e064039df646c7f3215c3d972a330ad718c4b00bc13271c1ac9d2035c8a4429e

Analysis

user interaction
yes
max time kernel
48s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
javaw.exe
Size 74.1MB
Sample261107-thg5msztex
SHA256 e064039df646c7f3215c3d972a330ad718c4b00bc13271c1ac9d2035c8a4429e
MD5 c9140f98f722c69dea8520f539776330
SHA1 0720ed8fa7c82915b0bfc36790a1502485d0c534
SHA512 7d634951e93e4fb704da8c65b98e43a6d099d1c4532757ac803ca3c4abd72981e6687d91bc24aeab561337e1301318d8d6f55387e64f74ea36341e4a7bff524d
SSDEEP 1572864:EZjcgkquMTNq19N1111111111g11111111111111111111111111111111111tJr:EZjcOzV6MOej1Jpl
TLSH
T16908DF1663E111AAD577D138CBAB6203EB72B40713308BDF329C47652F63AE45D7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1004	javaw.exe
1004	javaw.exe
1004	javaw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	javaw.exe

C:\Users\Admin\AppData\Local\Temp\javaw.exe
"C:\Users\Admin\AppData\Local\Temp\javaw.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:1004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@primno+dpapi.node

Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
Size 134KB
SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
MD5 5dc8861862329b3b4122314922be3ed9
SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
TLSH
T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\.cache\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\win32_x64\koffi.node
Size 2.3MB
SHA256 c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b
MD5 4b9ef9f01142f8b1e8f2c0dad39d6aac
SHA1 1f84d3689ffdaaf4b266981b2b45f63ae6c31d77
SHA512 a02191df9e9fc4ef3e18326b8a7fbe9f349a5012db313875ae9af1980525caca99d42456ddc8bfb9311133c17c26816323d605f608f217f6a8c316a3bb4c83cf
SSDEEP 24576:5owViD0+R6GQ/s1k5l0IUNSlPBob4TIFE6zLxIbuzekuyU3K4x+KP2JQVpJtPdgY:5TV+zeTyUa4TP2JQVpJsJ8v
TLSH
T1D2B5DE064758C8E9D83EB022B4177776E56A221B083D52DF04F58D61082ABFD5EAFFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node_sqlite3.node

Path C:\Users\Admin\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
TLSH
T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads