Analysis
-
max time kernel
126s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 21:44
Behavioral task
behavioral1
Sample
baedawdgh.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
gdwadtyjuesfshas.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
gweadtrgh.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
hjgesadfseawd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
kisloyat.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
kisteruop.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
pothjmawdtrg.exe
Resource
win10v2004-20241007-en
General
-
Target
kisteruop.exe
-
Size
239KB
-
MD5
aa7c3909bcc04a969a1605522b581a49
-
SHA1
e6b0be06c7a8eb57fc578c40369f06360e9d70c9
-
SHA256
19fcd2a83cd54c9b1c9bd9f8f6f7792e7132156b09a8180ce1da2fe6e2eeaaab
-
SHA512
f06b7e9efe312a659fd047c80df637dba7938035b3fd5f03f4443047f4324af9234c28309b0b927b70834d15d06f0d8e8a78ba6bd7a6db62c375df3974ce8bd0
-
SSDEEP
3072:QLCrbK4vn4p+U1v+N3Bz1IJ8JEchyka7Z7LU/fHY5rrr2MJ08:WaGm1U5Y1ICJU117L+45rrr2qz
Malware Config
Extracted
stealc
Voov
http://154.216.17.90
-
url_path
/a48146f6763ef3af.php
Signatures
-
Stealc family
-
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 9 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 388 chrome.exe 824 chrome.exe 1296 chrome.exe 5000 msedge.exe 400 msedge.exe 520 chrome.exe 4312 msedge.exe 4432 msedge.exe 2356 msedge.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation kisteruop.exe -
Loads dropped DLL 2 IoCs
pid Process 1216 kisteruop.exe 1216 kisteruop.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kisteruop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 kisteruop.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString kisteruop.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3188 timeout.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133774767046274214" chrome.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1216 kisteruop.exe 1216 kisteruop.exe 1216 kisteruop.exe 1216 kisteruop.exe 520 chrome.exe 520 chrome.exe 1216 kisteruop.exe 1216 kisteruop.exe 1216 kisteruop.exe 1216 kisteruop.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 3716 msedge.exe 3716 msedge.exe 5000 msedge.exe 5000 msedge.exe 1216 kisteruop.exe 1216 kisteruop.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 520 chrome.exe 520 chrome.exe 520 chrome.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 520 chrome.exe Token: SeCreatePagefilePrivilege 520 chrome.exe Token: SeShutdownPrivilege 520 chrome.exe Token: SeCreatePagefilePrivilege 520 chrome.exe Token: SeShutdownPrivilege 520 chrome.exe Token: SeCreatePagefilePrivilege 520 chrome.exe Token: SeShutdownPrivilege 520 chrome.exe Token: SeCreatePagefilePrivilege 520 chrome.exe Token: SeShutdownPrivilege 520 chrome.exe Token: SeCreatePagefilePrivilege 520 chrome.exe Token: SeShutdownPrivilege 520 chrome.exe Token: SeCreatePagefilePrivilege 520 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 520 chrome.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1216 wrote to memory of 520 1216 kisteruop.exe 85 PID 1216 wrote to memory of 520 1216 kisteruop.exe 85 PID 520 wrote to memory of 3236 520 chrome.exe 86 PID 520 wrote to memory of 3236 520 chrome.exe 86 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 772 520 chrome.exe 87 PID 520 wrote to memory of 4804 520 chrome.exe 88 PID 520 wrote to memory of 4804 520 chrome.exe 88 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89 PID 520 wrote to memory of 2436 520 chrome.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\kisteruop.exe"C:\Users\Admin\AppData\Local\Temp\kisteruop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb688bcc40,0x7ffb688bcc4c,0x7ffb688bcc583⤵PID:3236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2016,i,6059151346466400614,2550230518123181404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2012 /prefetch:23⤵PID:772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1828,i,6059151346466400614,2550230518123181404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2488 /prefetch:33⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2152,i,6059151346466400614,2550230518123181404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2604 /prefetch:83⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,6059151346466400614,2550230518123181404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:13⤵
- Uses browser remote debugging
PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,6059151346466400614,2550230518123181404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3256 /prefetch:13⤵
- Uses browser remote debugging
PID:388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3180,i,6059151346466400614,2550230518123181404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4424 /prefetch:13⤵
- Uses browser remote debugging
PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4284,i,6059151346466400614,2550230518123181404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4840 /prefetch:83⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4904,i,6059151346466400614,2550230518123181404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4836 /prefetch:83⤵PID:2544
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5000 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb68d046f8,0x7ffb68d04708,0x7ffb68d047183⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12166800928403388160,8391063865609729825,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:23⤵PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,12166800928403388160,8391063865609729825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,12166800928403388160,8391063865609729825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:83⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2168,12166800928403388160,8391063865609729825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:13⤵
- Uses browser remote debugging
PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2168,12166800928403388160,8391063865609729825,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:13⤵
- Uses browser remote debugging
PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2168,12166800928403388160,8391063865609729825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:13⤵
- Uses browser remote debugging
PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2168,12166800928403388160,8391063865609729825,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:13⤵
- Uses browser remote debugging
PID:4432
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\kisteruop.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- System Location Discovery: System Language Discovery
PID:228 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3188
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1292
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
649B
MD5bd5ee49c742e4faff2af5d1868ec5426
SHA1c50d80f11daf26d1d321cfde6ed69b4e22b58c2e
SHA25669a43040c2bb766f16b8f298c0986967ce290dee9fbc253086dc389f70acb491
SHA5120404ccac05632ce3f966005fd49488aa9c107f0d87b6f32c195281cc4db2af49b08e34504004032c85f1bc5b7e9e6fb2946f2a614f62fe701ef027b956c80166
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
152B
MD537f660dd4b6ddf23bc37f5c823d1c33a
SHA11c35538aa307a3e09d15519df6ace99674ae428b
SHA2564e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
-
Filesize
152B
MD5d7cb450b1315c63b1d5d89d98ba22da5
SHA1694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA25638355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
-
Filesize
5KB
MD519567864e26ecaedb64d169c30cefbb4
SHA1b3be6b713bd4624869d9a87fd0707ce9898cdd0d
SHA256e14a82f7973068c4fbbf9544c52f4f948a611c1a7cb2e07b8655d087edfc5468
SHA5127876f7f5117eb63b57d7928a9637672783a2b2a7c56c0b5242f524b2a429ee2ade6bd23dbb3744e81930712a1ab47844c9444ceb19916a1b02693e23d997934c