hxxps://gofile[.]io/d/ZXcmZE

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/ZXcmZE

Score

7^/10

agilenet

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

CreditCard Checker by Mirai.exevshost.exelibEGL32.cfgwinst.exe

pid process

2244 CreditCard Checker by Mirai.exe
5068 vshost.exe
4680 libEGL32.cfg
1216 winst.exe
Loads dropped DLL 6 IoCs

Processes:

libEGL32.cfg

pid process

4680 libEGL32.cfg
4680 libEGL32.cfg
4680 libEGL32.cfg
4680 libEGL32.cfg
4680 libEGL32.cfg
4680 libEGL32.cfg

pid	process
2244	CreditCard Checker by Mirai.exe
5068	vshost.exe
4680	libEGL32.cfg
1216	winst.exe

pid	process
4680	libEGL32.cfg
4680	libEGL32.cfg
4680	libEGL32.cfg
4680	libEGL32.cfg
4680	libEGL32.cfg
4680	libEGL32.cfg

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai.zip	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

73 pastebin.com
74 pastebin.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
73	pastebin.com
74	pastebin.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3040	msedge.exe
3040	msedge.exe
4988	msedge.exe
4988	msedge.exe
4128	identity_helper.exe
4128	identity_helper.exe
1384	msedge.exe
1384	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exe

pid	process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

7zG.exelibEGL32.cfg

description	pid	process
Token: SeRestorePrivilege	716	7zG.exe
Token: 35	716	7zG.exe
Token: SeSecurityPrivilege	716	7zG.exe
Token: SeSecurityPrivilege	716	7zG.exe
Token: SeDebugPrivilege	4680	libEGL32.cfg

Suspicious use of FindShellTrayWindow 37 IoCs

Processes:

msedge.exe7zG.exe

pid	process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
716	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4988 wrote to memory of 1768	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1768	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3572	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3040	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 3040	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1860	4988	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/ZXcmZE
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8da46f8,0x7ff8f8da4708,0x7ff8f8da4718
2⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
2⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
2⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
2⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
2⤵
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
2⤵
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
2⤵
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
2⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
2⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5692 /prefetch:8
2⤵
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
2⤵
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
2⤵
PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
2⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
2⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
2⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
2⤵
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
2⤵
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,981453315350180202,14262142134977710683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6384 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1140

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\" -spe -an -ai#7zMap14267:116:7zEvent1559
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:716

C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\CreditCard Checker by Mirai.exe
"C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\CreditCard Checker by Mirai.exe"
1⤵
- Executes dropped EXE
PID:2244

C:\ProgramData\vshost\vshost.exe
C:\ProgramData\\vshost\\vshost.exe ,.
2⤵
- Executes dropped EXE
PID:5068

C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\libEGL32.cfg
libEGL32.cfg
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\ProgramData\winst\winst.exe
C:\ProgramData\\winst\\winst.exe TBBjFerjgM9d6L6ew5hpP2TeRRc9aAnENBFycCsxBRR1OwH4pWmK7tRHoVDjkQyI
2⤵
- Executes dropped EXE
PID:1216

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\winst\winst.exe
Filesize
211KB

MD5
59238144771807b1cbc407b250d6b2c3

SHA1
6c9f87cca7e857e888cb19ea45cf82d2e2d29695

SHA256
8baa5811836c0b4a64810f6a7d6e1d31d7f80350c69643dc9594f58fd0233a7b

SHA512
cf2f8b84526ae8a1445a2d8a2b9099b164f80a7b7290f68058583b0b235395d749ad0b726c4e36d5e901c18d6946fd9b0dd76c20016b65dc7a3977f68ee4a220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
9905085dfff3385b35f34b18d370760f

SHA1
223762ce5b6b420bbd340d1d111816d3fba63f48

SHA256
07950958c66d6307f6f8afd378addfbe6edcf2e1184888df15fe6729920d64f1

SHA512
179b950f39ebfa1d710602485a3de4666a85c96e7a823c74ec9a9f0722ad53645d5e70073c37a0965be97f1193b82cfe375110e79daccb612e2b5872aa5cee13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
782B

