Analysis
- max time kernel
149s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 11:56
General
- Target 5af1d0a7f512f7b302980b119fa1870a1e274654180a71b3e87f50409c9ae34c.bin.exe
- Size 89KB
- Sample261110-n35tjsfb43
- SHA256 5af1d0a7f512f7b302980b119fa1870a1e274654180a71b3e87f50409c9ae34c
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5af1d0a7f512f7b302980b119fa1870a1e274654180a71b3e87f50409c9ae34c.bin.exe"C:\Users\Admin\AppData\Local\Temp\5af1d0a7f512f7b302980b119fa1870a1e274654180a71b3e87f50409c9ae34c.bin.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-sandbox --disable-gpu --disable-crash-reporter --disable-logging --no-first-run --no-default-browser-check --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abe_15e18176b48b4ef0a8af63f2f12a210d" about:blank2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\abe_15e18176b48b4ef0a8af63f2f12a210d /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\abe_15e18176b48b4ef0a8af63f2f12a210d\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\abe_15e18176b48b4ef0a8af63f2f12a210d --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff82293c728,0x7ff82293c734,0x7ff82293c7403⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
discord_info.txt
history.txt
passwords.json
norhook_data_Admin_d88827.zip
memory/5196-5-0x0000000003840000-0x0000000003890000-memory.dmp
memory/5196-54-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-7-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-8-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-9-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-0-0x0000000000FF0000-0x000000000100A000-memory.dmp
memory/5196-16-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-42-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-53-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-6-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-63-0x0000000001B50000-0x0000000001B62000-memory.dmp
memory/5196-4-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-3-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-2-0x0000000001AA0000-0x0000000001AAA000-memory.dmp
memory/5196-1-0x00007FF82140F000-0x00007FF821410000-memory.dmp
memory/5196-81-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-82-0x00007FF821280000-0x00007FF821C24000-memory.dmp
memory/5196-83-0x00007FF821280000-0x00007FF821C24000-memory.dmp