hxxps://s2[.]dosya[.]tc/server22/rhe4ez/s[.]rar[.]html

Analysis

max time kernel
1554s
max time network
1593s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://s2.dosya.tc/server22/rhe4ez/s.rar.html

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

stealerchecker.exe

pid process

4380 stealerchecker.exe

Loads dropped DLL 10 IoCs

Processes:

stealerchecker.exe

pid	process
4380	stealerchecker.exe
4380	stealerchecker.exe
4380	stealerchecker.exe
4380	stealerchecker.exe
4380	stealerchecker.exe
4380	stealerchecker.exe
4380	stealerchecker.exe
4380	stealerchecker.exe
4380	stealerchecker.exe
4380	stealerchecker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

1440 ipconfig.exe
Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid process

4336 NOTEPAD.EXE
3220 NOTEPAD.EXE

pid	process
1440	ipconfig.exe

pid	process
4336	NOTEPAD.EXE
3220	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exestealerchecker.exe

pid	process
1208	chrome.exe
1208	chrome.exe
2200	chrome.exe
2200	chrome.exe
1812	chrome.exe
1812	chrome.exe
3084	chrome.exe
3084	chrome.exe
1852	chrome.exe
1852	chrome.exe
4920	chrome.exe
4920	chrome.exe
4496	chrome.exe
4496	chrome.exe
380	chrome.exe
380	chrome.exe
3768	chrome.exe
3768	chrome.exe
4380	stealerchecker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

chrome.exe

pid	process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

7zG.exe7zG.exestealerchecker.exe

description	pid	process
Token: SeRestorePrivilege	3740	7zG.exe
Token: 35	3740	7zG.exe
Token: SeSecurityPrivilege	3740	7zG.exe
Token: SeSecurityPrivilege	3740	7zG.exe
Token: SeRestorePrivilege	3312	7zG.exe
Token: 35	3312	7zG.exe
Token: SeSecurityPrivilege	3312	7zG.exe
Token: SeSecurityPrivilege	3312	7zG.exe
Token: SeDebugPrivilege	4380	stealerchecker.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2200 wrote to memory of 4168	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4168	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1336	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1208	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 1208	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe
PID 2200 wrote to memory of 4640	2200	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://s2.dosya.tc/server22/rhe4ez/s.rar.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92e5b4f50,0x7ff92e5b4f60,0x7ff92e5b4f70
2⤵
PID:4168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1764 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1612 /prefetch:2
2⤵
PID:1336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2296 /prefetch:8
2⤵
PID:4640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
2⤵
PID:3680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
2⤵
PID:3484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4612 /prefetch:8
2⤵
PID:3376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
2⤵
PID:4152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
2⤵
PID:2028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
2⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
2⤵
PID:2664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
PID:5096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5732 /prefetch:8
2⤵
PID:4916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
2⤵
PID:5012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
2⤵
PID:1236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
2⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
2⤵
PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
2⤵
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
2⤵
PID:2148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6604 /prefetch:8
2⤵
PID:5036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6732 /prefetch:8
2⤵
PID:2864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6956 /prefetch:8
2⤵
PID:3716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6936 /prefetch:8
2⤵
PID:64

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6924 /prefetch:8
2⤵
PID:3752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7312 /prefetch:8
2⤵
PID:4780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7588 /prefetch:8
2⤵
PID:5044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7568 /prefetch:8
2⤵
PID:4664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7432 /prefetch:8
2⤵
PID:3852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7856 /prefetch:8
2⤵
PID:3304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7904 /prefetch:8
2⤵
PID:4868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6916 /prefetch:8
2⤵
PID:384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
2⤵
PID:3532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
2⤵
PID:4336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5068 /prefetch:8
2⤵
PID:1896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
2⤵
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6456 /prefetch:8
2⤵
PID:2268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 /prefetch:8
2⤵
PID:4948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,18124250604605396779,8473698883856598849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7732 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4192

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\s\" -ad -an -ai#7zMap5552:64:7zEvent8808
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3520

C:\Windows\system32\ipconfig.exe
ipconfig
2⤵
- Gathers network information
PID:1440

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\stealerchecker\" -ad -an -ai#7zMap26899:90:7zEvent30664
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\s\s\AE_2.48.168.39_2022-12-19T08_40_12.091Z\passwords.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4336

C:\Users\Admin\Downloads\stealerchecker\stealerchecker.exe
"C:\Users\Admin\Downloads\stealerchecker\stealerchecker.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\s\s\AE_86.97.102.61_2022-12-18T15_51_28.815Z\passwords.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3220

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Downloads\s.rar
Filesize
120.7MB

MD5
fe5e2bfd59a3e93ae5a85f69a90838af

SHA1
fa37d1cfacc75c9c45b83165a7f9d528f66a3ead

SHA256
2856438f4210e1d6f32809dd7fad5fc37df23426d40bafe81c11bf83389ce190

SHA512
b97b6022950ae283677fb09fb5987c3fc262b111a18eb63569620a7d5db59a048ca4371fd8879f38866791db3b2a803385e6414c015a02afee3cc427d8ff2998

