61aa2dcbf2a650f0293df2734978f410c42ae34cf2669989a2ce35b630f2052d

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61aa2dcbf2a650f0293df2734978f410c42ae34cf2669989a2ce35b630f2052d.exe
Size 11.3MB
Sample261110-qs211styct
SHA256 61aa2dcbf2a650f0293df2734978f410c42ae34cf2669989a2ce35b630f2052d
MD5 a06b294df9fea8666f5fa7fb712c38aa
SHA1 36a4b1830c0786267b0938edb08cb34fd842e274
SHA512 75135520272d835c7981e323f82c07c408baf6a1a61ece01a80140f09079dde31597cc918fb2d1d9b3561146f944305c22183910a98d9dac4e9b701f9c3f1d7e
SSDEEP 98304:9hGrMaRt8F/6s2MbjkeZ8CQWVW5MNfHabZ2GYd7EX:2REbpyC7oM9HqEmX
TLSH
T1F3C64843E87549D5C0AED17686769563BB713C898B3063D36B90FA242F33BE0ADB9710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	discord.com
10	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3804	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	61aa2dcbf2a650f0293df2734978f410c42ae34cf2669989a2ce35b630f2052d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	61aa2dcbf2a650f0293df2734978f410c42ae34cf2669989a2ce35b630f2052d.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2628	netsh.exe
3804	cmd.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	4	Go-http-client/1.1

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 3804	2476	61aa2dcbf2a650f0293df2734978f410c42ae34cf2669989a2ce35b630f2052d.exe	86
PID 3804 wrote to memory of 2628	3804	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\61aa2dcbf2a650f0293df2734978f410c42ae34cf2669989a2ce35b630f2052d.exe
"C:\Users\Admin\AppData\Local\Temp\61aa2dcbf2a650f0293df2734978f410c42ae34cf2669989a2ce35b630f2052d.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\cmd.exe
  cmd /C "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2628