stealerium | hxxps://github[.]com/batmanlol101/zeezy_stealer/tree/main/builder

Analysis

max time kernel
68s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/batmanlol101/zeezy_stealer/tree/main/builder

Score

10^/10

stealerium stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1235963613869772881/HySNirdpxjVl0EyoN6W2CyXKG22djEdq31jQg9sG1hz9kYRSkZeGUsecUeT9JCHJOL23

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

zeezy_builder.exezeezy_builder.exezeezy_builder.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	zeezy_builder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	zeezy_builder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	zeezy_builder.exe

Executes dropped EXE 3 IoCs

Processes:

zeezy_builder.exezeezy_builder.exezeezy_builder.exe

pid process

5932 zeezy_builder.exe
5340 zeezy_builder.exe
4560 zeezy_builder.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

70 raw.githubusercontent.com
71 raw.githubusercontent.com
86 discord.com
87 discord.com
89 discord.com
94 discord.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

5544 timeout.exe
6000 timeout.exe
1844 timeout.exe

pid	process
5932	zeezy_builder.exe
5340	zeezy_builder.exe
4560	zeezy_builder.exe

flow	ioc
70	raw.githubusercontent.com
71	raw.githubusercontent.com
86	discord.com
87	discord.com
89	discord.com
94	discord.com

pid	process
5544	timeout.exe
6000	timeout.exe
1844	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

3052 taskkill.exe
5508 taskkill.exe
5920 taskkill.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 914272.crdownload:SmartScreen msedge.exe

pid	process
3052	taskkill.exe
5508	taskkill.exe
5920	taskkill.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 914272.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exezeezy_builder.exezeezy_builder.exezeezy_builder.exe

pid	process
1408	msedge.exe
1408	msedge.exe
4432	msedge.exe
4432	msedge.exe
4672	identity_helper.exe
4672	identity_helper.exe
5812	msedge.exe
5812	msedge.exe
5932	zeezy_builder.exe
5932	zeezy_builder.exe
5340	zeezy_builder.exe
5340	zeezy_builder.exe
4560	zeezy_builder.exe
4560	zeezy_builder.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4432 msedge.exe
4432 msedge.exe
4432 msedge.exe
4432 msedge.exe
4432 msedge.exe
4432 msedge.exe
4432 msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

zeezy_builder.exetaskkill.exezeezy_builder.exetaskkill.exezeezy_builder.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	5932	zeezy_builder.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	5340	zeezy_builder.exe
Token: SeDebugPrivilege	5508	taskkill.exe
Token: SeDebugPrivilege	4560	zeezy_builder.exe
Token: SeDebugPrivilege	5920	taskkill.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4432 wrote to memory of 5048	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 5048	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 3016	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 1408	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 1408	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe
PID 4432 wrote to memory of 4372	4432	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/batmanlol101/zeezy_stealer/tree/main/builder
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8917d46f8,0x7ff8917d4708,0x7ff8917d4718
2⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
2⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
2⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
2⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
2⤵
PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
2⤵
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
2⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5696 /prefetch:8
2⤵
PID:5560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:5568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6364 /prefetch:8
2⤵
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,16744518167867713566,6586219723842961140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5812

C:\Users\Admin\Downloads\zeezy_builder.exe
"C:\Users\Admin\Downloads\zeezy_builder.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpC813.tmp.bat
3⤵
PID:2124

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:2404

C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 5932
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
4⤵
- Delays execution with timeout.exe
PID:1844

C:\Users\Admin\Downloads\zeezy_builder.exe
"C:\Users\Admin\Downloads\zeezy_builder.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp195F.tmp.bat
3⤵
PID:5472

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:2488

C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 5340
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5508

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
4⤵
- Delays execution with timeout.exe
PID:5544

C:\Users\Admin\Downloads\zeezy_builder.exe
"C:\Users\Admin\Downloads\zeezy_builder.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp37C4.tmp.bat
3⤵
PID:5860

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:5900

C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 4560
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5920

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
4⤵
- Delays execution with timeout.exe
PID:6000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Filesize
20KB

