stealerium | hxxps://gofile[.]io/d/FiiYWs

Analysis

max time kernel
218s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/FiiYWs

Score

10^/10

stealerium collection spyware stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1251557452009177259/QqjCcNiJRsd3SRmUA39PPuQQEQ83RjDb-1nGV-nsnwOdyxggjgc5oUAkjo2HIeDx24Zu

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
632	build.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
66	discord.com
67	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
69	icanhazip.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
760	632	WerFault.exe	111

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	build.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133629403800576632"	chrome.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
3348	chrome.exe
3348	chrome.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe
632	build.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe
Token: SeShutdownPrivilege	4372	chrome.exe
Token: SeCreatePagefilePrivilege	4372	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2964	4372	chrome.exe	83
PID 4372 wrote to memory of 2964	4372	chrome.exe	83
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 1728	4372	chrome.exe	85
PID 4372 wrote to memory of 3740	4372	chrome.exe	86
PID 4372 wrote to memory of 3740	4372	chrome.exe	86
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87
PID 4372 wrote to memory of 2008	4372	chrome.exe	87

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/FiiYWs
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80afcab58,0x7ff80afcab68,0x7ff80afcab78
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:2
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4292 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2620 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1140 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4872 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3432 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3036 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5104 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1892,i,14825362539139800972,8426071861583330514,131072 /prefetch:8
  2⤵
  PID:968
- C:\Users\Admin\Downloads\build.exe
  "C:\Users\Admin\Downloads\build.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - outlook_office_path
  - outlook_win_path
  PID:632
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    PID:3504
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4556
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      PID:4716
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    PID:4276
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:2568
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      PID:3204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 3248
    3⤵
    - Program crash
    PID:760

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1584

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 632 -ip 632
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\932571cbe93e19f05a6a0b3bd1be17df\Admin@TMUACBLB_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\932571cbe93e19f05a6a0b3bd1be17df\Admin@TMUACBLB_en-US\Browsers\Google\Downloads.txt

Filesize
58B

MD5
916af51f526524d884e101ae6c0f7afb

SHA1
452e220ffe9521b592cec5907e09c24d21672d72

SHA256
b4c0984aa51afaaa2fc8811ebfc688301016fb1ab7a4776b0b5e943f9b32f8e1

SHA512
269e3cdf351f18e8cd34baf83d1d9cb656c0923050eab53518fbec4b20da274b93f8c9bf583b3775f0859d308110665913232ad3133d4d208c43c380d6be6527

Download Submit
C:\Users\Admin\AppData\Local\932571cbe93e19f05a6a0b3bd1be17df\Admin@TMUACBLB_en-US\Directories\OneDrive.txt

Filesize
25B

MD5
966247eb3ee749e21597d73c4176bd52

SHA1
1e9e63c2872cef8f015d4b888eb9f81b00a35c79

SHA256
8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

SHA512
bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

Download Submit
C:\Users\Admin\AppData\Local\932571cbe93e19f05a6a0b3bd1be17df\Admin@TMUACBLB_en-US\Directories\Startup.txt

Filesize
24B

MD5
68c93da4981d591704cea7b71cebfb97

SHA1
fd0f8d97463cd33892cc828b4ad04e03fc014fa6

SHA256
889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

SHA512
63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

Download Submit
C:\Users\Admin\AppData\Local\932571cbe93e19f05a6a0b3bd1be17df\Admin@TMUACBLB_en-US\Directories\Videos.txt

Filesize
23B

MD5
1fddbf1169b6c75898b86e7e24bc7c1f

SHA1
d2091060cb5191ff70eb99c0088c182e80c20f8c

SHA256
a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

SHA512
20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

Download Submit
C:\Users\Admin\AppData\Local\932571cbe93e19f05a6a0b3bd1be17df\Admin@TMUACBLB_en-US\System\Apps.txt

Filesize
6KB

MD5
4257c7f9254560cb18e28a66685d6ca6

SHA1
9788366785a7e081fb37e53ec6f66c450abcab06

SHA256
3b33efee65742d53770d7ce42098c1bb348f0d2915edd9904c9e7ee2056b8c62

SHA512
bd085738ecd142ac2d3c83390e77acf4f4a108f54b988bc3f0113fc40b2f1b14c4d8b6de5ed29369ae9fc4a1e4ee356c24a4749c8f5fdb79330774fc6190ed0c

