stealc | hxxp://5[.]42[.]66[.]10/download/th/space[.]php

Analysis

max time kernel
141s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://5.42.66.10/download/th/space.php
Sample240625-rm7vravdke

Score

10^/10

stealc vidar 85e5ab22cf33aa5065a9f4df634d4c87 discovery spyware stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

Version

10.1

Botnet

85e5ab22cf33aa5065a9f4df634d4c87

https://t.me/memve4erin
https://steamcommunity.com/profiles/76561199699680841

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0

Signatures

Detect Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral2/memory/5472-145-0x0000000000400000-0x000000000064B000-memory.dmp	family_vidar_v7
behavioral2/memory/5472-147-0x0000000000400000-0x000000000064B000-memory.dmp	family_vidar_v7
behavioral2/memory/5472-149-0x0000000000400000-0x000000000064B000-memory.dmp	family_vidar_v7
behavioral2/memory/5472-162-0x0000000000400000-0x000000000064B000-memory.dmp	family_vidar_v7
behavioral2/memory/5472-216-0x0000000000400000-0x000000000064B000-memory.dmp	family_vidar_v7
behavioral2/memory/5472-274-0x0000000000400000-0x000000000064B000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3476	softwaredef.exe
5368	GCBFBGCGIJ.exe
4964	CAFHIJDHDG.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3476 set thread context of 5472	3476	softwaredef.exe	117
PID 5368 set thread context of 6056	5368	GCBFBGCGIJ.exe	122
PID 4964 set thread context of 1656	4964	CAFHIJDHDG.exe	128

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3232	4964	WerFault.exe	125
5980	5368	WerFault.exe	120

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5796	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637988014304294"	chrome.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2260	chrome.exe
2260	chrome.exe
5472	MSBuild.exe
5472	MSBuild.exe
5472	MSBuild.exe
5472	MSBuild.exe
5472	MSBuild.exe
5472	MSBuild.exe
5472	MSBuild.exe
5472	MSBuild.exe
5472	MSBuild.exe
5472	MSBuild.exe
5472	MSBuild.exe
5472	MSBuild.exe
3208	chrome.exe
3208	chrome.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe
6056	RegAsm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2260	chrome.exe
2260	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe
Token: SeShutdownPrivilege	2260	chrome.exe
Token: SeCreatePagefilePrivilege	2260	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe
2260	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2428	2260	chrome.exe	91
PID 2260 wrote to memory of 2428	2260	chrome.exe	91
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 3204	2260	chrome.exe	93
PID 2260 wrote to memory of 4260	2260	chrome.exe	94
PID 2260 wrote to memory of 4260	2260	chrome.exe	94
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95
PID 2260 wrote to memory of 1868	2260	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://5.42.66.10/download/th/space.php
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd94569758,0x7ffd94569768,0x7ffd94569778
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:2
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4604 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4648 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4964 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:8
  2⤵
  PID:340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5056 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:8
  2⤵
  PID:116
- C:\Users\Admin\Downloads\softwaredef.exe
  "C:\Users\Admin\Downloads\softwaredef.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3476
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5472
  - - C:\ProgramData\GCBFBGCGIJ.exe
      "C:\ProgramData\GCBFBGCGIJ.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5368
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 304
        5⤵
        Program crash
        
        PID:5980
  - - C:\ProgramData\CAFHIJDHDG.exe
      "C:\ProgramData\CAFHIJDHDG.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4964
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:1656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 308
        5⤵
        Program crash
        
        PID:3232
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JEGHDAFIDGDA" & exit
      4⤵
      PID:5964
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1872,i,5522582880367634134,7232086266140724226,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2340 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:3
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5368 -ip 5368
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4964 -ip 4964
1⤵
PID:5376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CAFHIJDHDG.exe

Path C:\ProgramData\CAFHIJDHDG.exe
Size 1.8MB
SHA256 514efbae5faa43878c743c3db36f81c25ab5d6da93b879b6e88e7a63b1b19769
MD5 c6c9f27d335d4e47b5ea12653e806be6
SHA1 e53242d463e2c94383ec646e7e04504b96b4d176
SHA512 7e00bdac39c89821b776dda372693d29e0e7188f8ef747037b971461af79545908f8fc8c9bbf7a30f1b0cc4ceea45632e91c1093e784002994808c19bd2a7347
SSDEEP 49152:KWPLwXMkW4itwCBDtixjSzceiLYtV25Mm8eEMMd:tPLPkW4IwcOj6iLYtV+Mw8
MD5 SHA1 SHA512 SSDEEP