Download Submit
C:\Users\Admin\Downloads\s\s\AE_2.48.168.39_2022-12-19T08_40_12.091Z\passwords.txt
Filesize
1KB

MD5
1535f87b98baf1255fff34b98bb1f379

SHA1
6f449a622f181ef56724c028b34358019e8e49ea

SHA256
0ec0ea3d9294c3b108c07cd55b2de7ff58c80dbf2651494094695e9d4fb5a73b

SHA512
e0d730868fdbdc442257fee33caa503262eeb9aee0a5ac9ac334242d5ce11abec150c2d3a08a233516455b2529b9a510b57c4301c2f682243a98ceb1b42066b5

Download Submit
C:\Users\Admin\Downloads\stealerchecker.zip
Filesize
41.0MB

MD5
63120dfb5730d69771cc78909cb59576

SHA1
c5e36a7b04345c8938899c8b34e7cd738fb481f2

SHA256
40ef2f025bb814d35f2a10cd9982fe154140ab47927f0825cc8d9d6a8e019a3a

SHA512
9dfdca86394ee8b0ebb201cb1c3700171f3a8bde99cbec7ea7abcd0b765fb2a7e157110715ddc168a0a19be90b8e544cb73d24da42b7bcdf45d65a88204de27e

Download Submit
C:\Users\Admin\Downloads\stealerchecker\Colorful.Console.dll
Filesize
88KB

MD5
9f6ce7ff934fb2e786ced3516705efad

SHA1
6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

SHA256
59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

SHA512
d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

Download Submit
C:\Users\Admin\Downloads\stealerchecker\Colorful.Console.dll
Filesize
88KB

MD5
9f6ce7ff934fb2e786ced3516705efad

SHA1
6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

SHA256
59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

SHA512
d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

Download Submit
C:\Users\Admin\Downloads\stealerchecker\Colorful.Console.dll
Filesize
88KB

MD5
9f6ce7ff934fb2e786ced3516705efad

SHA1
6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61

SHA256
59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436

SHA512
d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578

Download Submit
C:\Users\Admin\Downloads\stealerchecker\CommandLine.dll
Filesize
214KB

MD5
fac224b65fdd9ee338ae052c4d6f2589

SHA1
adc816102554d8c2e394bae924b1cf2ee5d42093

SHA256
65d05e85e4e950e6038c7ec1b43b8e7a2b46b45bd441391d8c425b22be88f39c

SHA512
ad931bdfcf0be063d08f78bab2fca3c0ce71ae7357c94bffb02a4e186a56f36bb779d9d6ce27cc0a5d2073734ab81d4267b36ec4cfe57b7fcde2c5561b23af44

Download Submit
C:\Users\Admin\Downloads\stealerchecker\CommandLine.dll
Filesize
214KB

MD5
fac224b65fdd9ee338ae052c4d6f2589

SHA1
adc816102554d8c2e394bae924b1cf2ee5d42093

SHA256
65d05e85e4e950e6038c7ec1b43b8e7a2b46b45bd441391d8c425b22be88f39c

SHA512
ad931bdfcf0be063d08f78bab2fca3c0ce71ae7357c94bffb02a4e186a56f36bb779d9d6ce27cc0a5d2073734ab81d4267b36ec4cfe57b7fcde2c5561b23af44

Download Submit
C:\Users\Admin\Downloads\stealerchecker\CommandLine.dll
Filesize
214KB

MD5
fac224b65fdd9ee338ae052c4d6f2589

SHA1
adc816102554d8c2e394bae924b1cf2ee5d42093

SHA256
65d05e85e4e950e6038c7ec1b43b8e7a2b46b45bd441391d8c425b22be88f39c

SHA512
ad931bdfcf0be063d08f78bab2fca3c0ce71ae7357c94bffb02a4e186a56f36bb779d9d6ce27cc0a5d2073734ab81d4267b36ec4cfe57b7fcde2c5561b23af44

Download Submit
C:\Users\Admin\Downloads\stealerchecker\Leaf.xNet.dll
Filesize
148KB

MD5
6f4784273e0e378ecf86acc62a5e8005

SHA1
baaa02a81a32c2199a60c273b5cdd451820fa360

SHA256
2a5e234423cf8a275e0dc6127c94f53f0e3c6916704fcff40d0ada105ab13e8e

SHA512
bab8bb64835585c6f5b92a530c59f67597ac2828d5374fc467cb7755ff5d3d5876b72c3af964f34e51b07a2c666cede3bbd5bc095deaf2117154b62ecd45d4c4

Download Submit
C:\Users\Admin\Downloads\stealerchecker\Leaf.xNet.dll
Filesize
148KB