Download Submit
C:\Users\Admin\AppData\Local\932571cbe93e19f05a6a0b3bd1be17df\Admin@TMUACBLB_en-US\System\Debug.txt

Filesize
1KB

MD5
6215aecbd112458bb9d96c0466ec6d97

SHA1
b50b7a06051b498603434e790201ba789dd84fea

SHA256
c0dd9593489d4ba8bf5d8fb4d02e3e5d91a93ef0acd748760f86c4fc3cc9cc30

SHA512
b367dad0655b6f47599bca01c50b3f4ece216c8a85cbb9e4f6cf48523a43ba0d7f6ea22856d06b0c95b7810e3ba9ad4248013d7209f0926950bba807db1e1253

Download Submit
C:\Users\Admin\AppData\Local\932571cbe93e19f05a6a0b3bd1be17df\Admin@TMUACBLB_en-US\System\Process.txt

Filesize
4KB

MD5
483d3fb6549eb3bd7dc708e3ac7d0aef

SHA1
6e9da56a52784657df3247f8951dfde33a3ba684

SHA256
954168e9672f5978e44166ca388c6e815a0a28988c4625848240dc64210a7524

SHA512
4e2c7fbae3becd4380351f7a673acade4b2623b80f07f1d7aefd0e91dfb71ad197f6d236f1e41b01f5bd63b2b74581096f7d52486421d7644c80279bcac1c1d6

Download Submit
C:\Users\Admin\AppData\Local\932571cbe93e19f05a6a0b3bd1be17df\Admin@TMUACBLB_en-US\System\ProductKey.txt

Filesize
29B

MD5
71eb5479298c7afc6d126fa04d2a9bde

SHA1
a9b3d5505cf9f84bb6c2be2acece53cb40075113

SHA256
f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

SHA512
7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
50fc07ebb5b221cef8babbbf57d4632c

SHA1
bd3eeac779e2e8e87e310b8c0b7845af00317c5d

SHA256
548ba1b9e396b0457eedb61a170d93d70ab88889448c2ab2d104de2c3221e5c3

SHA512
d811a720f7dc0404c16f3153ef69b28f0b379321aefd80f37c88cc9ee2d280ee9b9f9bb527b4bd7673e03f2d17ddde1daaa209198173455f3e1a4541bf6a998d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
152KB

MD5
113a4e2473f175be7fd010f06f0364e3

SHA1
ee47ba81a2fc749d7f1612035078722ab8fb4284

SHA256
99e60c0d3b52149beef77710386ed21967d47e8f2e212a31edd528d42f47cbbb

SHA512
fa74e380e4baf026fa21fcb3e8ebd16bef347961df9edd914f1431cb4c4893ff99e6df3c869ec99fa6f6f4f32c1896cd34923011a9b419974de68dfdafe68c4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5fc8ffd3a63995642cece8ae267d795f

SHA1
825093b979b7468b498b1ab74e81319d86ff77be

SHA256
3691e41fde68a2aa7c33b96a8650d9105081dad79ec3a6a4f14147b977617b71

SHA512
8ab8638c03ae2c9687430d7e4f88a99409f4194a91a548ebb76691fcccbe7a371069ebf52f3a01db14022925d974d6b26caa61b7538f1ae3cc35982cb9f8978d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
682B

MD5
5a6afec749cbbd43bf1d837de3eeb5f5

SHA1
6740f49c8097c414a0f97f0131f1017a2d58115b

SHA256
0718c1845df9e412810039583353e9746b952de0a322fc2538c651b2feed1dbf

SHA512
d7026a9892485282d8a72c5951d442affeb05f89790339dec6e251f62b6995a75e69b899391b3a15c2a287966c320d68c33358a3ecb44c7bf48daa0b34c98250

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9755e38cf0ffcba59524d8e006fff086

SHA1
af94c7013785b3b4713df9c2c67c1cdabc59804b

SHA256
194dfbb53857d048bd0f8e4d7e77ec9a5fe4b7a45b39d6350211293bd4339a94

SHA512
b5e7bcf9e032366d927c07ab1d946ca0af8fb5ef99a34a4ebc247d8a6c0dde136be5f49d03be055653cb36b8c1bad5edd3ec550fc111b5a27f8292e5bb8f1d40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
4d3edaa14620919796b97c7ed4a98314

