stealc | b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa

Analysis

max time kernel
135s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa.exe
Size

854KB
MD5

498a7a01bf758c22edce4242d2a44960
SHA1

020d69ceb746b1fb62c65f651ee1b37769654607
SHA256

b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa
SHA512

5318ab904d014a1657e8df6cfbd5b822c70d934b31c2efef51f8317eeb5aa60e9b38925590bd7f201393c437fb13758ffd30759aab17f0f1189016429ed286e2
SSDEEP

24576:wQDRq87lrAOfpjo1K7l604k1QmPtAKAe4INR:wN8JMIpjo1K7wAQG/R

Score

10^/10

stealc vidar discovery spyware stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

https://88.198.124.82

https://steamcommunity.com/profiles/76561199689717899

https://t.me/copterwin

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1

Signatures

Detect Vidar Stealer 12 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3284-575-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-577-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-584-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-585-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-601-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-602-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-618-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-619-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-636-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-637-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-638-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7
behavioral2/memory/3284-639-0x0000000000C00000-0x0000000000E46000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detect binaries embedding considerable number of MFA browser extension IDs. 10 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3284-584-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/3284-585-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/3284-601-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/3284-602-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/3284-618-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/3284-619-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/3284-636-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/3284-637-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/3284-638-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/3284-639-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 10 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3284-584-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3284-585-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3284-601-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3284-602-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3284-618-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3284-619-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3284-636-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3284-637-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3284-638-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3284-639-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Windows executables referencing non-Windows User-Agents 12 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3284-575-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-577-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-584-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-585-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-601-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-602-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-618-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-619-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-636-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-637-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-638-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3284-639-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 10 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3284-584-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3284-585-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3284-601-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3284-602-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3284-618-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3284-619-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3284-636-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3284-637-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3284-638-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3284-639-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 12 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3284-575-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-577-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-584-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-585-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-601-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-602-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-618-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-619-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-636-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-637-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-638-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/3284-639-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing potential Windows Defender anti-emulation checks 12 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3284-575-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-577-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-584-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-585-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-601-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-602-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-618-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-619-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-636-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-637-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-638-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
behavioral2/memory/3284-639-0x0000000000C00000-0x0000000000E46000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa.exeBuy.pif

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Buy.pif

Executes dropped EXE 2 IoCs

Processes:

Buy.pifBuy.pif

pid process

4600 Buy.pif
3284 Buy.pif
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

Buy.pif

description pid process target process

PID 4600 set thread context of 3284 4600 Buy.pif Buy.pif
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Buy.pif

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Buy.pif
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2300 timeout.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

4064 tasklist.exe
2520 tasklist.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1288 PING.EXE

description	pid	process	target process
PID 4600 set thread context of 3284	4600	Buy.pif	Buy.pif

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Buy.pif

pid	process
2300	timeout.exe

pid	process
4064	tasklist.exe
2520	tasklist.exe

pid	process
1288	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

Buy.pifBuy.pif

pid	process
4600	Buy.pif
4600	Buy.pif
4600	Buy.pif
4600	Buy.pif
4600	Buy.pif
4600	Buy.pif
4600	Buy.pif
4600	Buy.pif
4600	Buy.pif
4600	Buy.pif
3284	Buy.pif
3284	Buy.pif
3284	Buy.pif
3284	Buy.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tasklist.exetasklist.exe

description pid process

Token: SeDebugPrivilege 4064 tasklist.exe
Token: SeDebugPrivilege 2520 tasklist.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Buy.pif

pid process

4600 Buy.pif
4600 Buy.pif
4600 Buy.pif
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Buy.pif

pid process

4600 Buy.pif
4600 Buy.pif
4600 Buy.pif

description	pid	process
Token: SeDebugPrivilege	4064	tasklist.exe
Token: SeDebugPrivilege	2520	tasklist.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa.execmd.exeBuy.pifBuy.pifcmd.exe

