vidar | e5d4292ecf0f3e2c0f49c14054dd38fd3bb406dbdf6cb57c4cb51ba381323491

Analysis

max time kernel
82s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Unlock_Tool_2.3.rar
Size

43.5MB
MD5

aba901d2df207e0fb7126ac4ed6b0b92
SHA1

2b054c739404e122e39c6e8b50d2af0cd0a31b46
SHA256

e5d4292ecf0f3e2c0f49c14054dd38fd3bb406dbdf6cb57c4cb51ba381323491
SHA512

af437424302b25d833e609fac5e103a1a7d9f2ac4aea7fa98771b9d43dae967d222d8676a2a5129d11188243466a8d3efb94cbcebec5eb0d2a192ac170602dee
SSDEEP

786432:oWERuckDMYkh5bPwA4NWZTxNGPFCMUJ78pdmha2rvvdOl4Eej:oWERaJkhn4gZtUsMUJIz2rvsqT

Score

10^/10

vidar 23a142269e47ce1692ccc9fb68473bc2 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

11.1

Botnet

23a142269e47ce1692ccc9fb68473bc2

https://steamcommunity.com/profiles/76561199786602107

https://t.me/lpnjoke

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

Detect Vidar Stealer 29 IoCs

stealer

resource	yara_rule
behavioral1/memory/2392-627-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-630-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-631-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-640-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-641-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-649-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-650-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-658-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-659-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-675-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-676-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-700-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-701-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-708-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2392-709-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2480-720-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2480-721-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2480-729-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2480-730-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1972-751-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1972-752-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1972-760-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1972-761-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3428-764-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3428-765-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3428-773-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3428-774-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3652-777-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3652-778-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Unlock_Tool_2.3.exe

Executes dropped EXE 8 IoCs

pid	Process
1696	Unlock_Tool_2.3.exe
2392	Unlock_Tool_2.3.exe
856	Unlock_Tool_2.3.exe
2480	Unlock_Tool_2.3.exe
1696	Unlock_Tool_2.3.exe
1972	Unlock_Tool_2.3.exe
2056	Unlock_Tool_2.3.exe
3428	Unlock_Tool_2.3.exe

Loads dropped DLL 2 IoCs

pid	Process
2392	Unlock_Tool_2.3.exe
2392	Unlock_Tool_2.3.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 2392	1696	Unlock_Tool_2.3.exe	104
PID 856 set thread context of 2480	856	Unlock_Tool_2.3.exe	112
PID 1696 set thread context of 1972	1696	Unlock_Tool_2.3.exe	117
PID 2056 set thread context of 3428	2056	Unlock_Tool_2.3.exe	121

