Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 17:15
General
- Target AppDate.exe
- Size 52KB
- Sample261107-vsrmhazs5k
- SHA256 c1557220a43c889d139abdf694e892f63ac348c8e4b8b1af9d02263cd7ddaac0
Malware Config
Signatures
- Executes a file named after a Windows system binary 1 TTPs 1 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AppDate.exe"C:\Users\Admin\AppData\Local\Temp\AppDate.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Masquerading
1Match Legitimate Name or Location
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
_done.txt
_start.txt
autofill.txt
betterdiscord.txt
cookies.txt
credentials.txt
credit_cards.txt
crypto.txt
documents.txt
downloads.txt
filezilla.txt
hardware.txt
history.txt
ip.txt
minecraft.txt
outlook.txt
passwords.txt
product_key.txt
roblox_cookie.txt
steam.txt
telegram.txt
tokens.txt
svchost.exe
memory/3856-14-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/3856-41-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/3856-34-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/3856-89-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/3856-15-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/3856-16-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/3856-85-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/3856-35-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/3856-42-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/3856-81-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/5956-7-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/5956-8-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/5956-22-0x000000001BD30000-0x000000001BD80000-memory.dmp
memory/5956-4-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/5956-5-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/5956-1-0x00007FFDCD7AF000-0x00007FFDCD7B0000-memory.dmp
memory/5956-3-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/5956-9-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/5956-10-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/5956-0-0x0000000000210000-0x0000000000224000-memory.dmp
memory/5956-92-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp