redline | hxxps://githxub[.]com/ee/game/raw/main/SkyBlade

Analysis

max time kernel
127s
max time network
129s
platform
windows10_x64
resource
win10-20220414-en
submitted
03-05-2022 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://githxub.com/ee/game/raw/main/SkyBlade

Score

10^/10

redline 1 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

65.108.5.252:43673

Attributes

auth_value
95517c2a2f56575288c35d9dfde4a6aa

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3884-136-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/3884-141-0x000000000041BC2E-mapping.dmp	family_redline
behavioral1/memory/1560-151-0x0000000000DD0000-0x0000000000E1A000-memory.dmp	family_redline

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

StartGame.exeesss.exe

pid process

1560 StartGame.exe
2188 esss.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1560	StartGame.exe
2188	esss.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

StartGame.exeesss.exe

description	pid	process	target process
PID 1560 set thread context of 3884	1560	StartGame.exe	RegSvcs.exe
PID 2188 set thread context of 2500	2188	esss.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1556 2500 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
1556	2500	WerFault.exe	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe7zFM.exeRegSvcs.exeAppLaunch.exechrome.exe

pid	process
652	chrome.exe
652	chrome.exe
3420	chrome.exe
3420	chrome.exe
2860	chrome.exe
2860	chrome.exe
900	chrome.exe
900	chrome.exe
3772	chrome.exe
3772	chrome.exe
1120	chrome.exe
1240	chrome.exe
1120	chrome.exe
1240	chrome.exe
2724	chrome.exe
2724	chrome.exe
1804	chrome.exe
1804	chrome.exe
1912	chrome.exe
1912	chrome.exe
3420	chrome.exe
3420	chrome.exe
2240	chrome.exe
2240	chrome.exe
1796	7zFM.exe
1796	7zFM.exe
3884	RegSvcs.exe
1796	7zFM.exe
1796	7zFM.exe
1796	7zFM.exe
1796	7zFM.exe
1796	7zFM.exe
1796	7zFM.exe
2500	AppLaunch.exe
2500	AppLaunch.exe
1512	chrome.exe
1512	chrome.exe
1512	chrome.exe
1512	chrome.exe
1796	7zFM.exe
1796	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

1796 7zFM.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

3420 chrome.exe
3420 chrome.exe
3420 chrome.exe
3420 chrome.exe
3420 chrome.exe

pid	process
1796	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zFM.exeRegSvcs.exe

description	pid	process
Token: SeRestorePrivilege	1796	7zFM.exe
Token: 35	1796	7zFM.exe
Token: SeSecurityPrivilege	1796	7zFM.exe
Token: SeDebugPrivilege	3884	RegSvcs.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

chrome.exe7zFM.exe

pid	process
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
1796	7zFM.exe
1796	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3420 wrote to memory of 2196	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 2196	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3820	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 652	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 652	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe
PID 3420 wrote to memory of 3960	3420	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://githxub.com/ee/game/raw/main/SkyBlade
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd54c04f50,0x7ffd54c04f60,0x7ffd54c04f70
2⤵
PID:2196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1904 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1464 /prefetch:2
2⤵
PID:3820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 /prefetch:8
2⤵
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
2⤵
PID:1796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
2⤵
PID:3920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4140 /prefetch:8
2⤵
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
2⤵
PID:200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4316 /prefetch:8
2⤵
PID:2292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3084 /prefetch:8
2⤵
PID:960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5384 /prefetch:8
2⤵
PID:1124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3032 /prefetch:8
2⤵
PID:2788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5460 /prefetch:8
2⤵
PID:2864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:8
2⤵
PID:3776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5732 /prefetch:8
2⤵
PID:3852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5900 /prefetch:8
2⤵
PID:2088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5912 /prefetch:8
2⤵
PID:1556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
2⤵
PID:4072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
2⤵
PID:60

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1472 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3648 /prefetch:8
2⤵
PID:2272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:8
2⤵
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:8
2⤵
PID:3848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2488 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,16274371939123522105,5552168028649114370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1752 /prefetch:8
2⤵
PID:1228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1812

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\SkyBlade.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1796

C:\Users\Admin\AppData\Local\Temp\7zO407F82B7\StartGame.exe
"C:\Users\Admin\AppData\Local\Temp\7zO407F82B7\StartGame.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Users\Admin\AppData\Roaming\esss.exe
"C:\Users\Admin\AppData\Roaming\esss.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 484
6⤵
- Program crash
PID:1556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
148KB

MD5
58ce313aaa93fd1f86e7d42af8939c8a

SHA1
017303b14f506f3b7004b1574d543fa1571ef0ca

SHA256
c22c8ac1fda74ece74cdd3a8d729e4467c56ab658d3aabb499a05a5f9f838913

SHA512
1b965ff6a0edd981bd7b39583651c0a992bea8a4ab7c5c94461949b898f39c58abcc1d75106d57341ded8bb9c394573f60b1bc271b003f16ddf2ff422f9470b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO407F82B7\StartGame.exe
Filesize
290KB