MD5
8b2813296f6e3577e9ac2eb518ac437e

SHA1
6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

SHA256
befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

SHA512
a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
7c507026fde9f0bfaf69b2cfdcf343ef

SHA1
e5c934aa0976cee59abcaa8a9e11076354ef3ae9

SHA256
71d4c1d9cc9cfb693131c4788453d42daf67d3ea113cd509b8f8c5602a8debd5

SHA512
42ca995b763ddc069116d0a67ba239d82c824046bf7d997a1d7114a0e2d39a23937aa19122c185531697f87b3623b798b80e882c9487334ac4b2eadaa0e85712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d73687d93c9ef6de1dbf0bd138a714e3

SHA1
9648add0bca1b31982a014d095347dacab37cf8a

SHA256
b3200e31b7685b6728087a6d6a6edb7837e79b78259925af512010f8c9399d17

SHA512
230b7a9ac058d419d35ef1b9220d10c9052f4d80ae92e2a274b0418b0e209b6cab1fd8ac51e539950fc43d4ec85d6c733920395eaea20ed39dd7762a4993e429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2fe6c40d9d7bdb729a72311a287e8973

SHA1
7ffd618ec111a2e3748371517185bfe96206d206

SHA256
b6bd35c4945e550eb0d3ffba1b29ce1191c23251456bb12ec28dd50936ebeebe

SHA512
181535971d34309e4d75f03de34bb5e1cbc9b69b761de0357e2a252631712d711de313beca87888df17dd51574d743f492e18c8014ce300611d71faafa23d905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
af0bae1b39899724ce261ca5cb402abe

SHA1
dbca6d044e772b15c42330a2ed13980e9b4e227e

SHA256
36f484071bd5daeb49af9457b4e76ab7c6892f37724439e421b1780bf576c58b

SHA512
8f25c2baa1654e99f83ff86681bfc3ab76c900663b0aa546693e6144f22097432289d9ca5f7fea1041a9c4008886e88a0a544520a6cb2d9ede9d40e12f85913c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
293a51aedb9393236bf7cd39721e7bbd

SHA1
264fa01cbfd398c5b08490df9ce3a3ded25c8390

SHA256
a4224e093d23f816ec36a145ef8cc7b06113732cc4b57ff3a27d73a35d5dc70d

SHA512
46671cc2f1409571b56cc8ef79c047195dd0843c228d08f5235c52fd75db84004dbd8ae380771c36d552540b00f2029288e73e5f909d858c7fc583aee90ed398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
ee51d962ed0aacc931fb4651b5ac4840

SHA1
f30f4f6ab071231347c860d2052f4aa756700003

SHA256
f56e4faf24bca7eed3cb60d3291c2fa06f788b62f305e06f81b10cb01904d603

SHA512
19f6c0bc19197542c5aa034730e21b00c4913c5792cca5f51de81a777d8738bd310feaf9da18add27a9663fb454b9f4272a08c640dd90c6d21b5b8789f068f4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5792f9.TMP
Filesize
874B

MD5
152926040bf1e7da4f38e35b04f0ff64

SHA1
a15e645f64ef0105593b121bc20d778a6ca8a04d

SHA256
cdac3acc17a794409ef439162ea50bd70ceebc14aa7669407500316cbda18802

SHA512
327f80915edd053dc51983d26305810df9de6017089e7aef0c98d80ed28c0898b601cdb2502007d94cf7c1728366ed213a4b44505981ae710294e45bfdcf863d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a42a385ee413a319c26944c239ca69fd

SHA1
0edbd2ee3ac4e8434a776e1f3cd4c1e825aae999

SHA256
b185bd46b31d6ec8f0f53e3c19f1132c018aae7a3a4ba1a73520788b2736af19

SHA512
0b81fd324df17a45a52110b2cc18f58e10ae5d4cfeb086fc24c3e56dced243878249b3da0dc7f27896cec2302c2f4b2fe71603f10e8fb9a673c61dcce1633ef5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a5b21ab0cdbaebc3e04f22bed33f1d39