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4728	1696	WerFault.exe	102
320	856	WerFault.exe	111
1460	1696	WerFault.exe	116
5080	2056	WerFault.exe	120
3740	2824	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.3.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_2.3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_2.3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_2.3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_2.3.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2964	timeout.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zG.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3444	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2392	Unlock_Tool_2.3.exe
2392	Unlock_Tool_2.3.exe
2392	Unlock_Tool_2.3.exe
2392	Unlock_Tool_2.3.exe
2392	Unlock_Tool_2.3.exe
2392	Unlock_Tool_2.3.exe
2392	Unlock_Tool_2.3.exe
2392	Unlock_Tool_2.3.exe
2480	Unlock_Tool_2.3.exe
2480	Unlock_Tool_2.3.exe
2480	Unlock_Tool_2.3.exe
2480	Unlock_Tool_2.3.exe
1972	Unlock_Tool_2.3.exe
1972	Unlock_Tool_2.3.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3604	7zFM.exe
1220	7zG.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3604	7zFM.exe
Token: 35	3604	7zFM.exe
Token: SeRestorePrivilege	1220	7zG.exe
Token: 35	1220	7zG.exe
Token: SeSecurityPrivilege	1220	7zG.exe
Token: SeSecurityPrivilege	1220	7zG.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3604	7zFM.exe
1220	7zG.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 1220	3604	7zFM.exe	95
PID 3604 wrote to memory of 1220	3604	7zFM.exe	95
PID 1696 wrote to memory of 2392	1696	Unlock_Tool_2.3.exe	104
PID 1696 wrote to memory of 2392	1696	Unlock_Tool_2.3.exe	104
PID 1696 wrote to memory of 2392	1696	Unlock_Tool_2.3.exe	104
PID 1696 wrote to memory of 2392	1696	Unlock_Tool_2.3.exe	104
PID 1696 wrote to memory of 2392	1696	Unlock_Tool_2.3.exe	104
PID 1696 wrote to memory of 2392	1696	Unlock_Tool_2.3.exe	104
PID 1696 wrote to memory of 2392	1696	Unlock_Tool_2.3.exe	104
PID 1696 wrote to memory of 2392	1696	Unlock_Tool_2.3.exe	104
PID 1696 wrote to memory of 2392	1696	Unlock_Tool_2.3.exe	104
PID 1696 wrote to memory of 2392	1696	Unlock_Tool_2.3.exe	104
PID 2392 wrote to memory of 1676	2392	Unlock_Tool_2.3.exe	108
PID 2392 wrote to memory of 1676	2392	Unlock_Tool_2.3.exe	108
PID 2392 wrote to memory of 1676	2392	Unlock_Tool_2.3.exe	108
PID 1676 wrote to memory of 2964	1676	cmd.exe	110
PID 1676 wrote to memory of 2964	1676	cmd.exe	110
PID 1676 wrote to memory of 2964	1676	cmd.exe	110
PID 856 wrote to memory of 2480	856	Unlock_Tool_2.3.exe	112
PID 856 wrote to memory of 2480	856	Unlock_Tool_2.3.exe	112
PID 856 wrote to memory of 2480	856	Unlock_Tool_2.3.exe	112
PID 856 wrote to memory of 2480	856	Unlock_Tool_2.3.exe	112
PID 856 wrote to memory of 2480	856	Unlock_Tool_2.3.exe	112
PID 856 wrote to memory of 2480	856	Unlock_Tool_2.3.exe	112
PID 856 wrote to memory of 2480	856	Unlock_Tool_2.3.exe	112
PID 856 wrote to memory of 2480	856	Unlock_Tool_2.3.exe	112
PID 856 wrote to memory of 2480	856	Unlock_Tool_2.3.exe	112
PID 856 wrote to memory of 2480	856	Unlock_Tool_2.3.exe	112
PID 1696 wrote to memory of 1972	1696	Unlock_Tool_2.3.exe	117
PID 1696 wrote to memory of 1972	1696	Unlock_Tool_2.3.exe	117
PID 1696 wrote to memory of 1972	1696	Unlock_Tool_2.3.exe	117
PID 1696 wrote to memory of 1972	1696	Unlock_Tool_2.3.exe	117
PID 1696 wrote to memory of 1972	1696	Unlock_Tool_2.3.exe	117
PID 1696 wrote to memory of 1972	1696	Unlock_Tool_2.3.exe	117
PID 1696 wrote to memory of 1972	1696	Unlock_Tool_2.3.exe	117
PID 1696 wrote to memory of 1972	1696	Unlock_Tool_2.3.exe	117
PID 1696 wrote to memory of 1972	1696	Unlock_Tool_2.3.exe	117
PID 1696 wrote to memory of 1972	1696	Unlock_Tool_2.3.exe	117
PID 2056 wrote to memory of 3428	2056	Unlock_Tool_2.3.exe	121
PID 2056 wrote to memory of 3428	2056	Unlock_Tool_2.3.exe	121
PID 2056 wrote to memory of 3428	2056	Unlock_Tool_2.3.exe	121
PID 2056 wrote to memory of 3428	2056	Unlock_Tool_2.3.exe	121
PID 2056 wrote to memory of 3428	2056	Unlock_Tool_2.3.exe	121
PID 2056 wrote to memory of 3428	2056	Unlock_Tool_2.3.exe	121
PID 2056 wrote to memory of 3428	2056	Unlock_Tool_2.3.exe	121
PID 2056 wrote to memory of 3428	2056	Unlock_Tool_2.3.exe	121
PID 2056 wrote to memory of 3428	2056	Unlock_Tool_2.3.exe	121
PID 2056 wrote to memory of 3428	2056	Unlock_Tool_2.3.exe	121

