHA1 7d7f311fbacb42dd046ced232af9f219eb510248
SHA512 f29e0482d9f348aea61b7eb685de88f9003c7ed43628e59a146ab05f5c4406654b16a9f263fb1be71ee709f4a9167beef6a39e2547f651d548a9dd5f71cbd66d
SSDEEP 1536:AjzHiIO3SdZbx9TjGO4YHzvnfVfro0xUR6s+ygLah:IzHnrddjTjGncVjo0xLs+yzh
TLSH
T17F834A48B7DC5F12D5BE0E79647160850BB5F12A9A53EB0F1DC950BA2E23BC08791BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4884	6e284821f90aa0419cf4638a2b77d6bfd40cc19bf6bf6e5e4ffb5c30864f6a3c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	6e284821f90aa0419cf4638a2b77d6bfd40cc19bf6bf6e5e4ffb5c30864f6a3c.exe

C:\Users\Admin\AppData\Local\Temp\6e284821f90aa0419cf4638a2b77d6bfd40cc19bf6bf6e5e4ffb5c30864f6a3c.exe
"C:\Users\Admin\AppData\Local\Temp\6e284821f90aa0419cf4638a2b77d6bfd40cc19bf6bf6e5e4ffb5c30864f6a3c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4884-0-0x00007FF83E70F000-0x00007FF83E710000-memory.dmp

Download

memory/4884-1-0x0000000000170000-0x000000000018A000-memory.dmp

Download

memory/4884-2-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp

Download

memory/4884-6-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp

Download

memory/4884-7-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp

Download