Submit Download

GCBFBGCGIJ.exe

Path C:\ProgramData\GCBFBGCGIJ.exe
Size 632KB
SHA256 cc6d774ca5b7d8d89289ccace5a25c5c3db0b30c330c10f0233c1d0cb8c9e24c
MD5 b60d8d01724703616e7cbbd320a9bd75
SHA1 16f170f595d6db225f1376315406bf10146d1743
SHA512 7560876438eb1401b542ff491e3d800b3ba06163ef62362f4e8a1e0bab26d809a24d045d396f2269648114c67ceb9dfec96f33f8b1491257b4240179345d0d00
SSDEEP 12288:w+DhsWSlBrPzT/UeGyelDhWAkyuqvPBKPbg9:w+DZSHjhGJloAklQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 148KB
SHA256 a9119e57173df1734c3b4128cc2a63b1d867410b3e721de6443f0a142ba40f03
MD5 5e010afa5d675f8f10c811f0ac684737
SHA1 2f583e44c664cd0178f4941236895add133d172f
SHA512 de37152906ba94299fdabc4f97408977c6f37c0885ab1c18b20700ca89cbaab2c4dbfc13a0aee763c5d055e5129e912da0ed814e362145b17d4793476fd72ac1
SSDEEP 96:wAukleseU+bF+UIYysX0xnqyZoTtczVHNrLBL7wC68:wvQ+bF+UI3ikqyZWOzVHRx7wl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 e595103a827c8ce514cc363adf378e37576fc8198381f96e828c3e3cf3ced7e6
MD5 9b26ea894d48c244df96216aeccd8749
SHA1 83b23cfa898d38fe478d8dae723111f3520f60b2
SHA512 988c3f739fe4edeb612154b5f77788e3def8900bb9be2d8197e493852af0614e0d7c6e3ce80af1c943a8deb92d0127da16f5c47344d47a62088bd7969d93cdf4
SSDEEP 96:6eXICKIYkrqd8iZRy7Di+6MsmdeyOsy21JjVhYtjEsXt0/cg2Vup:6yZO8syy+Ft/otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 a6b0216089be1198c70deb95514be2f070e3f5856c8cec94b7fa14996d17803b
MD5 13bcb07428e3f4cd8f0fb0ab7ef68a6a
SHA1 a73c884439f5b11138610886067e1815a3a76696
SHA512 c3c5bbb2cd2291c37ee32e14d93679ab58fd28bff043514ac799e95928d937213216418b676bde6d16cf6d8f42d40ef9294c72572efb67481bb20d89b22c9d49
SSDEEP 96:6ejICKIYkrqd8iZRy7Di+6Msmde1IOsy21JjVhYtjEsXt0/cg2Vup:6OZO8syy+FEE/otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 c2e59182d3c9f1182c9eadaad427e31e76cb7f4adb26e241691b72cac702cbcd
MD5 5fb6af934c18c615ef2f8c4c2725cee3
SHA1 bccf0f986159a26a717db9f5ae3a65aa4164370b
SHA512 b836708cef631db737143e876f8842b557f127822a0e6f4e8dfefe8fc3475a72a2ccb1bb47cdc4e999c7f85a9393105fb5812cc68b8c61daa961b05078e3cbef
SSDEEP 96:6eXICKIYkrqd8iZRy7Di+6Msmde1IOsy21JjVhYtjEsXt0/cg2Vup:6yZO8syy+FEE/otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 c7c84e8cf849efcb0fc3dedec1b4ace5ba3cd7850460315fe3305e80fecd0092
MD5 568d93534523688cd45ed798dbcec494
SHA1 b53c9a4f37e3ae5e50e31fb449c801c97d4dcbdc
SHA512 038c7dee657d501510fb04fabd8c475643ada330013eee5f57c498430b5a4881f2db5be591710316f22913f6819e57e348dc4870eae8eed90d8ea88d11fe643b
SSDEEP 96:6eXICKIYkrqd8iZRy7Di+6MsmdeTOsy21JjVhYtjEsXt0/cg2Vup:6yZO8syy+Fa/otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 fa4ce371fb184d2541f9ae9f67ecefa39a47166955b89254b21ad1075cafc7f9
MD5 345192c2eca6b4de6fcd3538e393ca72
SHA1 a4836ba04ab88b060e05073a96c3ed4276d704d9
SHA512 f7c4ecfa5f4e5055281591ff275539f4b7cd63415c4002fee1f824e715459b490469a4444dc68f4cef17dcedc4d104a24379e986addb82822dbb177ce756f737
SSDEEP 3072:64Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+Z8:BASNdvXCNpbMHtCMpSc
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

