Analysis
-
max time kernel
1151s -
max time network
1147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2024 11:41
Static task
static1
Behavioral task
behavioral1
Sample
Unlock_Tool_v2.6.4.exe
Resource
win10v2004-20241007-en
General
-
Target
Unlock_Tool_v2.6.4.exe
-
Size
602KB
-
MD5
34c229204cee737c42fb261084131c56
-
SHA1
5d0b470cc34fc95b384cb776edfbd432a293523b
-
SHA256
4f47fdad9849be9d1215e344719db71134a314c6b68872ba3bd5895629bf34fb
-
SHA512
155d08f8904383aaf5f298fd1f4ebe8eff3c3668c478d7e1e749cdf24fe76de02ab33b4a4239a171b1f21c3b3cb8cc0f69d13612190cdf6e76524ab3b976534a
-
SSDEEP
12288:qGMwQprK4VXtqaG/Y3KMMkU4DqQp5/IwT1wRB20h8AiZ:qGM3+4Vo5wKxDarP1wRB4Z
Malware Config
Extracted
vidar
11.8
68fa61169d8a1f0521b8a06aa1f33efb
https://t.me/fu4chmo
https://steamcommunity.com/profiles/76561199802540894
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Signatures
-
Detect Vidar Stealer 24 IoCs
resource yara_rule behavioral1/memory/232-1-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-3-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-22-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-23-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-31-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-32-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-451-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-452-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-459-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-463-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-464-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-466-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-467-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-468-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-499-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-507-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-500-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-511-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-512-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-514-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-530-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-531-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-538-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 behavioral1/memory/232-539-0x0000000000400000-0x0000000000659000-memory.dmp family_vidar_v7 -
Vidar family
-
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 10 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 1572 msedge.exe 4552 chrome.exe 1696 chrome.exe 3044 chrome.exe 3456 chrome.exe 6044 msedge.exe 4308 msedge.exe 5416 chrome.exe 4024 msedge.exe 2064 msedge.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Unlock_Tool_v2.6.4.exe -
Loads dropped DLL 2 IoCs
pid Process 232 Unlock_Tool_v2.6.4.exe 232 Unlock_Tool_v2.6.4.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4532 set thread context of 232 4532 Unlock_Tool_v2.6.4.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5032 4532 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlock_Tool_v2.6.4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unlock_Tool_v2.6.4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Unlock_Tool_v2.6.4.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Unlock_Tool_v2.6.4.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1860 timeout.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133763180641123826" chrome.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 232 Unlock_Tool_v2.6.4.exe 232 Unlock_Tool_v2.6.4.exe 232 Unlock_Tool_v2.6.4.exe 232 Unlock_Tool_v2.6.4.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 232 Unlock_Tool_v2.6.4.exe 232 Unlock_Tool_v2.6.4.exe 232 Unlock_Tool_v2.6.4.exe 232 Unlock_Tool_v2.6.4.exe 3632 msedge.exe 3632 msedge.exe 6064 msedge.exe 6064 msedge.exe 6064 msedge.exe 6064 msedge.exe 6064 msedge.exe 6044 msedge.exe 6044 msedge.exe 232 Unlock_Tool_v2.6.4.exe 232 Unlock_Tool_v2.6.4.exe 232 Unlock_Tool_v2.6.4.exe 232 Unlock_Tool_v2.6.4.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeShutdownPrivilege 4552 chrome.exe Token: SeCreatePagefilePrivilege 4552 chrome.exe Token: SeShutdownPrivilege 4552 chrome.exe Token: SeCreatePagefilePrivilege 4552 chrome.exe Token: SeShutdownPrivilege 4552 chrome.exe Token: SeCreatePagefilePrivilege 4552 chrome.exe Token: SeShutdownPrivilege 4552 chrome.exe Token: SeCreatePagefilePrivilege 4552 chrome.exe Token: SeShutdownPrivilege 4552 chrome.exe Token: SeCreatePagefilePrivilege 4552 chrome.exe Token: SeShutdownPrivilege 4552 chrome.exe Token: SeCreatePagefilePrivilege 4552 chrome.exe Token: SeShutdownPrivilege 4552 chrome.exe Token: SeCreatePagefilePrivilege 4552 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 4552 chrome.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe 6044 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 4756 4532 Unlock_Tool_v2.6.4.exe 84 PID 4532 wrote to memory of 4756 4532 Unlock_Tool_v2.6.4.exe 84 PID 4532 wrote to memory of 4756 4532 Unlock_Tool_v2.6.4.exe 84 PID 4532 wrote to memory of 892 4532 Unlock_Tool_v2.6.4.exe 85 PID 4532 wrote to memory of 892 4532 Unlock_Tool_v2.6.4.exe 85 PID 4532 wrote to memory of 892 4532 Unlock_Tool_v2.6.4.exe 85 PID 4532 wrote to memory of 2040 4532 Unlock_Tool_v2.6.4.exe 86 PID 4532 wrote to memory of 2040 4532 Unlock_Tool_v2.6.4.exe 86 PID 4532 wrote to memory of 2040 4532 Unlock_Tool_v2.6.4.exe 86 PID 4532 wrote to memory of 232 4532 Unlock_Tool_v2.6.4.exe 87 PID 4532 wrote to memory of 232 4532 Unlock_Tool_v2.6.4.exe 87 PID 4532 wrote to memory of 232 4532 Unlock_Tool_v2.6.4.exe 87 PID 4532 wrote to memory of 232 4532 Unlock_Tool_v2.6.4.exe 87 PID 4532 wrote to memory of 232 4532 Unlock_Tool_v2.6.4.exe 87 PID 4532 wrote to memory of 232 4532 Unlock_Tool_v2.6.4.exe 87 PID 4532 wrote to memory of 232 4532 Unlock_Tool_v2.6.4.exe 87 PID 4532 wrote to memory of 232 4532 Unlock_Tool_v2.6.4.exe 87 PID 4532 wrote