SYSTEM ONLINE ยท FEED ACTIVE

PC Infection Analysis

Deep forensics into compromised endpoints. Analyze full infection chains, exfiltrated session cookies, and system fingerprints retrieved from active Botnets and InfoStealer campaigns (RedLine, Stealc, Raccoon).

System Diagnostics

61CD4BFB9F78737472448
Personal Laptop
Overview
Software
Processes
Infection Path
Credentials
Data Exfiltration 14

Hardware Info

CPU: 11th Gen Intel(R) Core(TM) i5-1135G7
RAM: 15.73 GB
GPU: Intel(R) Iris(R) Xe Graphics
Resolution: 1920x1080

System Info

OS: Windows 11 Pro
Computer Name: STAG-PC
Username: rranj
HWID: 61CD4BFB9F78737472448

Network & Detection

IP Address: 106.222.203.69 India Detected: Stealc Stealer
Google Chrome - 126.0.6478.185
Microsoft Edge - 127.0.2651.74
IntelliJ IDEA Community Edition 2023.2.2
PyCharm Community Edition 2023.2.2
OBS Studio - 30.0.2
Adobe Genuine Service - 8.5.0.68

Initial Access

User opened malicious attachment "Invoice_INV002.pdf.exe" from phishing email.

T-00:05:22

Loader Execution

PowerShell script executed, creating scheduled task for persistence.

T-00:04:15

Payload Injection

Stealc Stealer injected into `svchost.exe` process.

T-00:03:00

C2 Communication

Connection established to C2 Server at 45.132.89.112 (Russia).

T-00:00:45

Exfiltration Complete

Browser cookies, passwords, and wallets uploaded.

Now
System Registry smss.exe csrss.exe wininit.exe services.exe lsass.exe svchost.exe explorer.exe msedge.exe chrome.exe idea64.exe

22

TOTAL CREDENTIALS FOUND

14

TOTAL EXFILTRATED ITEMS

Cookies.txt Wallets Autofill