SHA1
3e62fa6a96ea5f5e6bec3fe4f2bb3dc760393323

SHA256
cf08382a53daaa4e5c238933aebdaed98c8678205f633569e1f3afa5f89e0dce

SHA512
5ca08401b99584decd9bbcce2cd3236748d13b45901cec65ce48a608297600b62898b03c3f9d6ef5aeae127bd7b97f79951a492eb34d969076e0750e0bd66e28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6a482e2bbff14c35d5a72b2e2d879375

SHA1
f8d9bb32d69ddb34ece331f54bf582a62c513c4b

SHA256
59f186369b18427ac02e093d16b33eaa656e4118e6f9d556bf2e22ad7a035893

SHA512
d796c2fee2b8f5c244f0a6aaca186c050337785d38380edf821620f6cfa347287a474b6371674af5596c7c4863c97c35d0ef11040dfa7a5283f63096eb45ed8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
2ce1c7731ffcab10f2e6a7c7229946b3

SHA1
a56ea8bb30e8e80c1e3fa9e91a4ce06a99486f56

SHA256
d91b6088e8cfd690b029d7cf55a660f4ab3800354491e2c3e0f84745c7fcf0f3

SHA512
5b3e6a0023bd120ac4c64e293a395ab546e4d2daf45524164f1ccd43c71db4059c89853098bc07c060756807fe231bf8ce3d93e7c9e76ac2f379a62e247c6287

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
881080738c7471ba6ba8dd527a2e0bde

SHA1
97dbc359daddfbb4ea415cc0159c953969d97327

SHA256
7e575d3a84899fca6a978ce2710233f0458a9e2396efdfcfd78d0eeee9228597

SHA512
e6916a8ffa3898e176fffd5446d9f32fc044550970aab1e727120ad25dcc55ad42bcb1ea30882ae5abeee1be20038b8b7ff1136d6ada05d7df2745c874a2bae5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59fe9a.TMP

Filesize
88KB

MD5
9557831047edb812fab436046182b37a

SHA1
eacee9b1dd8e508abd7ac4639adf859480aa5dae

SHA256
cc262167958f868316e623adf115a40ccc0ab02a3f968845df04506597df8a57

SHA512
4c1adede98cb56a13aa1732775e9e2f90f6a8ed6b80ce3c359784820050261b1b7ab3f11deb4bc37ef33a7acf0073c0fb134df975808040e86c816ffcda35ccf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 884307.crdownload

Filesize
1.6MB

MD5
34f741c816af00ddf3bca8a7910aa796

SHA1
09b6885440a375d054ae491d7b9de7c09a99baf4

SHA256
4679d2ea8f99f5f5eb1aaeff890417824f7cf6d9ca5e6345913dcd573655be19

SHA512
9a175c06598d1a5debc2822acb62dc2dd3b682433654c24e86828d99391689226dec4f22ff2df1218af376802ef270babae60b02106df2f4601ee386c256b98b

Download Submit
memory/632-164-0x0000000006170000-0x000000000618E000-memory.dmp

Filesize
120KB

Download
memory/632-229-0x0000000007080000-0x0000000007624000-memory.dmp

Filesize
5.6MB

Download
memory/632-224-0x0000000006830000-0x00000000068C2000-memory.dmp

Filesize
584KB

Download
memory/632-163-0x0000000006150000-0x0000000006158000-memory.dmp

Filesize
32KB

Download
memory/632-162-0x0000000006140000-0x000000000614A000-memory.dmp

Filesize
40KB

Download
memory/632-367-0x00000000062D0000-0x000000000634A000-memory.dmp

Filesize
488KB

Download
memory/632-152-0x0000000005220000-0x0000000005228000-memory.dmp

Filesize
32KB

Download
memory/632-151-0x00000000051F0000-0x0000000005216000-memory.dmp

Filesize
152KB

Download
memory/632-150-0x0000000005160000-0x00000000051F2000-memory.dmp

Filesize
584KB

Download
memory/632-144-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/632-143-0x0000000004C40000-0x0000000004CA6000-memory.dmp

Filesize
408KB

Download
memory/632-142-0x00000000000B0000-0x0000000000242000-memory.dmp

Filesize
1.6MB

Download
memory/632-449-0x0000000006690000-0x0000000006742000-memory.dmp

Filesize
712KB

Download
memory/632-451-0x0000000006400000-0x0000000006422000-memory.dmp

Filesize
136KB

Download
memory/632-452-0x0000000007830000-0x0000000007B84000-memory.dmp

Filesize
3.3MB

Download
memory/632-453-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/632-141-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download