SHA1
a2966ced460d9d124bd8621656907bd744a49fc7

SHA256
5135941906f43d73a642d08fef392ae3efa3ba7799dcd5b0d04647a77ea23248

SHA512
74f530c27f370d4948353b2da632890f79da6b2e544d59bd53d00ed7c64a1cb163d8ae5bcb528a49da6f4d7c46d5bbe1382b81f58556e0925773c885a669be87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stealerium-Latest.log
Filesize
685B

MD5
a585a279373d9c5e6a4c8c600f06c2f4

SHA1
5d71f96483bc676227071571eb63952612c7fb8b

SHA256
c61a1c16eff7fa59194d1b31c1475c8dda20331033ebfd990ec567fab9979ab7

SHA512
01109e0ca4fc7337d9a5791feb2ee63f9f9b43746908a9e84de7e6cc97aa059376400522f20fd98aeb47a4a18ba44e37b056b2744dce913a9dd642de81fae6e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stealerium-Latest.log
Filesize
1KB

MD5
1594593f8d731ac443a2ec8685bf8d8f

SHA1
a2eefe300626b098ba0c50961de7047f1cac9ba7

SHA256
ce5d29c6ce08bd3c95d16be3ab5f58d6feb916bd305ac9452f20a9d64b356d19

SHA512
8b69b83f6bb953ca4aba8caa1f56e0ead97d5281fc7ed70ac9f11edba35cb9b77ce02a2f7a069db83ccf93295128cff437d1bc18536f0893fc07d6f30a7b0f1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp195F.tmp.bat
Filesize
57B

MD5
e1c52eed42942b566010a11a15f97da9

SHA1
5c5db9fecd5c3289a786ba4c3410a6fb7f27e8f0

SHA256
8965a67d26e8c6ed9031987f4fa038c25bd5abc4743a8294d2926bc6abc28be7

SHA512
9f9898d87082a8a93436ae1d6e5933ee32fc2a71f59bd9749b0a0268e17f9110a30c1257205f1225dd9a3ef7e838858232a1569321d429edc6407bd275053fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp37C4.tmp.bat
Filesize
57B

MD5
50a980b06ee501d4221d887c5faffa6f

SHA1
b917584032b95086b0eefc495f7bb297e042b80e

SHA256
d1154bc056f61ff18ae382355b3359c70d1678a89fa089e88d846ae0afa53b4e

SHA512
de0ce865fb99b9f86990129e10c0c3f08ee9722ff9f7606bfeadb3b7f9b72e3f1e22e8574de2a37ff01b8ec826521b4c86c2565add632b16ef5519c0b14ce468

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC813.tmp.bat
Filesize
57B

MD5
67bf7ee36b8e74cee132a7f33d936b23

SHA1
061ba3efefa3627c8a74dd654a375fc9f977ef80

SHA256
cb942c9ca3c6a4b724b51be9f2f1c213a1c41813ae24c492a95db71289878eda

SHA512
ed55c16fcb56710d9cecf40001f6f09c0b7b24fe6cd951f5d6d15a4954fd74fb061a33be3013c45538d09b834fddb232ea62e51e7f2fd85454f569cf71952fb4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 914272.crdownload
Filesize
1.6MB

MD5
b9e0f12dac33aeacd4c95a89d3084a66

SHA1
2ad8173c61907a949e5b0c0d60064336b12583c3

SHA256
3520bdc6dd768a63a429517e4270740b514387835fe4a4918fd14cd6e47fdd24

SHA512
4c57c55123edbae3862b3b028ffb2927202558264933f8c89924185bc9199a524d5e1da81125a72d76a06110de3f76c0e682db97221ab96729df01d462dd3e52

Download Submit
\??\pipe\LOCAL\crashpad_4432_XZETRREDHPXEQGBK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5932-291-0x0000000005900000-0x0000000005908000-memory.dmp

Filesize
32KB

Download
memory/5932-290-0x00000000058C0000-0x00000000058E6000-memory.dmp

Filesize
152KB

Download
memory/5932-289-0x0000000005830000-0x00000000058C2000-memory.dmp

Filesize
584KB

Download
memory/5932-277-0x0000000005190000-0x00000000051F6000-memory.dmp

Filesize
408KB

Download
memory/5932-267-0x0000000000670000-0x0000000000804000-memory.dmp

Filesize
1.6MB

Download