Analysis
- max time kernel
150s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 12:50
General
- Target 09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c.exe
- Size 1.6MB
- Sample261110-p26vwsfe53
- SHA256 09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Custom signatureDetect suspicious telegram bot 4 IoCs
Detect suspicious telegram bot.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c.exe"C:\Users\Admin\AppData\Local\Temp\09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "WindowsSecurityService" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost_ws.exe" /sc onlogon /rl highest /f >nul 2>&12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\0DD25F85-EBMSDFDP_2026_11_10T12_50_46\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\[GB]85.203.46.129_0DD25F85-EBMSDFDP.zip' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost_ws.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost_ws.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Cookies.txt
cert9.db
cookies.sqlite
key4.db
places.sqlite
BackupHide.docx
EnableGroup.xlsx
SubmitDeny.xlsx
BlockMeasure.docx
ExportImport.xlsx
FormatGet.docm
GrantUnblock.xlsx
MeasureGroup.txt
NewExport.xlsb
RepairResume.docx
ResumeSave.docx
RevokeMove.docx
Processes.txt
UserInfo.txt
[GB]85.203.46.129_0DD25F85-EBMSDFDP.zip
__PSScriptPolicyTest_2j0lcxja.0su.ps1
svchost_ws.exe
memory/1844-108-0x00007FF7D3BD0000-0x00007FF7D3D69000-memory.dmp
memory/1844-118-0x00007FF7D3BD0000-0x00007FF7D3D69000-memory.dmp
memory/2156-3-0x00007FF649450000-0x00007FF6495E9000-memory.dmp
memory/5092-67-0x000001F027970000-0x000001F027A22000-memory.dmp
memory/5092-78-0x000001F027950000-0x000001F027962000-memory.dmp
memory/5092-79-0x000001F027940000-0x000001F02794A000-memory.dmp
memory/5092-77-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-76-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-75-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-74-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-73-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-72-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-71-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-70-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-69-0x000001F027940000-0x000001F02794A000-memory.dmp
memory/5092-68-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-66-0x000001F027950000-0x000001F02796E000-memory.dmp
memory/5092-59-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-58-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-57-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-56-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-48-0x000001F00F480000-0x000001F00F4A2000-memory.dmp
memory/5092-107-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-49-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp
memory/5092-47-0x00007FFAA252F000-0x00007FFAA2530000-memory.dmp
memory/5092-119-0x00007FFAA23A0000-0x00007FFAA2D44000-memory.dmp