bitrat | f6631cb0b90dad50436e54e1626d6684bb4188a451dd1168e72df5ca67583af7

Analysis

max time kernel
202s
max time network
210s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

stub.exe
Size

3.8MB
MD5

4443b57c1262fbc156765ba2a9019391
SHA1

b02b8b4c0ee1f8b850e420d754ef1f398c1ebf4d
SHA256

f6631cb0b90dad50436e54e1626d6684bb4188a451dd1168e72df5ca67583af7
SHA512

84e4854c82c5fbd789ce1973b73d60aef138cee9b492a693a8a9d49a24488cdc719d54a8434fdc4b8e7057be33126e09aae2f04a88d9bfbb7abb9264aa0d596d
SSDEEP

98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/emlwXVZ4FB:5+R/eZADUXR

Score

10^/10

bitrat persistence trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

103.153.182.247:6161

Attributes

communication_password
81dc9bdb52d04dc20036dbd8313ed055
install_dir
Install path
install_file
Install name
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Install name = "C:\\Users\\Admin\\AppData\\Local\\Install path\\Install name"	stub.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local:28-03-2024	stub.exe
File created	C:\Users\Admin\AppData\Local:28-03-2024	stub.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1660	stub.exe

Suspicious behavior: RenamesItself 40 IoCs

pid	Process
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe
1660	stub.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	stub.exe
Token: SeShutdownPrivilege	1660	stub.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1660	stub.exe
1660	stub.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2872	2868	chrome.exe	31
PID 2868 wrote to memory of 2872	2868	chrome.exe	31
PID 2868 wrote to memory of 2872	2868	chrome.exe	31
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1560	2868	chrome.exe	33
PID 2868 wrote to memory of 1768	2868	chrome.exe	34
PID 2868 wrote to memory of 1768	2868	chrome.exe	34
PID 2868 wrote to memory of 1768	2868	chrome.exe	34
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35
PID 2868 wrote to memory of 404	2868	chrome.exe	35

C:\Users\Admin\AppData\Local\Temp\stub.exe
"C:\Users\Admin\AppData\Local\Temp\stub.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6269758,0x7fef6269768,0x7fef6269778
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:8
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1176 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:2
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3232 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2024 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1928 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3204 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:8
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3424 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:1
  2⤵
  PID:576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3268 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1396 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:8
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3484 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3756 --field-trial-handle=1380,i,1334023397290138629,7726902667888692160,131072 /prefetch:8
  2⤵
  PID:2564
- C:\Users\Admin\Downloads\stub.exe
  "C:\Users\Admin\Downloads\stub.exe"
  2⤵
  PID:580

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local:28-03-2024

Filesize
4KB

MD5
0e2c4667e2ddcd8d339f5984c23668e2

SHA1
7eafe9c1cc9bd3b66bfa0822251c45f43cb0ffb0

SHA256
a78085ed8e607fcfed97cf2886c6ef28dd2862217a56ff155ee1dbe09e127593

SHA512
d4d80a44f84fe27cfad9fb3aadc5d129a578fb5ecc5ab2158e321da1faf78672180c8fb20484043dbea6bf9420c442372f71ed2956ce128eeddb401602e6d36f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
632B

MD5
568c4f0ff8900558159c4eaee4bd14da

SHA1
6f15cfc6b1a56d77f5efc8c3222105d14ff8c83a

SHA256
b06f5e736af7e67a73230fa71af2a509503d3cb7d223d5e911454f809a97df3d

SHA512
21fcf8154830f6fdd737d2c2331d2718fc74bc8de7e32f3cdb914aee7c6d5b21f7bf5983ba1d76084baac276cbd0c08e486c0b9cb96fe62cf3787c067a4027f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a1734e2d809f71c3ce676428f05bd203

SHA1
e3278e45d88f8dde973df0674c1746aab47e286a

SHA256
6b231df6bdf815029629061c66be9ec6ad84838b8b9b9d775c35b0a97574fd7e

SHA512
6a4283a1199f0678defca347777dedbefe4e86c83848f23fd0dbe7f76ce9ee5f3b1295f68f427e1eb7e0aa94643a5f20e0d61a290d49dbebf8277cfb5846b8a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d36e644388d1c06740b9584494c06be5

SHA1
db7839c2ee342fe6d8a6200e432d35cfecae5aa8

SHA256
491f39f0f109e0c4db6e3acbf1259003bd1d053ee838eb750c63d365ef9f2c57

SHA512
143a656bc4d02ce8585d08e80a216423b7df657d010efc8166f0cd6f932f82f2ce1e3ce7a923e6e0edf457dafaa14ff115219870bab54bd93719e437bc541e46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d15f613828dc88d70fc927b97cbf08c7

SHA1
807d4ef76bcf3c7c3443e3d31d2be2976401a67b

SHA256
76efb771bb72916e7b28d45e86bdbe6d4e3861509e9de6924adc018b7933c266

SHA512
ac95b0e74aeae7b2a439e51c2d23fe500dcba083f394f0e663f0be242f11b40d3ffc25f236f147748796cd396e9aa296ece9a5cdf25229246c4ad00d76ea064f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
3.8MB

MD5
4443b57c1262fbc156765ba2a9019391

SHA1
b02b8b4c0ee1f8b850e420d754ef1f398c1ebf4d

SHA256
f6631cb0b90dad50436e54e1626d6684bb4188a451dd1168e72df5ca67583af7

SHA512
84e4854c82c5fbd789ce1973b73d60aef138cee9b492a693a8a9d49a24488cdc719d54a8434fdc4b8e7057be33126e09aae2f04a88d9bfbb7abb9264aa0d596d

Download Submit
memory/1660-0-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download