to memory of 232 4532 Unlock_Tool_v2.6.4.exe 87 PID 4532 wrote to memory of 232 4532 Unlock_Tool_v2.6.4.exe 87 PID 232 wrote to memory of 4552 232 Unlock_Tool_v2.6.4.exe 105 PID 232 wrote to memory of 4552 232 Unlock_Tool_v2.6.4.exe 105 PID 4552 wrote to memory of 2044 4552 chrome.exe 106 PID 4552 wrote to memory of 2044 4552 chrome.exe 106 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 2400 4552 chrome.exe 107 PID 4552 wrote to memory of 376 4552 chrome.exe 108 PID 4552 wrote to memory of 376 4552 chrome.exe 108 PID 4552 wrote to memory of 228 4552 chrome.exe 109 PID 4552 wrote to memory of 228 4552 chrome.exe 109 PID 4552 wrote to memory of 228 4552 chrome.exe 109 PID 4552 wrote to memory of 228 4552 chrome.exe 109 PID 4552 wrote to memory of 228 4552 chrome.exe 109 PID 4552 wrote to memory of 228 4552 chrome.exe 109 PID 4552 wrote to memory of 228 4552 chrome.exe 109 PID 4552 wrote to memory of 228 4552 chrome.exe 109 PID 4552 wrote to memory of 228 4552 chrome.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.exe"C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.exe"C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.exe"2⤵PID:4756
-
-
C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.exe"C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.exe"2⤵PID:892
-
-
C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.exe"C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.exe"2⤵PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.exe"C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.6.4.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcc7a4cc40,0x7ffcc7a4cc4c,0x7ffcc7a4cc584⤵PID:2044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:24⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2044,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:34⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2456 /prefetch:84⤵PID:228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:14⤵
- Uses browser remote debugging
PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3260 /prefetch:14⤵
- Uses browser remote debugging
PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3640,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4564 /prefetch:14⤵
- Uses browser remote debugging
PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4780,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4548 /prefetch:84⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4636 /prefetch:84⤵PID:692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4572,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4548 /prefetch:84⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4892,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:84⤵PID:3304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4632,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4652 /prefetch:84⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4516,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4664 /prefetch:84⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4840,i,14301040235038112749,11827713979683542723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:24⤵
- Uses browser remote debugging
PID:5416
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:6044 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc7a546f8,0x7ffcc7a54708,0x7ffcc7a547184⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,7235787266518800936,12506404613755337967,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:24⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,7235787266518800936,12506404613755337967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,7235787266518800936,12506404613755337967,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:84⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2220,7235787266518800936,12506404613755337967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:14⤵
- Uses browser remote debugging
PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2220,7235787266518800936,12506404613755337967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:14⤵
- Uses browser remote debugging
PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2220,7235787266518800936,12506404613755337967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:14⤵
- Uses browser remote debugging
PID:4308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2220,7235787266518800936,12506404613755337967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:14⤵
- Uses browser remote debugging
PID:1572
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FBKFCFBFIDGC" & exit3⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1860
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 2802⤵
- Program crash
PID:5032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4532 -ip 45321⤵PID:4672
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4340
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
649B
MD535fac5cf01234d8502f843b3aca0e3a4
SHA19adb66d1c742694fd5f3fa9d28376418a4793613
SHA256fd2b0764e5ae89f3918e8f657a68a6fb1ea0bb6ea2f081b8559551a7cec7a1e7
SHA512cbdb4916cbfe4327428c5752dd88944c21eb5370e81215ea9768a85cf5b1b367396f3baea8664bcf435894a2c31ce49ad18884a4bd4154c829da95bb89ea13da
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\696ae2e4-4ab6-4aea-a362-cede43e00688.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d22d1ab-b18d-4269-a1ca-966621ed9cbc.tmp
Filesize5KB
MD51173cb2e17eddb11bcdc6a94f91b19d7
SHA111a12bad5ff4fc53d73ca9555fce98337a0bc1d6
SHA256f2e0d45325f00223a20aacc9ca6629b447bc8f7d6cb2bd4579cf48b43abc5176
SHA512aba99b0f471bfa31b1e5ebdefdffed605013092fdaea0bd6d6aa9477cc2daa2f761f5283a3af48a7a373d149ad8c3cc3456e4a289d617f6fd879ff4323a25a8f
-
Filesize
132KB
MD5da75bb05d10acc967eecaac040d3d733
SHA195c08e067df713af8992db113f7e9aec84f17181
SHA25633ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA51256533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727