859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe
Size 679KB
Sample261110-p25b3afe52
SHA256 859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294
MD5 3ffe9b94fdd07511c2c8a92d0bf2e8cf
SHA1 baf3f0291da842279570946f8850ca538cfbf52d
SHA512 205c53a2b93597426607008038afd3dc6b1d2a9f477673f5330cd8bdb4a5ffb4c5cd55e9c27d25cd6a49bf2fd12ce763a58f58ea53b62b1e81c23775bbf36b34
SSDEEP 12288:O+tw67SW+Z1acIVFUvW6T/pVfwfzBchoD+r1676Y1GkB2vSVQTkU8rF6H8KXDyP3:F7STZ1aLVK1/pVfw7Bcnr19Y1wTJHnD6
TLSH
T1D2E43B36DB5C017DD1B6C1BA8E0B5813E6B238491331BAEB57C11E631E1F6A4A77AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4868	powershell.exe
4868	powershell.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
7	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe
1792	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe
1792	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeIncreaseQuotaPrivilege	4868	powershell.exe
Token: SeSecurityPrivilege	4868	powershell.exe
Token: SeTakeOwnershipPrivilege	4868	powershell.exe
Token: SeLoadDriverPrivilege	4868	powershell.exe
Token: SeSystemProfilePrivilege	4868	powershell.exe
Token: SeSystemtimePrivilege	4868	powershell.exe
Token: SeProfSingleProcessPrivilege	4868	powershell.exe
Token: SeIncBasePriorityPrivilege	4868	powershell.exe
Token: SeCreatePagefilePrivilege	4868	powershell.exe
Token: SeBackupPrivilege	4868	powershell.exe
Token: SeRestorePrivilege	4868	powershell.exe
Token: SeShutdownPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeSystemEnvironmentPrivilege	4868	powershell.exe
Token: SeRemoteShutdownPrivilege	4868	powershell.exe
Token: SeUndockPrivilege	4868	powershell.exe
Token: SeManageVolumePrivilege	4868	powershell.exe
Token: 33	4868	powershell.exe
Token: 34	4868	powershell.exe
Token: 35	4868	powershell.exe
Token: 36	4868	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 4868	1792	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe	89
PID 1792 wrote to memory of 1404	1792	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe	92
PID 1792 wrote to memory of 1404	1792	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe	92
PID 1792 wrote to memory of 1404	1792	859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe	92

C:\Users\Admin\AppData\Local\Temp\859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe
"C:\Users\Admin\AppData\Local\Temp\859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe', 'C:\Users\Admin\AppData\Local\Temp\~tmp_240742906_1792') -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_1oidng1t.xwx.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1oidng1t.xwx.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cs_db_10548846068975756736.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_10548846068975756736.tmp
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs_db_15260620753309077113.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_15260620753309077113.tmp
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs_db_16796048587069100431.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_16796048587069100431.tmp
Size 138KB
SHA256 62a1153ee3b7629593315af19174502c354d12ebf135f23092bc3ea60ca5c760
MD5 789745d4caa7cbb8f4dd71c84524bb9c
SHA1 264c845524bbb785ea8bddb9866c64eaafd29cd1
SHA512 4179b37bad69abf93786fe722b9fa081d24b610fcedef03f7e176dadf2c5e54b2c215a1efcd63254063cf723356ce5b55d676052263a9fd77253994ca4fdf417
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OQm9iVumNUn5D:FnbZeMrv/hGtvmUnh
TLSH
T1C0D3774B3A743102EDE59A721CE051BB5D3CB17D4F16A5D428B620588EF2963B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs_db_3496240480720196340.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_3496240480720196340.tmp
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs_db_5153165309752151871.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_5153165309752151871.tmp
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs_db_7365502073040638647.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_7365502073040638647.tmp
Size 5.0MB
SHA256 a670e7842c3e03cec3b32bee75c54c976b0dc8cbad3b602c628406a7096fad2a
MD5 df87a96caf21c681e9f3ed12f44ba207
SHA1 2f6a48923cf96630500a011fc11bc3fcd54e43f9
SHA512 18a742752072bd0f1386dc969a51e7700a6f166540377b7aac3501adc14b4cd9fff21a56f17a5db401dad470f14f1873b1129d6e9d21318a602a57d8366a65f1
SSDEEP 192:M8rJQaXoMXp0VW9FxWHg9isEhy++Mkzx8Zm:M8r54w0VW3xWA9icx
TLSH
T17236100F3A205198C4EAA172ECE39F152C3F70168A3676933D94556D4ED0B27B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs_db_7505069315119046637.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_7505069315119046637.tmp
Size 224KB
SHA256 1ba935b83104faba63785781dd06f1fb405f5f6c205dd557a94f50a87e9a6b0d
MD5 cc0b01b6e40c08b0732d098947ad2dc7
SHA1 1dd6b8b636d6f6592ebb8f74496271b507609de8
SHA512 4ed4e560bf01dcf12b20c264851b941bcabf443db80f139e5ec4fe45d73798e8e3a64961f9209e861b2f4fb7c8b6976a1618f4076d14929cea3b48a2def94187
SSDEEP 96:bnjFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:b2H+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T10624EF4E5F343722CDBD913668E644A35C7CF03F8B5366DA686114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autofills.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240742906_1792\Autofills\Autofills.txt
Size 698B
SHA256 46044a3b0cbc73f2f763418a208cf20b45ef425033ff680219284d21c29120d4
MD5 a9eb1f5b660aa4491fe6abe97352eb08
SHA1 f2f3d599ec5dfcbb91d335acae9c69935fa2997d
SHA512 c8da117a01fedf05b7cd3684192ae7f70c838b5f3df9c4db26cac238b45871b14cac9aa1668104d6a040f11df0f28fb23c9e9808b5e60e451aa11baf6d5a7348
MD5 SHA1 SHA512

Submit Download

Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240742906_1792\Browsers\Chrome\Cookies.txt
Size 118B
SHA256 ec5b0bcc95d398ee21aba31d122488d0acfd21b586b1ea7ccd1810d48074d4e2
MD5 92386d358d471831b9ecb02f02d730db
SHA1 cff183f33d1faa98ff3865e4cd1fedc80a2e3037
SHA512 c1a6a76177e633622cdb94f946d628339ea2077c6468c599fa4e04fb6362c1ce74bb8be4dd9a4c98784950df738e0af6715996618d630bea9bdfe26fa5b787d0
TLSH
T1CBB0922E108692A902A88982B341567893498C8C53E89AA2A025A92AE19C58568E869B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4868-12-0x000001774ECC0000-0x000001774ED72000-memory.dmp

Download

memory/4868-24-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-15-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-16-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-17-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-18-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-19-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-20-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-21-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-22-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-23-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-14-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-26-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-13-0x000001774ED80000-0x000001774ED8A000-memory.dmp

Download

memory/4868-8-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-0-0x00007FFB5C5AF000-0x00007FFB5C5B0000-memory.dmp

Download

memory/4868-11-0x000001774ECA0000-0x000001774ECBE000-memory.dmp

Download

memory/4868-7-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-6-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-2-0x000001774EC10000-0x000001774EC32000-memory.dmp

Download

memory/4868-3-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download

memory/4868-1-0x00007FFB5C420000-0x00007FFB5CDC4000-memory.dmp

Download