description	pid	process	target process
PID 4592 wrote to memory of 4076	4592	b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa.exe	cmd.exe
PID 4592 wrote to memory of 4076	4592	b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa.exe	cmd.exe
PID 4592 wrote to memory of 4076	4592	b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa.exe	cmd.exe
PID 4076 wrote to memory of 4064	4076	cmd.exe	tasklist.exe
PID 4076 wrote to memory of 4064	4076	cmd.exe	tasklist.exe
PID 4076 wrote to memory of 4064	4076	cmd.exe	tasklist.exe
PID 4076 wrote to memory of 1788	4076	cmd.exe	findstr.exe
PID 4076 wrote to memory of 1788	4076	cmd.exe	findstr.exe
PID 4076 wrote to memory of 1788	4076	cmd.exe	findstr.exe
PID 4076 wrote to memory of 2520	4076	cmd.exe	tasklist.exe
PID 4076 wrote to memory of 2520	4076	cmd.exe	tasklist.exe
PID 4076 wrote to memory of 2520	4076	cmd.exe	tasklist.exe
PID 4076 wrote to memory of 4116	4076	cmd.exe	findstr.exe
PID 4076 wrote to memory of 4116	4076	cmd.exe	findstr.exe
PID 4076 wrote to memory of 4116	4076	cmd.exe	findstr.exe
PID 4076 wrote to memory of 3572	4076	cmd.exe	cmd.exe
PID 4076 wrote to memory of 3572	4076	cmd.exe	cmd.exe
PID 4076 wrote to memory of 3572	4076	cmd.exe	cmd.exe
PID 4076 wrote to memory of 3252	4076	cmd.exe	findstr.exe
PID 4076 wrote to memory of 3252	4076	cmd.exe	findstr.exe
PID 4076 wrote to memory of 3252	4076	cmd.exe	findstr.exe
PID 4076 wrote to memory of 2820	4076	cmd.exe	cmd.exe
PID 4076 wrote to memory of 2820	4076	cmd.exe	cmd.exe
PID 4076 wrote to memory of 2820	4076	cmd.exe	cmd.exe
PID 4076 wrote to memory of 4600	4076	cmd.exe	Buy.pif
PID 4076 wrote to memory of 4600	4076	cmd.exe	Buy.pif
PID 4076 wrote to memory of 4600	4076	cmd.exe	Buy.pif
PID 4076 wrote to memory of 1288	4076	cmd.exe	PING.EXE
PID 4076 wrote to memory of 1288	4076	cmd.exe	PING.EXE
PID 4076 wrote to memory of 1288	4076	cmd.exe	PING.EXE
PID 4600 wrote to memory of 3284	4600	Buy.pif	Buy.pif
PID 4600 wrote to memory of 3284	4600	Buy.pif	Buy.pif
PID 4600 wrote to memory of 3284	4600	Buy.pif	Buy.pif
PID 4600 wrote to memory of 3284	4600	Buy.pif	Buy.pif
PID 4600 wrote to memory of 3284	4600	Buy.pif	Buy.pif
PID 3284 wrote to memory of 4768	3284	Buy.pif	cmd.exe
PID 3284 wrote to memory of 4768	3284	Buy.pif	cmd.exe
PID 3284 wrote to memory of 4768	3284	Buy.pif	cmd.exe
PID 4768 wrote to memory of 2300	4768	cmd.exe	timeout.exe
PID 4768 wrote to memory of 2300	4768	cmd.exe	timeout.exe
PID 4768 wrote to memory of 2300	4768	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa.exe
"C:\Users\Admin\AppData\Local\Temp\b2506074e22cbbd6c7a54b64c258ca48dd5a06bebf0830cc63596f1034045bfa.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k copy Apparent Apparent.cmd & Apparent.cmd & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
3⤵
PID:1788

C:\Windows\SysWOW64\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
3⤵
PID:4116

C:\Windows\SysWOW64\cmd.exe
cmd /c md 209835
3⤵
PID:3572

C:\Windows\SysWOW64\findstr.exe
findstr /V "BARNLUGGAGEANYTIM" Transcripts
3⤵
PID:3252

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Mel + Avoid + Online + Prove 209835\q
3⤵
PID:2820