MD5
05d594d24500053766eb3ecd894cbdd2

SHA1
6b01856464404fa5562bdf70760c9f99cebd6aa6

SHA256
911470997cd27221d08e829df6352fb1c41b74bed72fae9bcd583122d9d9e6a7

SHA512
31d7d8483b2b33d8bcd5e93f2336da2a9df3e814779e1a2bff4d42a89801eee5fc23409db2195bf9059e6fc3d25b3ecb0c09cd16d4497530e8b68489f8e068ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
852B

MD5
ca06f1d43f261a063e74a4ec1c823d77

SHA1
fe168ade3f20e65170a692aa866d95d3919195a1

SHA256
7ed1e776ac179dd39a21f3e23b520e9acb8e2e222b093b1b92c7662df1c10032

SHA512
9d45bb38a3b45a5a568d809e4e547c8f85f4f1b06acdebd2d29dddf69ac233b730761dd3636270efa4fdf935b59201d189aca9ac6d36ea428f3b60f8c1335501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3d9c6df356863ccc0a8c4c6eef1475c2

SHA1
4580df9dc4f8fd55dacfb74e8578f8e0aa6c1622

SHA256
7c63ab6e62c3737f1f032b3ad00c96bfd99a9e659e9e4cf9e7c13c15df812576

SHA512
f2338068f1977b9fa4e51b0281b7d92d8483c895567f01cbf4310f7a92a2166902035af989327987194467ce00453436570c8b7af495300a0545598222fccff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
65b40ee1dd9b3d4757c709f56dbb42fb

SHA1
1d53522193705a41badc3845854846bef34716e0

SHA256
8cd9ce8f9eeb6f2582c14c1d9f5982e05a8c490321934c93648fc8ec50f7e083

SHA512
2d334abaed3ac372eaa17833ea510c1c605cc6e6c1b82d7103a3c1e82bbdcdb6c4a985e0fb35143823364bb9337f71072f73a68bc6e2797022ddb021b83fd074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
12081ef4a6cb992afbee221b29f243a2

SHA1
5b97f3c9d5fe99896665938688a876b2fe9e6bbd

SHA256
de87c04229a9b5f34dbbab3c228325a9de11b85bb8c08cb41feaf5b20e866f22

SHA512
756c5b62cdf137922546ff142aafe06c7758a486583074c365f2119feab859d5bd296d62a8104b6f83f9bafe316ce226ed0e24f2035019f6c5ea20e2640fb791

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
96dcb8091d727cf3003a34580b845b96

SHA1
4575bed0e1a2d6ec13cd73962e4f4363b9b64506

SHA256
0ac6941620ff05546b5a38bebfe44f1dd61f5b7d6a73607f69efa7357dfbda32

SHA512
8bc168a8652f3063e17992b54c3649777fe7a3e9d4eb42ae8a7665af911f74adf86f8c2744a896521b014dbd49fb23ea9ebea1b321717a709e174f4751cf4102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
2fa431fb78a8730c74c128f0777e5be6

SHA1
12679fc9eede2f132f8340e11ccfd98155f58fcb

SHA256
6618ef42f1d546961efd01ce64fba3bda140cb06230bb36a5f7ace5942893e19

SHA512
e9f75577ce377d93653c4bd5f4ef64c22eb793c024b8d2feb14656d9a2d7a1a20908b003098da503033530828e808dc22b399fb2859c9ea730d3cfe47c43ed15

Download Submit
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai.zip
Filesize
6.4MB

MD5
eddf09073f2d0729e6ddb4d661dcb5b6

SHA1
33cc2773795e2061c0a3681782a37506050ed0a1

SHA256
cd25bd97c8d0ae446ed04545189cec6a38d06d76b02138e8c9f65573f1bce654

SHA512
24944a0032d7ac99c488f94f477fb6a64756043259d27790dd263069b0f2d937b10e60760400a64d3bd6173df2f01ebe49ae097d65656343ac53130b716e4b4b

Download Submit
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\Bunifu.UI.WinForms.dll
Filesize
2.3MB

