Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-11-2024 23:28

General

  • Target

    Launcher.exe

  • Size

    154.6MB

  • MD5

    76c8f7f191f2f33cc9fe1c2d3fabd39b

  • SHA1

    a155de45981e17eb44e24f958e5e45a5891c3007

  • SHA256

    f2fa065107d4246c08277a46a9503e2e7a24ee54c6faf665742b542833490d8d

  • SHA512

    2ebcde708d22ebbfebc5767f536c16f0b1f6e7c9ede588550cffc3dcdbc60d1e42ad1d7d835ea90a1fd50b2525cd58a94b3e5d2e44033cea373ae67506f555b3

  • SSDEEP

    1572864:ATmw0ciLNpDPuAvHxJLkY2O6Ea3f9kwZXeT6EivLp1vUAtdjtZn+f4FnIvGaC9dU:zv6E70+Mk

Malware Config

Signatures

  • Hexon family
  • Hexon stealer

    Hexon is a stealer written in Electron NodeJS.

  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates processes with tasklist 1 TTPs 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 9 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3888
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4876
    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 --field-trial-handle=1852,i,12842890817379662644,4232962071178929203,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:1216
      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=1916 --field-trial-handle=1852,i,12842890817379662644,4232962071178929203,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4088
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1752
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\system32\where.exe
          where /r . cookies.sqlite
          3⤵
            PID:3340
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2184
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1372
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1768
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4704
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
          2⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:912
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffd82dcc40,0x7fffd82dcc4c,0x7fffd82dcc58
            3⤵
              PID:920
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1948,i,4735239596332692289,2448908971296532918,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1952 /prefetch:2
              3⤵
                PID:860
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1880,i,4735239596332692289,2448908971296532918,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1980 /prefetch:3
                3⤵
                  PID:632
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2064,i,4735239596332692289,2448908971296532918,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2244 /prefetch:8
                  3⤵
                    PID:4800
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2872,i,4735239596332692289,2448908971296532918,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2892 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:2144
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2904,i,4735239596332692289,2448908971296532918,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2912 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:1660
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4052,i,4735239596332692289,2448908971296532918,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4008 /prefetch:1
                    3⤵
                    • Uses browser remote debugging
                    PID:2128
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
                  2⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  PID:3052
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd4f346f8,0x7fffd4f34708,0x7fffd4f34718
                    3⤵
                      PID:3948
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,6828965875237649950,7484037697558515861,131072 --no-sandbox --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2040 /prefetch:2
                      3⤵
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1868
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,6828965875237649950,7484037697558515861,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2184 /prefetch:3
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4960
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,6828965875237649950,7484037697558515861,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2736 /prefetch:8
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2856
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2020,6828965875237649950,7484037697558515861,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:440
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2020,6828965875237649950,7484037697558515861,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3328
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2020,6828965875237649950,7484037697558515861,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4260
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2020,6828965875237649950,7484037697558515861,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3508
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                    2⤵
                      PID:732
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        3⤵
                        • Enumerates processes with tasklist
                        PID:3436
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                      2⤵
                        PID:1632
                        • C:\Windows\system32\tasklist.exe
                          tasklist
                          3⤵
                          • Enumerates processes with tasklist
                          PID:4056
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                        2⤵
                          PID:4324
                          • C:\Windows\system32\tasklist.exe
                            tasklist
                            3⤵
                            • Enumerates processes with tasklist
                            PID:3420
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"
                          2⤵
                            PID:1952
                            • C:\Windows\system32\where.exe
                              where /r . *.sqlite
                              3⤵
                                PID:4308
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
                              2⤵
                                PID:3496
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /IM EpicGamesLauncher.exe /F
                                  3⤵
                                  • Kills process with taskkill
                                  PID:3092
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
                                2⤵
                                  PID:656
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /IM javaw.exe /F
                                    3⤵
                                    • Kills process with taskkill
                                    PID:4512
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                  2⤵
                                    PID:696
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /F /T /IM chrome.exe
                                      3⤵
                                      • Kills process with taskkill
                                      PID:3056
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                    2⤵
                                      PID:4936
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /F /T /IM msedge.exe
                                        3⤵
                                        • Kills process with taskkill
                                        PID:3884
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
                                      2⤵
                                        PID:2236
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /IM Steam.exe /F
                                          3⤵
                                          • Kills process with taskkill
                                          PID:4160
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                        2⤵
                                          PID:4680
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /F /T /IM chrome.exe
                                            3⤵
                                            • Kills process with taskkill
                                            PID:3220
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                          2⤵
                                            PID:4712
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /F /T /IM msedge.exe
                                              3⤵
                                              • Kills process with taskkill
                                              PID:800
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                            2⤵
                                              PID:2180
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist
                                                3⤵
                                                • Enumerates processes with tasklist
                                                PID:3328
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                              2⤵
                                                PID:4952
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /F /T /IM chrome.exe
                                                  3⤵
                                                  • Kills process with taskkill
                                                  PID:4800
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                                2⤵
                                                  PID:5084
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill /F /T /IM msedge.exe
                                                    3⤵
                                                    • Kills process with taskkill
                                                    PID:4360
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs""
                                                  2⤵
                                                    PID:1956
                                                    • C:\Windows\system32\cscript.exe
                                                      cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs"
                                                      3⤵
                                                      • Checks computer location settings
                                                      PID:3052
                                                      • C:\Users\Admin\AppData\Local\Temp\hexon_ca95336a176dd8e8.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\hexon_ca95336a176dd8e8.exe" HXN-TEST-7E561F93D321 discord
                                                        4⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:4324
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
                                                          5⤵
                                                            PID:3220
                                                            • C:\Windows\System32\reg.exe
                                                              C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                              6⤵
                                                                PID:800
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\20241017-4324-bdwagn.7zx7a.png" "
                                                              5⤵
                                                                PID:4136
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
                                                                  6⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2492
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES970B.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC993BC3BB7724EC5A050CBC7F0B456AC.TMP"
                                                                    7⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2808
                                                                • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
                                                                  screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\20241017-4324-bdwagn.7zx7a.png"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:3624
                                                        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=928 --field-trial-handle=1852,i,12842890817379662644,4232962071178929203,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1912
                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                        1⤵
                                                          PID:2312