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\Buy.pif
209835\Buy.pif 209835\q
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\Buy.pif
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\Buy.pif
4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3284

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\Buy.pif" & rd /s /q "C:\ProgramData\EGHCAKKEGCAA" & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
6⤵
- Delays execution with timeout.exe
PID:2300

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
3⤵
- Runs ping.exe
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\Buy.pif

Filesize
915KB

MD5
b06e67f9767e5023892d9698703ad098

SHA1
acc07666f4c1d4461d3e1c263cf6a194a8dd1544

SHA256
8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb

SHA512
7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\209835\q

Filesize
347KB

MD5
31ed0f956703a726c62248a411d22cce

SHA1
bd4a0d351c5ee8d7fca36e3cf4e462462301eafe

SHA256
5ceb6a47114ad7027f40b0d33ecc4a3c101cd843e825c06b15e7bd73455d2b26

SHA512
5f59dd79af888211625bba773b80a6df7d645260e602cfe074aa19f16c12fc384e56caae2b633a6e437cb0b007983772c05b02a7279d9984c444a08adbcd0dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Anchor

Filesize
19KB

MD5
7400c856071a39c301413acf230411d6

SHA1
e448951a0387274dc276996045183740ba5e681b

SHA256
15e238f0cc601e974c899a9f1709ad0583d856c0e09fb1ae9491f250cd864c16

SHA512
2df7ed26a6d95f459cae4fcf5b8db0eb2ed51ff9678fdb5f67b0f07c18c29b64af97857f8a13f0a7e157fb79d3448b7ab42c72cb87ddef6780cd67bb36123ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Apparent

Filesize
24KB

MD5
ceada9d3039535bc0cb87c3ff57628ff

SHA1
babd1a60b008d59ad862c7732b23a249f4059890

SHA256
9f904098b3b965b0f383f097102982637107bc04f5588bb2d6ecd33551aa249d

SHA512
3aad377df0f258dbfddad21530b4dca267ff1ab9ee168274f880ef32cd07a63555d996281bc20f9f17209536f7cdcfcac30527c1a2c1f126c3c2610b358ed292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Avoid

Filesize
67KB

MD5
bc31a12aefbdd22638a6c51c40ac0cbe

SHA1
01bd5d83b79fdafcd441dd25538b6f1789842e36

SHA256
e41445bcb2b87065aaf10471ba1d94ba25c34d0bfb94a034b006d0762b809a62

SHA512
828283ccaee57aa8fc97476f9cb9c7c8aacaf90efe3d7c69f4e54289b2ece18ecc75c2a3c42b95bba43b6989061e00a7c3ef77e5bc7a2efe672cf180b0e94ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Burden

Filesize
66KB

MD5
0b53aa66b605e881670b79a59573d0eb

SHA1
5f747decd8764b7f7a01a20f049db3f7f2d51822

SHA256
707ebfe234767c1c62fd5c17d58e10f7e0bc233aa9c9406eeb6eba68cc0e22c4

SHA512
239bfb4d4389e544cae776baf2063f3f959cd7ddd00bdaed5ce1e73a003645d7873443a3ec993e96a458245e7c149d9459476f0009983f30a5c599dea0024a63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Comment

Filesize
53KB

MD5
ae59a671263ed7577ee67882a91e6e24

SHA1
14e61438cd996ba5a6e0358364c49c4c82a170d1

SHA256
6a9d9ad65c58d9a359d84c73c7a60e3cca3326a7ee14f0d6a84b1ff9c152082e

SHA512
098764cbd227a116a0f11274dfc5ee1855f82ac48e97a90f316f4e8eb8aa0a19f71dfacb0c21d60f63f7036a0c2509f41ad8dbbfb4e3bd37dbb021b283cfd742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cooperation

Filesize
64KB

MD5
153bc866a91a3ea8090ebb07addcf721

SHA1
75c4f3675e9966cd6e57ee4b8d9dfb85866532f2

SHA256
f9b5fe82e99db096ad9b233a25b7bc70b3cd613bc5c2ac8ee65de037c7c65aab

SHA512
b65be678b7311fe3e7c0e649af4f8f2499b0cc178a71d6a620ba9495495876728c3d71796e75c7499df739da6f7dca34a045569a56d573a13e75e5fa39b804b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Defeat

