Analysis
- user interaction
yes - max time kernel
148s - max time network
136s - platform
windows11-21h2_x64 - resource
win11-20260911-fr - resource tags
- submitted
10/11/2026, 18:06
General
- Target RoShade.exe
- Size 72.9MB
- Sample261110-wp5kmacv21
- SHA256 463028e93c280773e09c271f691f01bdb3eac853fa1fe22fa5ba7de04db3a389
Malware Config
Signatures
- Executes a file named after a Windows system binary 1 TTPs 3 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 10 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in Program Files directory 4 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RoShade.exe"C:\Users\Admin\AppData\Local\Temp\RoShade.exe"1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\RoShade.exe"C:\Program Files (x86)\Microsoft\Edge\Application\RoShade.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\Ie7n6ST7DBXh.exe"C:\Program Files (x86)\Microsoft\Edge\Application\Ie7n6ST7DBXh.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\PeerDistRepub\WUDFHost.exe"C:\Users\Admin\AppData\Local\PeerDistRepub\WUDFHost.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\PeerDistRepub\WUDFHost.exe"C:\Users\Admin\AppData\Local\PeerDistRepub\WUDFHost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\PeerDistRepub\WUDFHost.exeC:\Users\Admin\AppData\Local\PeerDistRepub\WUDFHost.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Packages\fontdrvhost.exe"C:\Users\Admin\AppData\Local\Packages\fontdrvhost.exe"1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Packages\fontdrvhost.exe"C:\Users\Admin\AppData\Local\Packages\fontdrvhost.exe"2⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Packages\fontdrvhost.exeC:\Users\Admin\AppData\Local\Packages\fontdrvhost.exe1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\fontdrvhost.exe"C:\Program Files\Google\Chrome\Application\fontdrvhost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4tm1azzf.1hb.ps1
inv_4064_734e06033606cb6a_Web Data
inv_4064_f3b715d972fb59ae_Web Data
memory/2176-57-0x0000000140000000-0x0000000140636000-memory.dmp
memory/2176-80-0x0000000140000000-0x0000000140636000-memory.dmp
memory/2176-71-0x0000000140000000-0x0000000140636000-memory.dmp
memory/2176-72-0x0000000140000000-0x0000000140636000-memory.dmp
memory/2176-68-0x0000000140000000-0x0000000140636000-memory.dmp
memory/2176-61-0x0000000140000000-0x0000000140636000-memory.dmp
memory/2176-59-0x0000000140000000-0x0000000140636000-memory.dmp
memory/2176-30-0x0000000140000000-0x0000000140636000-memory.dmp
memory/2176-58-0x0000000140000000-0x0000000140636000-memory.dmp
memory/2932-129-0x00000194FF2F0000-0x00000194FF336000-memory.dmp
memory/2932-120-0x00000194E5FC0000-0x00000194E5FD0000-memory.dmp
memory/2932-157-0x00000194E5FE0000-0x00000194E6AA2000-memory.dmp
memory/2932-152-0x00000194FF3E0000-0x00000194FF3EA000-memory.dmp
memory/2932-151-0x00000194FF380000-0x00000194FF386000-memory.dmp
memory/2932-150-0x00000194FF350000-0x00000194FF358000-memory.dmp
memory/2932-142-0x00000194FFA70000-0x00000194FFA8A000-memory.dmp
memory/2932-141-0x00000194FF340000-0x00000194FF34A000-memory.dmp
memory/2932-140-0x00000194FF360000-0x00000194FF37C000-memory.dmp
memory/2932-136-0x00000194FF2D0000-0x00000194FF2EC000-memory.dmp
memory/2932-139-0x00000194FF390000-0x00000194FF3DC000-memory.dmp
memory/2932-138-0x00000194FF2C0000-0x00000194FF2CA000-memory.dmp
memory/2932-137-0x00000194FF890000-0x00000194FF943000-memory.dmp
memory/2932-113-0x00000194FF040000-0x00000194FF062000-memory.dmp
memory/2932-128-0x00000194FF400000-0x00000194FF502000-memory.dmp
memory/2932-112-0x00000194FF210000-0x00000194FF29A000-memory.dmp
memory/3752-8-0x0000000140000000-0x0000000140636000-memory.dmp
memory/3752-7-0x0000000140000000-0x0000000140636000-memory.dmp
memory/3752-6-0x0000000140000000-0x0000000140636000-memory.dmp
memory/3752-38-0x0000000140000000-0x0000000140636000-memory.dmp
memory/3752-9-0x0000000140000000-0x0000000140636000-memory.dmp
memory/3752-20-0x0000000140000000-0x0000000140636000-memory.dmp
memory/3752-17-0x0000000140000000-0x0000000140636000-memory.dmp
memory/3752-0-0x0000000140000000-0x0000000140636000-memory.dmp
memory/3752-16-0x0000000140000000-0x0000000140636000-memory.dmp
memory/3752-11-0x0000000140000000-0x0000000140636000-memory.dmp
memory/3752-10-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-170-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-185-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-105-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-108-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-111-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-149-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-109-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-107-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-125-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-106-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-123-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-174-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-175-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-173-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-184-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-92-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-124-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-203-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-204-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-205-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-206-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-207-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-208-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-209-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-210-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-211-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-213-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-212-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-214-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-215-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-218-0x0000000140000000-0x0000000140636000-memory.dmp
memory/4064-219-0x0000000140000000-0x0000000140636000-memory.dmp