MD5
6f4784273e0e378ecf86acc62a5e8005

SHA1
baaa02a81a32c2199a60c273b5cdd451820fa360

SHA256
2a5e234423cf8a275e0dc6127c94f53f0e3c6916704fcff40d0ada105ab13e8e

SHA512
bab8bb64835585c6f5b92a530c59f67597ac2828d5374fc467cb7755ff5d3d5876b72c3af964f34e51b07a2c666cede3bbd5bc095deaf2117154b62ecd45d4c4

Download Submit
C:\Users\Admin\Downloads\stealerchecker\Leaf.xNet.dll
Filesize
148KB

MD5
6f4784273e0e378ecf86acc62a5e8005

SHA1
baaa02a81a32c2199a60c273b5cdd451820fa360

SHA256
2a5e234423cf8a275e0dc6127c94f53f0e3c6916704fcff40d0ada105ab13e8e

SHA512
bab8bb64835585c6f5b92a530c59f67597ac2828d5374fc467cb7755ff5d3d5876b72c3af964f34e51b07a2c666cede3bbd5bc095deaf2117154b62ecd45d4c4

Download Submit
C:\Users\Admin\Downloads\stealerchecker\Newtonsoft.Json.dll
Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\Downloads\stealerchecker\Newtonsoft.Json.dll
Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\Downloads\stealerchecker\Newtonsoft.Json.dll
Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\Downloads\stealerchecker\TemnijExt.dll
Filesize
16KB

MD5
d5f618716399d91961f9b6f7c0bf8abd

SHA1
325a9cd40a30d8c00a10a91c1912930146d91967

SHA256
92b879a4e7c074b5195f7e85772b619efcec02bbcb2ee56cd4bdce9c52b071e7

SHA512
7965f12a1405870a33378862b09a3374dedc6d2900c80d93f068c0695ac796974c66146104dd297d5826e4bbf20568d3e68c1a8e00bd0053e77e45f2158693f7

Download Submit
C:\Users\Admin\Downloads\stealerchecker\TemnijExt.dll
Filesize
16KB

MD5
d5f618716399d91961f9b6f7c0bf8abd

SHA1
325a9cd40a30d8c00a10a91c1912930146d91967

SHA256
92b879a4e7c074b5195f7e85772b619efcec02bbcb2ee56cd4bdce9c52b071e7

SHA512
7965f12a1405870a33378862b09a3374dedc6d2900c80d93f068c0695ac796974c66146104dd297d5826e4bbf20568d3e68c1a8e00bd0053e77e45f2158693f7

Download Submit
C:\Users\Admin\Downloads\stealerchecker\stealerchecker.exe
Filesize
67KB

MD5
6c957fb8db1e3711a0528b4bd223057d

SHA1
fdd6888c8bd3565fc25f8f5bd89eab3d95b97ea9

SHA256
54dbf5ee38f7823d4a6d9fc0c1d2de011702b5e20b7ea78f534061b93627d05d

SHA512
f869b16908155574a323357004e3621132f929fb7b97e6ba746b7fdd9cc7afac6057b506d6d8eee6a6ad96c60c279d4f432f1600871d6c9def9b88bdf3dc314d

Download Submit
C:\Users\Admin\Downloads\stealerchecker\stealerchecker.exe
Filesize
67KB

MD5
6c957fb8db1e3711a0528b4bd223057d

SHA1
fdd6888c8bd3565fc25f8f5bd89eab3d95b97ea9

SHA256
54dbf5ee38f7823d4a6d9fc0c1d2de011702b5e20b7ea78f534061b93627d05d

SHA512
f869b16908155574a323357004e3621132f929fb7b97e6ba746b7fdd9cc7afac6057b506d6d8eee6a6ad96c60c279d4f432f1600871d6c9def9b88bdf3dc314d

Download Submit
\??\pipe\crashpad_2200_JIJTCXLQNJLOZSDK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1440-135-0x0000000000000000-mapping.dmp

Download
memory/4380-154-0x00000000054F0000-0x000000000552C000-memory.dmp

Filesize
240KB

Download
memory/4380-150-0x0000000005550000-0x00000000055E2000-memory.dmp

Filesize
584KB

Download
memory/4380-149-0x0000000005490000-0x00000000054AC000-memory.dmp

Filesize
112KB

Download
memory/4380-145-0x0000000005450000-0x000000000546A000-memory.dmp

Filesize
104KB

Download
memory/4380-144-0x0000000005420000-0x000000000544C000-memory.dmp

Filesize
176KB

Download
memory/4380-158-0x0000000005890000-0x0000000005940000-memory.dmp

Filesize
704KB

Download
memory/4380-140-0x0000000000B50000-0x0000000000B66000-memory.dmp

Filesize
88KB

Download
memory/4380-159-0x0000000006500000-0x0000000006522000-memory.dmp

Filesize
136KB

Download
memory/4380-162-0x00000000073B0000-0x00000000073BA000-memory.dmp

Filesize
40KB

Download