Filesize
51KB

MD5
ffce7513b0b9425c6c2d98f3f7ba9dba

SHA1
b02e72f5a3d806a02a0a95fc9945da98e213543e

SHA256
611f7148a76fae9bcc5d2075dd614da0450202edf561bab91565ab123570671c

SHA512
139a97f27360d14f0eb70b49fd85b5a1740254dbdb8c2d266a05ed3bffc0d8d0b4c7695c8cfc1a181ada0b43faf50da0d62fb13549acff8818a552b1eb1d24a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Defining

Filesize
12KB

MD5
3f67ae4354226998d838891675309cfe

SHA1
aff63b9af03f953f180c7c3b0bbb4fab55eeed86

SHA256
c2b6356e08c317b39beae721dd860f1db3999dd2ede310b2c239c3b968cce912

SHA512
0193f294dbf9f4dc0fb3d839b132825afd18ea0832ad1bde53b77e9bff7043a15034b41256afcce9334da4600223763776219cc8d90d342551cb75cb52514b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Donation

Filesize
49KB

MD5
7ca4621d1c35fc9ffd158ea8d4fffddd

SHA1
6deb7fc23d51fdaf914607e4f5d1aa6f9041d740

SHA256
3d713587907eeb8bf06c0283dc234fb9dd9451ab9b597a75ae5ef960fdf38a1e

SHA512
fb069357e5d34d6ea22c95b7e89961636c9b073b320ecf3ed7290766fabc6c6277808528a50b8dcc37c68235cd9c3c0b5effa7321609b3b042e92483e2c3a220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fame

Filesize
36KB

MD5
7eae9d7be47dcb5828c15147aba3d9e4

SHA1
f1f7c713cc4df7655aa70f8e9c035fe7a3e29ddd

SHA256
50719294e27ee75b1a4adec7414bb70fec7a8752d53e208f60a585ef88c06b0d

SHA512
a2b8b712989715f56cb82cdfd1c44b5772d874bff8f44e3d81d0cdb77efdae422b17225c222e6aca9c566876df8a883ec3ac7a07c7db1b774492957db1bc0047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Gore

Filesize
63KB

MD5
40214213b456ce9ae37e7135bc938fcd

SHA1
4c3805226bee6a0314c5e4c7aed6beaeca070688

SHA256
79cee99cc90423f33223e679cb999dc1e9da0d46817764bad47a551557f07a1e

SHA512
2375f3b2aa224a2a0672092def6520f93b58e570ad17b4b24406b7eb3f8ad95d690da8484547dd5fd809b39c164210ba785459749842222e66ccfb6b48018cfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Hampton

Filesize
41KB

MD5
f083727754cf8a400295c00b2b2d10e1

SHA1
3a1d2f1e541d36ec109b77ad32911cea1678e40b

SHA256
2611e74b00969844d134d89835110f42450bdb1038ad9212a043dc03a4a16f4f

SHA512
3d99dd6686c0aecf3c3b54fd7d68555740d8c69ba6a398b874d9208f8cfde994d9abb6a606ff5a9716858f17cd633ac48cc0976401877bd2fe660c58eba0cff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Handle

Filesize
29KB

MD5
f92123f4085f2e2d633b61e255056a81

SHA1
efbfc3873208e0ca18fa64feb22f53903ee45bc1

SHA256
5dbf8f90f3a0f57161250f4474507d9c763c918c1cae328e8f46eea026fd248c

SHA512
dcf0fab394f03e32102b25bdfdd361b4cb27b45d2de9ba99c71b6ad651dca98802f88303cab459aa39cdff4f282594e9cf413a707101c6338569efe0121584ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Keen