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                          Filesize

                                                          2B

                                                          MD5

                                                          d751713988987e9331980363e24189ce

                                                          SHA1

                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                          SHA256

                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                          SHA512

                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          37f660dd4b6ddf23bc37f5c823d1c33a

                                                          SHA1

                                                          1c35538aa307a3e09d15519df6ace99674ae428b

                                                          SHA256

                                                          4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

                                                          SHA512

                                                          807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          d7cb450b1315c63b1d5d89d98ba22da5

                                                          SHA1

                                                          694005cd9e1a4c54e0b83d0598a8a0c089df1556

                                                          SHA256

                                                          38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

                                                          SHA512

                                                          df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          5KB

                                                          MD5

                                                          29e7ea1b8f236a5d78a74672403cfc99

                                                          SHA1

                                                          aded0259305e6b3c7433ddbbd9aa615448cd5692

                                                          SHA256

                                                          92bc56d6822f1f9447c719e33e0a64e9a98f0771c9c95b3fda584110f735f587

                                                          SHA512

                                                          9524e1e4868750abe0433b8db1da4e001ca3aa4af8f8295323c5f822082b7c386abbebe0bd5c43bef2120fe26313e58b6010737a12264a9dc1307d309676d0ba

                                                        • C:\Users\Admin\AppData\Local\Temp\20241017-4324-bdwagn.7zx7a.png

                                                          Filesize

                                                          433KB

                                                          MD5

                                                          2296f296b6983b5a2b8de680292ddd5f

                                                          SHA1

                                                          ac8b114c4659d6d71d2107c55955f3f9a9fdb8e3

                                                          SHA256

                                                          e514c9b2f5e2a274b6530568b7eaae8d4ddb23af29b16c644fe3677882622436

                                                          SHA512

                                                          23cd0dca44faa3be14cec2a242979f0af21bf690d4e2460ed51af48ecbedf3c496cdd2c1986f3435d3eca7c7290ffe0e12e439e093aafc1271cc8ca574260cb8

                                                        • C:\Users\Admin\AppData\Local\Temp\87b615ca-ece4-479b-887f-24794caee0a6.tmp.node

                                                          Filesize

                                                          1.4MB

                                                          MD5

                                                          56192831a7f808874207ba593f464415

                                                          SHA1

                                                          e0c18c72a62692d856da1f8988b0bc9c8088d2aa

                                                          SHA256

                                                          6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

                                                          SHA512

                                                          c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

                                                        • C:\Users\Admin\AppData\Local\Temp\RES970B.tmp

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          28922a8f00dcf3775b6feb660516e0b0