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_2.3\" -ad -an -ai#7zMap14154:110:7zEvent6582
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4252

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Unlock_Tool_2.3\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3444

C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe
"C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe
  "C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EBAKEBAECGCB" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 268
  2⤵
  - Program crash
  PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1696 -ip 1696
1⤵
PID:4616

C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe
"C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe
  "C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 220
  2⤵
  - Program crash
  PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 856 -ip 856
1⤵
PID:4716

C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe
"C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe
  "C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 224
  2⤵
  - Program crash
  PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1696 -ip 1696
1⤵
PID:2240

C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe
"C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe
  "C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe"
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 236
  2⤵
  - Program crash
  PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2056 -ip 2056
1⤵
PID:4416

C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe
"C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe"
1⤵
PID:2824
- C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe
  "C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe"
  2⤵
  PID:3652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 220
  2⤵
  - Program crash
  PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2824 -ip 2824
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\KFCAFIIDHIDG\JKJEHJ

Filesize
20KB

MD5
9d232a645f7bfb26aec425a3ccc22814

SHA1
73508d4206de7abaaca70a3b6f9994c1e3f95b61

SHA256
d17135779613db40f1d53d72e6a00f5b9fb0871b1dee1e3110e5fec60b16fe78

SHA512
8c68dd77f71448b8b66e8eb8a04c8f90e75501c2d393f2eb9aa1c05d731a78439501abc647637bd5ea39af6341e11565ace55d36ad89041b1a55f8665f7e6bac

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
d44ded6bcf9041abe0236961c0a5232d

SHA1
5fb64a4879cebab13f09b75fe63ea8cc4b5dfee1

SHA256
67c1ea44086da3947b88841d1f011fd739ce6f2a6b5b0d0f089b9d69fe8b5305

SHA512
1390aead27e74954f5acf005ae204d36ef42c08f7be7bf922fe61ba6ff5914ea66b7e5c930c9eca9a12abc90921b6897e64c6cde40eb6d80e787bb9d4833783a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
1801c76d1e225d60417c15afb72e1398

SHA1
1f1af09b053954c16e1715bc2b66e5aded76f9a4

SHA256
ef9ab446b3904f28c4d9fbe14e0b590cba0f5e479aaeb5fa8e4228f8da4d62da

SHA512
ab5d0e0e689454d1b9133d17349e02d36be94f2c1b79de392a06ece662f499953ec90cc0e9f7bd1ae458704c18b660f274ed531c1ec2b91576bf26a928b8ef2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPUS7TYC\76561199786602107[1].htm

Filesize
35KB

MD5
39874718022507bed31eaaca1a349cc9

SHA1
1c6b78eaed17f7dfee39de589aa01ba7c47d977a

SHA256
3912ca3199cf344a982e90e96ee48d1e31e89d647dcf22ef7094b7a46c9eb1de

SHA512
5569c5652cd1deb27289b2e9e22656c841be8d41dc1a0dc7312efeb93a5a350e169728c9cb3feb988e1ed2c6ea95515a78da161bc2db3164c8130e94c0f7cf82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HA5FC889\76561199786602107[1].htm

Filesize
35KB

MD5
202d85b6e400e17d7f09c624f5403405

SHA1
5612dbe423a65de86faa9dfc6fdd4d33350202f6

SHA256
3353fc37e40757bccdd266072638dfad703e422a427342e7b0417bd7fd0812b8

SHA512
e49e04c5ebd4a25cedc289c3da649bc22f63ec604529526a03dd4bf07d3442e20bb5cecd2043ca0998ab073771ca24ebbd399fa2f7bf55d16e8c110241b30f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HA5FC889\76561199786602107[1].htm

Filesize
35KB

MD5
e916090d80dede7f6b864ffa9c31493e

SHA1
a773906eed475ce64fdddc234040e9389729475e

SHA256
d1bd3d41451167053944479d0eeaffb2ecc4ada46e995d211a6a1f02b438007a

SHA512
553e4a55e5a3941b778e14ee30d9dfca4ff9d8b8b2c3cc9ac2e23e84faae07b6132364d038f723600bf2aab4a0101329962ff709c6f18cb3057da5079a12dc05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P2UT3MS5\76561199786602107[1].htm

