f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
Size 1.9MB
Sample261110-n58yzsxt7q
SHA256 f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748
MD5 b8bb71414f9e43f782d2ff16f7c22119
SHA1 35a58b316676c1a87d002b00468300969191fba8
SHA512 1d68be06a870ac0c7a8e6d108a12dc0426c3e8764eddc896e0bcdd2ffb582c8b5ccebb038505540c4e0c07a94fca9e861ea18b714033d7a01233fee4b037b9b7
SSDEEP 49152:X/LindvsJDce5zaObGY4NrQ1T0RkYTRwQ:X/enR4Dce5p0RkYTRwQ
TLSH
T185952943E1A718ECC9939774429BA337B731FC648939AF7B8654C6311D13ED06A2EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
Token: SeDebugPrivilege	1464	f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe

C:\Users\Admin\AppData\Local\Temp\f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe
"C:\Users\Admin\AppData\Local\Temp\f82e7de003c78492b0bf89cafb8319092a6da8355159679b8874b02a66cc1748.bin.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Web Data

Path C:\Users\Admin\AppData\Local\Temp\js_db_240715671\Web Data
Size 138KB
SHA256 ec501d01373480b8717bc6e4fd75222ee5d2fc71a231664839c0be2a605b38e9
MD5 4d95c510060b3b15ae17d388ac5b7a7b
SHA1 deb2987277acd5f1e7841d874fdb9a5ed930cf5b
SHA512 fcfa82f180e4cf754afacd43d609365b5fd2b444b543085e178efb26b2577c6f88eff00a0113f05d853fceef2b1f6c84901b8054a6e6bc508f4a4c1172aadf9a
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OoxeVumqynl:FnbZeMrv/hGtoxqnl
TLSH
T1FBD3884B3A747102EDE59A721CE050BB5E3C716D8F5595D428B620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\js_db_240715671\Web Data
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1464-23-0x00007FF72FFE0000-0x00007FF730149000-memory.dmp

Download