Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 06:05
General
- Target 7958a30722d41d57929034dd4e82361fe2fd020a3c29167bb7781213eb6dbf01.dll
- Size 141KB
- Sample261113-gs8dcsgs2v
- SHA256 7958a30722d41d57929034dd4e82361fe2fd020a3c29167bb7781213eb6dbf01
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7958a30722d41d57929034dd4e82361fe2fd020a3c29167bb7781213eb6dbf01.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\mgggekjcdcdaiagafcbdhcdapifehhmc.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\mgggekjcdcdaiagafcbdhcdapifehhmc' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_eyoagcbl.act.psm1
mgggekjcdcdaiagafcbdhcdapifehhmc.zip
memory/3688-8-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-17-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-7-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-1-0x00007FF914C2F000-0x00007FF914C30000-memory.dmp
memory/3688-9-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-12-0x00000196A6E90000-0x00000196A6EAE000-memory.dmp
memory/3688-13-0x00000196A7100000-0x00000196A71B2000-memory.dmp
memory/3688-14-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-2-0x00000196A6CC0000-0x00000196A6CE2000-memory.dmp
memory/3688-15-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-16-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-6-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-18-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-19-0x00000196A6E80000-0x00000196A6E8A000-memory.dmp
memory/3688-20-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-21-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-22-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-23-0x00000196A6E90000-0x00000196A6EA2000-memory.dmp
memory/3688-3-0x00007FF914AA0000-0x00007FF915444000-memory.dmp
memory/3688-24-0x00000196A6E70000-0x00000196A6E7A000-memory.dmp
memory/3688-31-0x00007FF914AA0000-0x00007FF915444000-memory.dmp