Filesize
62KB

MD5
932c22652e4dc04172bd3c9e8231c090

SHA1
9e29c64008e554f34b1217381e874a0935e5d909

SHA256
f6dacd2fb67de305665f84a25fd2f0c85c9abef75334498735924e1eb8c40a96

SHA512
f4c6b0282d89bdf0687424d8d691ddb41dafcfebec87d6bd99c591c2682faa006170e2b7b7d8da630b1b4e6712f51ca487d63f89d22d47037472f2a1834a872d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Meeting

Filesize
35KB

MD5
f4d1e58fe6ea4e6db131e2fbb1877fb9

SHA1
2f757a077929e38873022d033e6835fa6d908584

SHA256
d49e2fafdc343c80a370e407aef49f092d98a1cde4313990b555b3ff602d14b4

SHA512
ab2ad408b66c35d8af39de3aa248f84a9da3f22d0b8ba74f7c38d6e56e0843c95f84698d63bc00278d190c987020ab2d90ab0db38dfb83cf5ea25e60e13578d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Mel

Filesize
25KB

MD5
4266c93fc57f777f5bb5c5167c6c358b

SHA1
eb387be4f7bf71d91bfd1a0ab4fc3e9d66de5c46

SHA256
6ab509c23bf8ad2f0cbbafe0f521809aea700fac53976854ab9db3306facf04a

SHA512
c9c16310adecd657a39c2c4aa31bac6f0b33a82b1764c1c821bddb552ee6d930bbe34a1ad18cc46e6c11880e7590865abf0a52890b9e0acaf1de4b10fd456754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Online

Filesize
138KB

MD5
9fbaf981a4fb785664fa165e0ce463d0

SHA1
62476abe076dbd35cd3dc906f3c8d7e8399cc5d2

SHA256
271c4cff3e2eb78badfb87005aba3876d182c18ae98993e4309908041fa3a6eb

SHA512
8b5295b77537b5681b7248ebcebc5633e8e6d69c145391f0c78cccf4d91568af054c9c43daea0bb023f17eaeaeeb67cda6e1cc02ccaa56b5852681c7305d1074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Principal

Filesize
20KB

MD5
a3326a8340a9b6c4c6cc4736c9d68833

SHA1
9840d262918441d11d228f1325ed6e885dbd760c

SHA256
c8592bf3b25774e06014b03e180c978b62abb0449842c5965b1b93b006dc3d69

SHA512
d9b562000f376e2084a6cce7a894d2e0b1ad326a404d84527a80065b171233ec6dfb5abdfc896e3d09a2d7ac0a90131b67231fccf3cdfc243bd6ea1d307d79ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Prove

Filesize
117KB

MD5
0d82d568de81a5416b65d46275c57afe

SHA1
f1496bf5d56e2ca48a20738203238b47345f49ef

SHA256
48fd8dfc163008e4968654073afa8c186de9d95460bbc2b60d3aa5529947e162

SHA512
45b895e71db3703398ec1c1647de5890f54c1f2e525fbe0f5986fe3d3c43925a2d13683a691d2603a71d6f995cac54e119d218b95b81bdddd31ae03cb3e18135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Pussy

Filesize
42KB

MD5
4ca7db16fbca0bb3ff1b58b7dc68ed33

SHA1
3ef55f25643b885e99ba30569e382d14887f9df8

SHA256
d62002a7c054dcf9daf35c311c72f2494786cceb3c968f52210e5f3a0acbea97

SHA512
de67b3230ff51260d383518a376c7b67807809acd69b672b9ce7fff80271c266a518ef665b736d4f61b57c39989376cfe45c2990586bb5351630d7c39be0e40a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Shift

Filesize
44KB

MD5
68fc2213914195ca32a487be4960b246

SHA1
65bd64a6b135cd2c6bff7e8226df6197272c790c

SHA256
18e4cc79ad57a1b0ce2e946ef97f19780d26aca2e944accefa7c99bd40a13c69

SHA512
47aadaa6e47a38a5074ef3d76677533fb00fffdb0b4928e8b5d343404b5ff0f17f21bbb84b372b2d42fea695a65e8aa6c4f1e7d6615b49ffaa2200c3fda08d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Specs

