Analysis
- user interaction
yes - max time kernel
103s - max time network
66s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-es - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe
Resource
win10v2004-20260911-es
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe
- Size 3.0MB
- Sample261110-e85lasyzfz
- SHA256 ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1
- MD5 7bcfefeb53a07032cd85fd8cd6ab0601
- SHA1 a8a7056052c6dc55e38d837623bc1f7ca439fae8
- SHA512 689091938a5bf5e5e91087133ce926e4baaee1ca210f4d2a6c90fd30e5f0701f40b2165cdb533bee1de5e26d89fffa75e1dbd5df1a5892b60ee1b3aaf06cd73d
- SSDEEP 98304:K0dx4+gamVGkg49/cPELfdyVkKVj+X6NodO4v3C:K0QX/ctVfZ+XSkJv3
- TLSH T1CAE5330CA4A79DFECA2A06B846BBAC77804EFE076CD4CC7A4D205A5CFF45D155CA9C90
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: NWHStealer
NWHStealer is a Windows infostealer written in Rust.
- Detects NWHStealer 5 IoCs
resource yara_rule behavioral2/memory/3608-0-0x000001A444CF0000-0x000001A444F78000-memory.dmp family_nwhstealer behavioral2/memory/3608-7-0x000001A444CF0000-0x000001A444F78000-memory.dmp family_nwhstealer behavioral2/memory/3608-9-0x000001A444CF0000-0x000001A444F78000-memory.dmp family_nwhstealer behavioral2/memory/3608-6-0x000001A444CF0000-0x000001A444F78000-memory.dmp family_nwhstealer behavioral2/memory/3608-8-0x000001A444CF0000-0x000001A444F78000-memory.dmp family_nwhstealer - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3608 ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe 5868 chrome.exe 5868 chrome.exe 4592 msedge.exe 4592 msedge.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 6120 taskmgr.exe Token: SeSystemProfilePrivilege 6120 taskmgr.exe Token: SeCreateGlobalPrivilege 6120 taskmgr.exe - Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe 6120 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 6120 taskmgr.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3608 wrote to memory of 5476 3608 ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe 88 PID 3608 wrote to memory of 5476 3608 ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe 88 PID 3608 wrote to memory of 5868 3608 ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe 89 PID 3608 wrote to memory of 5868 3608 ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe 89 PID 3608 wrote to memory of 4592 3608 ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe 90 PID 3608 wrote to memory of 4592 3608 ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe"C:\Users\Admin\AppData\Local\Temp\ec7977cc97003f2a34b13edebfc7db888fc22c4dde96b7bccca1ddbd2e191ac1.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito2⤵PID:5476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4592
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3492
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3908
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2660
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1712
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3