softwaredef.exe

Path C:\Users\Admin\Downloads\softwaredef.exe
Size 5.1MB
SHA256 c8883f098885598233e55dd11234369ae54c4b4ea617c4a2e8401c2e8cf0c127
MD5 54e6e3cbd08181c9254352cd534cf17f
SHA1 5be3192131e1d14af3fd02940d3378ebeeb80865
SHA512 7fb9f5df2e58876f45d7f413bdb8c44f388f194f5381d960ec6f8a2a9756c9ff59407f33db6f26a344e1ce63b56337f66252f10886b3cc0a8c5a1feef89bcc51
SSDEEP 98304:xnaPlaEWk0q5QeGnUjA+0Durx0pfjTZH8:xa9aEHfGnUjA+0IxajTZH8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3476-124-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-84-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-130-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-128-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-126-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-120-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-122-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-76-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-118-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-116-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-114-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-112-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-108-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-106-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-104-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-102-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-100-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-98-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-94-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-92-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-90-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-88-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-86-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-82-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-80-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-134-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-78-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-110-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-96-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-132-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-75-0x00000000058E0000-0x00000000058F5000-memory.dmp

Download

memory/3476-144-0x0000000074D00000-0x00000000754B0000-memory.dmp

Download

memory/3476-65-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

Download

memory/3476-66-0x00000000009D0000-0x0000000000EF6000-memory.dmp

Download

memory/3476-69-0x00000000059C0000-0x0000000005A5C000-memory.dmp

Download

memory/3476-150-0x0000000074D00000-0x00000000754B0000-memory.dmp

Download

memory/3476-70-0x0000000074D00000-0x00000000754B0000-memory.dmp

Download

memory/3476-74-0x00000000058E0000-0x00000000058FC000-memory.dmp

Download

memory/3476-73-0x0000000005A60000-0x0000000005B7E000-memory.dmp

Download

memory/5472-145-0x0000000000400000-0x000000000064B000-memory.dmp

Download

memory/5472-162-0x0000000000400000-0x000000000064B000-memory.dmp

Download

memory/5472-149-0x0000000000400000-0x000000000064B000-memory.dmp

Download

memory/5472-147-0x0000000000400000-0x000000000064B000-memory.dmp

Download

memory/5472-216-0x0000000000400000-0x000000000064B000-memory.dmp

Download

memory/5472-274-0x0000000000400000-0x000000000064B000-memory.dmp

Download

memory/6056-275-0x0000000008890000-0x0000000008EA8000-memory.dmp

Download

memory/6056-278-0x0000000008330000-0x000000000836C000-memory.dmp

Download

memory/6056-273-0x00000000051B0000-0x00000000051BA000-memory.dmp

Download

memory/6056-250-0x00000000056D0000-0x0000000005C74000-memory.dmp

Download

memory/6056-245-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/6056-276-0x0000000008400000-0x000000000850A000-memory.dmp

Download

memory/6056-277-0x0000000008110000-0x0000000008122000-memory.dmp

Download

memory/6056-256-0x00000000051C0000-0x0000000005252000-memory.dmp

Download

memory/6056-279-0x0000000008370000-0x00000000083BC000-memory.dmp

Download

memory/6056-285-0x00000000090B0000-0x0000000009116000-memory.dmp

Download

memory/6056-286-0x00000000093E0000-0x0000000009456000-memory.dmp

Download

memory/6056-287-0x00000000093C0000-0x00000000093DE000-memory.dmp

Download

memory/6056-288-0x000000000A1B0000-0x000000000A372000-memory.dmp

Download

memory/6056-289-0x000000000A8B0000-0x000000000ADDC000-memory.dmp

Download