Filesize
35KB

MD5
3b7d36c3456f1915a148130be3504176

SHA1
32fe8704075236ab11990977a18abc876cd00fd4

SHA256
5a26fce989835bc62604eb61c4cae5cc17da46f7706c6d4eae78c7a80a43a750

SHA512
671396762f3f4429057570c8f4ee773738ec33c57e919458ed170281eba1311a5df771e05e1e8fbe64bbb78419ca0f421feb68ee9d8224b913489d4cbac8614c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P2UT3MS5\76561199786602107[1].htm

Filesize
35KB

MD5
cc60d9cbe6883828837d2b6797e9254b

SHA1
49996ba3467b879a114ccdbfdeb7f44fceda9fb8

SHA256
42efff6c3f51aef41093dc5a6c918f69c9f5f1575f4fb1a7122fc7e57d07d1ad

SHA512
b8e74ce4b219cc2a33cbd48fa7282d59a1bf6f2c1b8efc60d1feb6d86987adc8448a6882438bc7e54d0aa632687b160703b61edf1fd53da1424e40c50a9af0fa

Download Submit
C:\Users\Admin\Desktop\Unlock_Tool_2.3\Readme.txt

Filesize
102B

MD5
8e24d07508a868b943c26d04dfbd48f8

SHA1
032cbaa50fafbd71ac2aa3beed4fb38d0f70e99e

SHA256
37db6fc123be7dbf1f2c74e5762767a0d4c4a0358b354c9024866924909467f2

SHA512
a2ac5f86dd6bb5e6faebf4f901170f1480b52f3a2a6c0b2ad09e444d17aef81999456157bef618b9105bce93685c3405d2fd334267ebc035f9231cb360f174ab

Download Submit
C:\Users\Admin\Desktop\Unlock_Tool_2.3\Unlock_Tool_2.3.exe

Filesize
1.5MB

MD5
875d0ab4d446da201127377ef3756d5e

SHA1
45cdad2ed72f5d4956d13ffcee2002caabc68625

SHA256
5067e33aee627b233fccbfa9516fdb2bb96216694a606986f986add251a856fd

SHA512
4ee704b5cc1cf693a511ca555de476ec76fa39b9993fbde102545a390e91ae286c57f7c4cd717b56748a1549e1c28c5e7cfde994f61dac0b762b832fed4d769e

Download Submit
C:\Users\Admin\Desktop\Unlock_Tool_2.3\locales\resources\Data\level4.resS

Filesize
128KB

MD5
64d183ad524dfcd10a7c816fbca3333d

SHA1
5a180d5c1f42a0deaf475b7390755b3c0ecc951c

SHA256
5a666340f42f0f985772024d90a83d15c9a241a68d58205cd4afbb1a31f1621a

SHA512
3cab59dff09981f49d1070fba06a781439bb1ea2dae0cfcb937d9875bbe9e866be2c951cfc6a3ca4a92aea79dd3e9c4792a765f5a06f230a57dabcab2f0b3c1e

Download Submit
memory/1972-760-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1972-751-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1972-761-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1972-753-0x0000000022D30000-0x0000000022F8F000-memory.dmp

Filesize
2.4MB

Download
memory/1972-752-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-650-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-631-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-709-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-658-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-676-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-649-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-627-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-630-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-708-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-640-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-675-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-643-0x00000000229F0000-0x0000000022C4F000-memory.dmp

Filesize
2.4MB

Download
memory/2392-701-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-700-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-659-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2392-641-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2480-720-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2480-729-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2480-723-0x0000000020740000-0x000000002099F000-memory.dmp

Filesize
2.4MB

Download
memory/2480-721-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2480-730-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3428-764-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3428-765-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3428-766-0x00000000202B0000-0x000000002050F000-memory.dmp

Filesize
2.4MB

Download
memory/3428-773-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3428-774-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3652-777-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3652-778-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3652-779-0x000000001FFF0000-0x000000002024F000-memory.dmp

Filesize
2.4MB

Download