discordrat | hxxps://uploadnow[.]io/f/Cjkxnjr

Resubmissions

23-09-2024 06:09

240923-gwfshsxerb 3

08-09-2024 07:36

240908-jfrk7atfkr 10

Analysis

max time kernel
153s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 07:36

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://uploadnow.io/f/Cjkxnjr

Score

10^/10

discordrat credential_access discovery persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyODQyMTY2ODcxMjc0MjkyMw.G0xS_t.r4U6VkyZJ2UIdIqoBwU0SC9thIqegYEqjd-I9I
server_id
1282239514231701626

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
5496	FPS+.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
123	raw.githubusercontent.com
125	discord.com
126	discord.com
92	discord.com
96	discord.com
106	discord.com
91	discord.com
107	discord.com
124	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 417958.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
3728	msedge.exe
3728	msedge.exe
5092	identity_helper.exe
5092	identity_helper.exe
5348	msedge.exe
5348	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5496	FPS+.exe
Token: SeShutdownPrivilege	5496	FPS+.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 2396	3728	msedge.exe	86
PID 3728 wrote to memory of 2396	3728	msedge.exe	86
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 4660	3728	msedge.exe	87
PID 3728 wrote to memory of 2136	3728	msedge.exe	88
PID 3728 wrote to memory of 2136	3728	msedge.exe	88
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89
PID 3728 wrote to memory of 1772	3728	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://uploadnow.io/f/Cjkxnjr
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2b9046f8,0x7ffb2b904708,0x7ffb2b904718
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5348
- C:\Users\Admin\Downloads\FPS+.exe
  "C:\Users\Admin\Downloads\FPS+.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4212204178779002260,5330995653030748991,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
78KB

MD5
59c79baf3c417eddd625b43274f89e04

SHA1
07f4a72d8b2bb99f1d9441001c36392480428e68

SHA256
b48f6d98933fa65efb43959e05a95cfcf0cfaaf5a0994cf7d860f380c5ed3ffc

SHA512
82fd1b3b12ed7e53dc399eaa4df98a549d64ed5f0bf327844c2cbec9d490307172c7a728d9df30439c5d5883f927ebf8bcdbe534424217b5ef7edd915d0711b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e670b06c2484dad757261afca05d1de7

SHA1
eab03a0053fb7accbe937fd6878be3b28977cfe6

SHA256
400087d5c38b0819203bac6474cd7179019a3dfae50e4d2be98718645be5d24c

SHA512
d72ca56491c2896d051f98210b0c0bdea4ecef6e0ec9e2e2836bdfc5ced25ed9f6ffc8347d4b350ed205fcb77e00f478688987a53b7a95c5bbc8219fd0034d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
91240e26309892bf269502b6d120abb2

SHA1
1f9290f9fe36d86c27d768b9dd4d509e2faaf471

SHA256
ef48051b4905971db6c7208dd9aabc6ae6e24519bdaceac060cc3e8856fe582e

SHA512
671e26cde3a5f2eaa27c512f4d39949490db809caa4c22cb4619be1e29e710fa0cf0c1e761706eac74e17e733b9e23cab818603e933f0dc407060887eba8f916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c5533992970be2e4f2ceb26a65eec6c7

SHA1
e2105986721b46192b603c90be1e6da74ad666e1

SHA256
3a585cdea00d018485d5d0cfd3c82dfc1d2f9f5978259cefa2a3a07ca12b733d

SHA512
248bb360bea600331e8a60bad8efd92c0ca8befdfabcb59cc781ab9014128571456210615fa65419029b0c223d4e2ff60ae14a07e09adc0f80651163c8d9bc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c01936f5eeef5ca8704325a7f08409fe

SHA1
fd492fc033b83a8e5f7b28c8c967f17c254ca326

SHA256
f798bd93da4667c4baf9d0ae809223221b4cfa4545512cb673a3c619509a955b

SHA512
8bcbc564edb41eebd90936ea9a067bc75578eb338bb40f72efab6ccea96c60813bd8362270ee51d2525ff34cd1841c00cd4db089639a2ad64b01033d47989694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fe7eafe78ef227789afc662d3196b160

SHA1
0c064e2422424cc71f23f0cb7c7553b1b2127c28

SHA256
c9fde370ce0a6cfcf2185b245b897b68703d2330c17d27796ced82733c11551c

SHA512
adef724042739a8c2c96de96cd9f5e349acb7641633fa1496eb345d8546edf42a048b85218e40a5ac42594ac9729c4d507e86458e37d4c061577397b4c162a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3cac9e8f63a9dc8fe155b36b54ac5b53

SHA1
0ab71885acefb50e460acba187ad93823d092383

SHA256
a7ba0219acf8bf8ae8db19ed881f4ba981602cafbdb1130cea9e4ef2782d3213

SHA512
767fc8fa08829027c76b8bcc39f813a304180a2ee3a7b3773d34754a74262269d8f33274b75281ec63b6a7f337c0dce14f7aae4ab8a2ba2e65619f2aac99e67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f9a37d25f58d10e2219f6fe74e0d4d6d

SHA1
04923ef2c276edf73b9b3be725babe755c5a6f12

SHA256
1badef616dfa2ee2eb85c8c05593a5b415403aa067f41f37d419a534fb66f217

SHA512
675008131384acdcc1f022549985eab1c2974ccf8d029b58d81d66cabb24d2bc7bd096d7fc38fd8ddb213299754d1ee468e1217afb9d15cd65721d7d0bb06060

Download Submit
memory/5496-288-0x0000024799D60000-0x0000024799D78000-memory.dmp

Filesize
96KB

Download
memory/5496-289-0x00000247B42E0000-0x00000247B44A2000-memory.dmp

Filesize
1.8MB

Download
memory/5496-290-0x00000247B4B20000-0x00000247B5048000-memory.dmp

Filesize
5.2MB

Download
memory/5496-367-0x00000247B4670000-0x00000247B46E6000-memory.dmp

Filesize
472KB

Download
memory/5496-368-0x00000247B4230000-0x00000247B4242000-memory.dmp

Filesize
72KB

Download
memory/5496-369-0x00000247B42C0000-0x00000247B42DE000-memory.dmp

Filesize
120KB

Download