vipkeylogger | 91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
Size 628KB
Sample241008-rt3jlsvcjh
SHA256 91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558
MD5 2109de45c8c7542e52810b82902a2c5f
SHA1 9d0524fdcba9efa020225e50e5a0fdf299871d16
SHA512 3cfe10ee0e11a20319f185246cdb8339b7113258753aa23951539318858ab0ec0d591fe3b448936bf1e562de24758a4913be6a41676e23568689921f5b28acdf
SSDEEP 6144:BDKW1Lgbdl0TBBvjc/rgXUXKoIU+jw23G+g1mM2Ob5:xh1Lk70TnvjcIM/IUQw2LgMMX5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vipkeylogger collection discovery keylogger spyware stealer

Malware Config

Extracted

Family

vipkeylogger

https://api.telegram.org/bot7473786847:AAF6uyQFCEEhsMFIK2gBbi2HMTnWRW2OqSY/sendMessage?chat_id=7443879801

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.dyndns.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
2344	msedge.exe
2344	msedge.exe
5032	msedge.exe
5032	msedge.exe
4900	identity_helper.exe
4900	identity_helper.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 5032	416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe	85
PID 416 wrote to memory of 5032	416	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe	85
PID 5032 wrote to memory of 3192	5032	msedge.exe	86
PID 5032 wrote to memory of 3192	5032	msedge.exe	86
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2064	5032	msedge.exe	87
PID 5032 wrote to memory of 2344	5032	msedge.exe	88
PID 5032 wrote to memory of 2344	5032	msedge.exe	88
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89
PID 5032 wrote to memory of 2228	5032	msedge.exe	89

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe

C:\Users\Admin\AppData\Local\Temp\91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe
"C:\Users\Admin\AppData\Local\Temp\91440b2ada60e6183e71df076a43011f5dc65a7f2a487e9291fb2bc6fd3e8558.exe"
1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://helpx.adobe.com/acrobat/kb/cant-open-pdf.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8568146f8,0x7ff856814708,0x7ff856814718
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13819825896000662398,10354610545429528980,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5488 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
MD5 e55832d7cd7e868a2c087c4c73678018
SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 9b372e9893c7241ba05cf55b90025d4dc36196d1b646da5a38c4944ebf32af45
MD5 1aa05164aaf3c6e6390340330f6716aa
SHA1 3a0be42f359f0db7fb3d3f569553751b20305934
SHA512 9187570c7168ed4f9353dec822c2f867ad429002a600ca2035ee3d3bcf822ee2cb0b6cb5b6798cfc5e5752f3d87a81925478235ebfd6084fe17548dc5ab2ffc1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 0b88a3220b4fbfa53a001ac7452dc362591f7961ca32c3dc29ceea4d515ddbb0
MD5 8a7416b6149b716b2b6a322f5232891d
SHA1 fb31e4c547aecba63611f120772c230aec22e82a
SHA512 f19cb4a83c54749dd384cddc4dc4ef48a924912a460a126f0cbe3a529a51f7253fab43f619bbdae49806be29c1325f25addcf527500a5e04c4dccb5d59169bda
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a080d9a3463afec94a3c04e4f406c22f8affed15d44367c4d23c93cb7621f7b9
MD5 fb859b662a207201d6924be581dd1339
SHA1 ee1c0bf8f9489176fb904973c02ae3de23981bea
SHA512 0a46545c31a6b942632574e02e090f6772d6f6cae33e5a6f610443bb576aac7ed049ba29af8981ccdc09353b709b393bd2d6acade857f0b5e4607e5a2afb7255
SSDEEP 96:njkVB1+YPfkwpvWMoiVmdeHyc/UWQyV+VDCziEwb:njkf0YUGWMX3ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bc50a1252446ab40cd7a789354e78a78fb8558ad5dc0c921a24a896052473e5e
MD5 69abda390d48fdc79008454f3df8a564
SHA1 07a636e7a0fdfba27acda75c671acb20256adf5c
SHA512 ad8aa4f55da6acc1106eb85f00497a9a2b0b08444deb58d7793ebf2d314f4ab8d98cb0cb12fe3bb542faf1207726972164810577b17419120eb294e55ba931ca
SSDEEP 96:njkMB1GoPfkwpvWMoiVmdeLu91kERykef2yx/UWQyV+VD7AiEwb:njkMQoUGWM7u9bRTef2Krg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 601f99fae0c72ff01fa953a1bb78d85075dd865f455d2c59a259083eaad517e2
MD5 a7347075e08ba38dbacc51039651c7b7
SHA1 3cb350981e65e80e587c9199003a9b1fe1fee7aa
SHA512 9213faef5b552e43d1bf9830c83136feddc54535fb5e8a07c57525e879a1f4c42a7c88fb22070f5196c2cea82c4b5e5669f37cdf6ed041cd014cad9c525fbdd5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphte2RUC+p4z36+B1EsB7u:A9iIxuERzA83h09RZxYhpbdbE87u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ff1040c3dcdd7d8c583ab7a49f092386a412ab25933923dd840e33cb8b25b48e
MD5 bfd7f32369720694863c8d2a2d8e4026
SHA1 e7fb34b19455ed057caa33f565c9f94762e6152c
SHA512 26966d579adf93a7ead093a8a567314392ed8644d408b439cbce7abf362840479b2817175faad8e1b0d67d6ff0491379090eddb1af012408bf6e2b1d6f8404ca
SSDEEP 192:IoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuph0e2RUC+SJBCz5vPs/zi6j:w9iIxuERzA83h09RZxYh6RPkPs7ibE8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/416-6-0x0000000074850000-0x0000000075000000-memory.dmp

Download

memory/416-156-0x0000000074850000-0x0000000075000000-memory.dmp

Download

memory/416-8-0x0000000074850000-0x0000000075000000-memory.dmp

Download

memory/416-7-0x0000000074850000-0x0000000075000000-memory.dmp

Download

memory/416-0-0x000000007485E000-0x000000007485F000-memory.dmp

Download

memory/416-132-0x0000000006700000-0x00000000068C2000-memory.dmp

Download

memory/416-133-0x00000000061E0000-0x0000000006230000-memory.dmp

Download

memory/416-152-0x00000000068D0000-0x0000000006DFC000-memory.dmp

Download

memory/416-155-0x000000007485E000-0x000000007485F000-memory.dmp

Download

memory/416-9-0x0000000006660000-0x00000000066F2000-memory.dmp

Download

memory/416-161-0x0000000074850000-0x0000000075000000-memory.dmp

Download

memory/416-5-0x0000000004C30000-0x0000000004CCC000-memory.dmp

Download

memory/416-2-0x0000000074850000-0x0000000075000000-memory.dmp

Download

memory/416-178-0x0000000007210000-0x000000000721A000-memory.dmp

Download

memory/416-4-0x0000000002740000-0x0000000002794000-memory.dmp

Download

memory/416-3-0x0000000004D20000-0x00000000052C4000-memory.dmp

Download

memory/416-1-0x0000000002540000-0x0000000002594000-memory.dmp

Download