Filesize
26KB

MD5
1bcb4b7705fdef179cc72980fea7ce26

SHA1
82dd3552e15f57bca8742d8258767f492e5ec46e

SHA256
3bba68698818d8f273c1440c12d3e281a697ad7fade35fb859467480b56e3ad8

SHA512
554e6ff5705d4e71f25ad99879d38c061e7c66c12531c7828308a8fee1bfda4366c2e2d4846aa71a0968426132e908124707a2b341083463463d85bb92f4c0e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Transcripts

Filesize
158B

MD5
2818b8f68bd095c62f48222c252262ec

SHA1
e90bc017ce4a45ba8352585c78d8158b4c4e139b

SHA256
c0e947ef64b02398cbbc8d1080de78e7a884500e06e3fba36c1b13f39b49e28f

SHA512
398fc4bbc8e498c0beddc14a5181973a9caf5607e48f4c421ee624d788e2830177af813e4a957af99691c48d0ef0b93002219422ff1b787d53e1f0872a8aabaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ukraine

Filesize
59KB

MD5
1615dd90a44f0748e0bcb5c620e08aea

SHA1
2002a43a8ccafd28926417428d9fc45a945228b5

SHA256
7060bbb1549dd936219fcfdbe47dc6089202e4b69368db82521c862b05b7f6c7

SHA512
1e981a8a038fab2692276e1979ac848e7af28cb682477b12cfad7a64ca94c3852127d0c6e6720fc57aec0880579bf9ff6c1489729bf6918daaac071d378e7094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Uruguay

Filesize
64KB

MD5
dd85bf970e4e6cfcf951f8cc7715a8c6

SHA1
1743f1439889e4a5aa1c9bb5df870025ae07d904

SHA256
55e80cbc262a725e7f7ef2d7bbf2ce4a9c5d2e1e429e9930d1baae1df24b97ca

SHA512
99905866f4408ce419792a6a94891dcbef3d3d773f6a4c5d53511184b9e95524a15ed3f7c66e953a90541543810e1cb7e9543eac4741a30197cdeec889f1f209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Var

Filesize
8KB

MD5
0829f71740aab1ab98b33eae21dee122

SHA1
0631457264ff7f8d5fb1edc2c0211992a67c73e6

SHA256
9f1dcbc35c350d6027f98be0f5c8b43b42ca52b7604459c0c42be3aa88913d47

SHA512
18790c279e0ca614c2b57a215fecc23a6c3d2d308ce77f314378cb2d1b0f413acd3a9cd353aa6da86ec9f51916925c7210f7dfabc0ef726779f8d44f227f03b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Wearing

Filesize
12KB

MD5
64cc92e2de1c2f706b4078d99daf0fbe

SHA1
0cae2206ec04a05234112e5df725fa8338085346

SHA256
4e09ea0f8526cdaea7ca21c5f5abe5023a2447e3c9e28ce99fb6119c66de6b42

SHA512
f625a257d5c47f19fc9ba797443247ee6e368e6f05121342e0156ee701c15ab3e5a146d40aafe81d72c8703274bdece83da67624c502e2c025d2220f79ba4b7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Webcam

Filesize
60KB

MD5
fbe1a1a4ea1a979ec69ab7e29cf30f48

SHA1
b85fad489c682ad454df9ddbd34cc694980c50ab

SHA256
7dc3f42e99fdeb3c242cebb74e554f9d8b0496902e4cc0c6e21ca95c6eb7e74b

SHA512
eacfbb6fda9f361c51f1771cd32e3f4e30ee33d6e0a0cc261568a8b43432dfc35fb568da8ca9b9d5c8139070612f175d97211360ce9626de72418c1f0ab75119

Download Submit
memory/3284-577-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-602-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-574-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-584-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-585-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-587-0x000000001C220000-0x000000001C47F000-memory.dmp

Filesize
2.4MB

Download
memory/3284-601-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-575-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-618-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-619-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-636-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-637-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-638-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download
memory/3284-639-0x0000000000C00000-0x0000000000E46000-memory.dmp

Filesize
2.3MB

Download