MD5
c47aa23862f9230f066ae6b7ab6276be

SHA1
8e4391429de5ed43a07b92c8763b3cabca98ca23

SHA256
5140a516841312d3eed98ecb1046127c5c2511734b324013e5ba600556447280

SHA512
141f4fe1508786810fc383d5b15251252d2623d8dedb2f277bd0f1f228df0323193bc517bd7b8345a380b990e8d5ec63db8be4096d82d329fef312d6112e5c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO407F82B7\StartGame.exe
Filesize
290KB

MD5
c47aa23862f9230f066ae6b7ab6276be

SHA1
8e4391429de5ed43a07b92c8763b3cabca98ca23

SHA256
5140a516841312d3eed98ecb1046127c5c2511734b324013e5ba600556447280

SHA512
141f4fe1508786810fc383d5b15251252d2623d8dedb2f277bd0f1f228df0323193bc517bd7b8345a380b990e8d5ec63db8be4096d82d329fef312d6112e5c23

Download Submit
C:\Users\Admin\AppData\Roaming\esss.exe
Filesize
6.6MB

MD5
121c023e63315d35667087261e3ec749

SHA1
a5134d1f23dbbe69b0fe3f2938458093f3d6ef29

SHA256
d1b4590d9b0dd5a70cc75ef2fe82a68a7923e863e62f9146b66c9bc6dd15e217

SHA512
1cb7130a559e10652397b8bdfd16bfa2d7c0d93d282760a26e977ae99fe0bc73eeee127f9523f4a951a08c519f4862af60a9647ca7e8f8e568f1c80b269cebf2

Download Submit
C:\Users\Admin\AppData\Roaming\esss.exe
Filesize
6.6MB

MD5
121c023e63315d35667087261e3ec749

SHA1
a5134d1f23dbbe69b0fe3f2938458093f3d6ef29

SHA256
d1b4590d9b0dd5a70cc75ef2fe82a68a7923e863e62f9146b66c9bc6dd15e217

SHA512
1cb7130a559e10652397b8bdfd16bfa2d7c0d93d282760a26e977ae99fe0bc73eeee127f9523f4a951a08c519f4862af60a9647ca7e8f8e568f1c80b269cebf2

Download Submit
C:\Users\Admin\Downloads\SkyBlade.zip
Filesize
2.5MB

MD5
6d7db8f9d837dc740acdc267c36bae2a

SHA1
f92ec8e0b3135152ff734b9820d277c2fa32f543

SHA256
88ee707401099b1ec3ae439dd1af328772aaf2fcc74a3d46ddedc9ba0bbd1c63

SHA512
80baa70f47568f66db9936d61835ffb7b410991e05d81eb71f4c79fc197941abcb6669d78c1c58f35714080b4ca5abcfba13e26f43fb419883a6f65944e9cb3f

Download Submit
\??\pipe\crashpad_3420_QOWTEHWVEQOQJFFH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1560-133-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-123-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-126-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-124-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-128-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-129-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-130-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-131-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-132-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-148-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-134-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-135-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-119-0x0000000000000000-mapping.dmp

Download
memory/1560-125-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-142-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-122-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-155-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-145-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-146-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-121-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-152-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/1560-151-0x0000000000DD0000-0x0000000000E1A000-memory.dmp

Filesize
296KB

Download
memory/1560-154-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/2188-268-0x0000000000000000-mapping.dmp

Download
memory/2500-303-0x0000000000424A33-mapping.dmp

Download
memory/3884-164-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-183-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-150-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-156-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-158-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-159-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-160-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-161-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-162-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-163-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-153-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-165-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-167-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-169-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-171-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-173-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-174-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-175-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-177-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-176-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-179-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-180-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-181-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-182-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-184-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-149-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-185-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-187-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-186-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-178-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-172-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-170-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-168-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-166-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-157-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-203-0x0000000005BA0000-0x00000000061A6000-memory.dmp

Filesize
6.0MB

Download
memory/3884-204-0x0000000005590000-0x00000000055A2000-memory.dmp

Filesize
72KB

Download
memory/3884-205-0x00000000056C0000-0x00000000057CA000-memory.dmp

Filesize
1.0MB

Download
memory/3884-208-0x0000000005610000-0x000000000564E000-memory.dmp

Filesize
248KB

Download
memory/3884-210-0x0000000005650000-0x000000000569B000-memory.dmp

Filesize
300KB

Download
memory/3884-214-0x00000000066B0000-0x0000000006BAE000-memory.dmp

Filesize
5.0MB

Download
memory/3884-215-0x0000000005940000-0x00000000059B6000-memory.dmp

Filesize
472KB

Download
memory/3884-216-0x0000000005A60000-0x0000000005AF2000-memory.dmp

Filesize
584KB

Download
memory/3884-220-0x0000000005B00000-0x0000000005B1E000-memory.dmp

Filesize
120KB

Download
memory/3884-222-0x00000000065F0000-0x0000000006656000-memory.dmp

Filesize
408KB

Download
memory/3884-147-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-232-0x0000000007D30000-0x0000000007EF2000-memory.dmp

Filesize
1.8MB

Download
memory/3884-233-0x0000000008430000-0x000000000895C000-memory.dmp

Filesize
5.2MB

Download
memory/3884-144-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-143-0x0000000076EE0000-0x000000007706E000-memory.dmp

Filesize
1.6MB

Download
memory/3884-141-0x000000000041BC2E-mapping.dmp

Download
memory/3884-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download