discordrat | hxxps://gofile[.]io/d/RVPzaO

Analysis

max time kernel
1019s
max time network
1685s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/RVPzaO

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1MDMzODQzOTQwMDc4MzkxMw.GhJOAK.3oIzig5tKkoPl8VvE4gewUAbpBe-dUdKCtUMuI
server_id
1243114572278141000

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

s.exes (1).exe

pid process

3000 s.exe
1288 s (1).exe

pid	process
3000	s.exe
1288	s (1).exe

Loads dropped DLL 16 IoCs

Processes:

chrome.exechrome.exechrome.exeWerFault.exechrome.exechrome.exeWerFault.exe

pid	process
2348	chrome.exe
2100	chrome.exe
2124	chrome.exe
872	WerFault.exe
872	WerFault.exe
872	WerFault.exe
872	WerFault.exe
872	WerFault.exe
2736	chrome.exe
1404	chrome.exe
2124	chrome.exe
1104	WerFault.exe
1104	WerFault.exe
1104	WerFault.exe
1104	WerFault.exe
1104	WerFault.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exe

pid process

2124 chrome.exe
2124 chrome.exe
2124 chrome.exe
2124 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

Processes:

chrome.exe

pid	process
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2124 wrote to memory of 2688	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2688	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2688	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 1912	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2816	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2816	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2816	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe
PID 2124 wrote to memory of 2968	2124	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/RVPzaO
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7109758,0x7fef7109768,0x7fef7109778
2⤵
PID:2688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:2
2⤵
PID:1912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
PID:2816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:1
2⤵
PID:2104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:1
2⤵
PID:348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3168 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:1
2⤵
PID:2672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3300 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:2
2⤵
PID:2756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
PID:1920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1564 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:1
2⤵
PID:1788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
PID:1260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3612 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
PID:1864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3632 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
PID:1036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
PID:560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3744 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
- Loads dropped DLL
PID:2348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3736 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
- Loads dropped DLL
PID:2100

C:\Users\Admin\Downloads\s.exe
"C:\Users\Admin\Downloads\s.exe"
2⤵
- Executes dropped EXE
PID:3000

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3000 -s 600
3⤵
- Loads dropped DLL
PID:872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=664 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
PID:2532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=884 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
PID:1716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=720 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2004 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
- Loads dropped DLL
PID:1404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2008 --field-trial-handle=1384,i,831533747749062195,10858737841576519030,131072 /prefetch:8
2⤵
- Loads dropped DLL
PID:2736

C:\Users\Admin\Downloads\s (1).exe
"C:\Users\Admin\Downloads\s (1).exe"
2⤵
- Executes dropped EXE
PID:1288

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1288 -s 596
3⤵
- Loads dropped DLL
PID:1104

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
d257e06c383188eca5192bbe43639213

SHA1
59ffaf6f31abc9e30c27cf30e7d12a8cb1df3985

SHA256
d81b6704f64c92a774a75b7d96904a5e612c6f425e52fd5ba040dfc8cb91904c

SHA512
2109a961166a8e36750965416fcd5a8b4dfcefe6f742eae5bcd5ae56cd25659321ec6924cfa370069a60677df78059cb85215dc740a5be9f6df5afc81fc6a27c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
c8013f06171aebe5562f183012211203

SHA1
a907adec371efa625728f8503455fb2e57c798e5

SHA256
d4294e01e0393333baa7dbdce08e531f59a576a5cb9405ee762a96de4171b448

SHA512
8d5eb3a0ea0b66175e62b91575caa62f52f58461e514517dab60afec3b874fb430dbbecdcb7b8cbc02610b7cd6f21062cf36224437f3886c6ebeb9101e2c1282

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
edc8a36345af0f46ad16d89b5612a3b5

SHA1
dc7faebb068a0f9933de57ec5a47ae7d96e62dbc

SHA256
78f20a6653b8a57504c99408fc67a8d16e5a38ea4436bd8f1d8c83b050acac62

SHA512
a4f3c92926fab93cfd4f8775ffb2b5eab9fd1c7bb68ff9138847d0d0747105045fbc392948cd9aa909087bf67bd707c73d2a2a9d488f56ce5f69cc14f6236591

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
24d572ed925731584d6e9c177799c427

SHA1
5c8bc022a286e2c473bc015bdff8e0e127d7e83a

SHA256
cfa5850674559f79ae8b64010611db5847947b81de21f3ff6b81bb8f99003bbc

SHA512
1c6fd8b12f97f92ef3159fa971bbabccc06a66817b40177ee536c285756d78a405aeea75e1c4bc0a576ccc520e747f007391b6bfbe91f5cfbf67d03952ac0b34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
149KB

MD5
8007c45937947eeb4db017d6b94981ea

SHA1
e59cce1b0232146dd0f19cc01ccf81a582c26674

SHA256
3d8872fb30645d120594484ee6d044071df23567fe1b87bc0ffff302f11bca5a

SHA512
a39c4e2fd88cfba0bb82ac0df43a43460f881e9858e732441d39b3b29c097da3f62b4751b9a47c09aa8612d46015dd54a364f1e8054a32512f4f48f9042f96e7

Download Submit
\??\pipe\crashpad_2124_OXNAJLEUJSJIKWNQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\Downloads\s.exe
Filesize
78KB

MD5
3660e0d18df32d558826726388e4d0ff

SHA1
e15249056f19d0b06ff1750e6244d01c0099092d

SHA256
257071a8b0e16a9deda47a7b2f21617c4b20da887ecaba215e9e81bf2a182407

SHA512
303d7934478431e066d67f6fecc8a0195beebf83b477adbb4c90d3cf38490fa7558c270d732a8f7bad24e72bf7b872a34d1afc50b517b0d935fe42b58f777be8

Download Submit
memory/1288-210-0x000000013F720000-0x000000013F738000-memory.dmp

Filesize
96KB

Download
memory/3000-160-0x000007FEF3400000-0x000007FEF3DEC000-memory.dmp

Filesize
9.9MB

Download
memory/3000-158-0x000007FEF3400000-0x000007FEF3DEC000-memory.dmp

Filesize
9.9MB

Download
memory/3000-153-0x000000013F120000-0x000000013F138000-memory.dmp

Filesize
96KB

Download
memory/3000-152-0x000007FEF3403000-0x000007FEF3404000-memory.dmp

Filesize
4KB

Download