                                                          SHA1

                                                          9edb052faad1597c47675bb57a6f9d9c852d87fa

                                                          SHA256

                                                          54a9f784585dcb5e6044ef1ee6233230e70c561ce1a9c88e8bcf6254d9a35ab6

                                                          SHA512

                                                          48cdd5d7af2ab1a2244f1e868cf218d2d4c1ac28fd2bbad60b7785d72cade3c65e8e0da8555c37091917c4dd5c44191c0cc495e5796407e22983aca6407548ee

                                                        • C:\Users\Admin\AppData\Local\Temp\eccdb051-28ab-4c0d-82f7-70afed4d477d.tmp.node

                                                          Filesize

                                                          137KB

                                                          MD5

                                                          04bfbfec8db966420fe4c7b85ebb506a

                                                          SHA1

                                                          939bb742a354a92e1dcd3661a62d69e48030a335

                                                          SHA256

                                                          da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

                                                          SHA512

                                                          4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

                                                        • C:\Users\Admin\AppData\Local\Temp\open.vbs

                                                          Filesize

                                                          191B

                                                          MD5

                                                          e562e5be4d7f03e7cc4c9ad803a2194e

                                                          SHA1

                                                          c1eca4a4724ede13a8507fe362f654f4e8fd70be

                                                          SHA256

                                                          57e71d6c67d6a6ad15c1a779cce0183e23289c061757d879e9a82f725c5ba88e

                                                          SHA512

                                                          835de4fc4ede1eb126e08340d85ab1cbc3029006ed114175915f7aa8e33a8f4ec1d474f32c8aed90c07c235425cb1e7389020a1abad822c7578f7e0fdfadd8db

                                                        • C:\Users\Admin\AppData\Local\Temp\passwords_0.db

                                                          Filesize

                                                          40KB

                                                          MD5

                                                          a182561a527f929489bf4b8f74f65cd7

                                                          SHA1

                                                          8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                          SHA256

                                                          42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                          SHA512

                                                          9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                        • C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          66a65322c9d362a23cf3d3f7735d5430

                                                          SHA1

                                                          ed59f3e4b0b16b759b866ef7293d26a1512b952e

                                                          SHA256

                                                          f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

                                                          SHA512

                                                          0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat

                                                          Filesize

                                                          13KB

                                                          MD5

                                                          da0f40d84d72ae3e9324ad9a040a2e58

                                                          SHA1

                                                          4ca7f6f90fb67dce8470b67010aa19aa0fd6253f

                                                          SHA256

                                                          818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b

                                                          SHA512

                                                          30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

                                                        • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

                                                          Filesize

                                                          12KB

                                                          MD5

                                                          8bbdf1ba59579643def230707afda0b9

                                                          SHA1

                                                          127c82dcb0c8050ad307c1f7cfb42bd84a8b32e9

                                                          SHA256

                                                          94b79fae4fcaaff0f5cc884f434997dab815877a44ab01d84cb7e604201f8ba1

                                                          SHA512

                                                          e42f98735d9e943c38b444e0939682735b55d5bbff060fcdd85b58bdb689e8fc1577ad86116ced33f7a52e5283c0d5377fb0e01c2baf3844cad73c6a21418f8c

                                                        • \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC993BC3BB7724EC5A050CBC7F0B456AC.TMP

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          a6f2d21624678f54a2abed46e9f3ab17

                                                          SHA1

                                                          a2a6f07684c79719007d434cbd1cd2164565734a

                                                          SHA256

                                                          ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344

                                                          SHA512

                                                          0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

                                                        • \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest

                                                          Filesize

                                                          350B

                                                          MD5

                                                          8951565428aa6644f1505edb592ab38f

                                                          SHA1

                                                          9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2

                                                          SHA256

                                                          8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83

                                                          SHA512

                                                          7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5

                                                        • memory/1912-200-0x00000190E5C10000-0x00000190E5C11000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1912-194-0x00000190E5C10000-0x00000190E5C11000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1912-193-0x00000190E5C10000-0x00000190E5C11000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1912-192-0x00000190E5C10000-0x00000190E5C11000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1912-204-0x00000190E5C10000-0x00000190E5C11000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1912-203-0x00000190E5C10000-0x00000190E5C11000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1912-202-0x00000190E5C10000-0x00000190E5C11000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1912-201-0x00000190E5C10000-0x00000190E5C11000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1912-199-0x00000190E5C10000-0x00000190E5C11000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1912-198-0x00000190E5C10000-0x00000190E5C11000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/3624-186-0x0000000000E30000-0x0000000000E3A000-memory.dmp

                                                          Filesize

                                                          40KB