MD5
559e0bb848d95c95c29273be8042b920

SHA1
ba05496905a77631f274b016d6f04875a3c165b3

SHA256
1566d30a46c499769d2ca541dee7add696d633ad452abf523dab321f6fd566f4

SHA512
f9b8b22d22743328b151fab1dd8ca529fd4e8836c8ff2ea07562d6c30070854a97ef04a1540a2b90d8ae2ea05ae95e36264841c0c9d76eb806a01168ff575f15

Download Submit
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\Bunifu_UI_v1.5.3.dll
Filesize
319KB

MD5
15b2639e04e5ab17ceed3bf4dc61a68a

SHA1
5eb3c44c87e8c68e9926acb22cc8996c134c78d0

SHA256
4c940e989a91016c1a1aeb456d9288e573c8c1bf5b64e3e38a868f98f7f2385e

SHA512
b8309f2198f21dfbbaef38a3e3736fc070426f2dbc19da83a201e9fdc5eb633ea62eeb4b63e8f2d2abc4fb161e7a11989bfd7672884c03f7e3f90ec0847cf431

Download Submit
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\CreditCard Checker by Mirai.exe
Filesize
847KB

MD5
6400ed150975a6969ccbe4a3517df1d6

SHA1
98d314567c44ade1b97b243211fe21f380595a7e

SHA256
0f993e3f3b742a7696891f5dd0e56c99b375f25e3c548eb989d0eae21003d34a

SHA512
bdb855a0b267d850a5f329ea2e37e313d706c2931d0adc3ddeacc0f2a8286bddce7a104d4f18d4d9f7b6825b0ec3541823eda05dc8d7beac98e7699b802655e6

Download Submit
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\Leaf.xNet.dll
Filesize
129KB

MD5
ea87f37e78fb9af4bf805f6e958f68f4

SHA1
89662fed195d7b9d65ab7ba8605a3cd953f2b06a

SHA256
de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa

SHA512
c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a

Download Submit
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\data.lib
Filesize
238KB

MD5
4e6a7ee0e286ab61d36c26bd38996821

SHA1
820674b4c75290f8f667764bfb474ca8c1242732

SHA256
f67daf4bf2ad0e774bbd53f243e66806397036e5fde694f3856b27bc0463c0a3

SHA512
f9d99d960afce980421e654d1d541c1fdb81252615c48eed5c4a5c962cb20123d06dbdf383a37a476aa41e4ffabca30e95a8735739c35f66efbaa1dee8a9ba8a

Download Submit
C:\Users\Admin\Downloads\CreditCard-checker-by-Mirai\libEGL32.cfg
Filesize
1.5MB

MD5
147f2a8fb46d9398c4e25cc192e91aec

SHA1
f179490ee711246ec729de78dfbed64ed2428d29

SHA256
85aba119d7f0a649d969a5ede02dddc2bc9edec626a4b674dac774fa67c7f143

SHA512
1030fb5067c738c94d2ff9526a9d2c503e2a78eb2425beae80f65debd53744b0f979b4cbf71e469991fe36c9e48a6a0fad53ec97792fa5827db9b7ad1e1ee0a7

Download Submit
\??\pipe\LOCAL\crashpad_4988_CAFSEAEGKGWNRCRD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4680-175-0x0000000005120000-0x00000000056C4000-memory.dmp

Filesize
5.6MB

Download
memory/4680-185-0x0000000005810000-0x000000000581A000-memory.dmp

Filesize
40KB

Download
memory/4680-186-0x0000000005B70000-0x0000000005C0C000-memory.dmp

Filesize
624KB

Download
memory/4680-187-0x0000000006C60000-0x0000000006C80000-memory.dmp

Filesize
128KB

Download
memory/4680-184-0x0000000005920000-0x0000000005B6E000-memory.dmp

Filesize
2.3MB

Download
memory/4680-191-0x00000000096A0000-0x00000000096C6000-memory.dmp

Filesize
152KB

Download
memory/4680-180-0x0000000004D10000-0x0000000004D66000-memory.dmp

Filesize
344KB

Download
memory/4680-176-0x0000000004C70000-0x0000000004D02000-memory.dmp

Filesize
584KB

Download
memory/4680-174-0x0000000000110000-0x0000000000288000-memory.dmp

Filesize
1.5MB

Download