stealc | d851fac530f4b5d3f7f215f4257a8fd0248039b7beb7246b06fb2f47e5297d17

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f12ecb7e8dd8bfb2d68df43267aeba89.exe
Size

6.1MB
MD5

f12ecb7e8dd8bfb2d68df43267aeba89
SHA1

f84adbecb1cc3db6be01ea506cb8e3e747d8356a
SHA256

d851fac530f4b5d3f7f215f4257a8fd0248039b7beb7246b06fb2f47e5297d17
SHA512

7b694e3c7a02883fbde8868552411cd37e0724f5b7b884f3d8ea3597d2e5beb0701a5cea337471742b926a1f18bf2c1351929a872b04d43d91b36d46f180710a
SSDEEP

98304:ew9zSgxHa3GEff6K/lYxaSXAMeUx3HuzxXnjWxx0GYHl9T+Fxc+aE484jZweXt2:5zSMHanf3/W1A/G3HYCXtA4x2EkK02

Score

10^/10

stealc logsdiller credential_access discovery spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

LogsDiller

http://185.219.81.135

Attributes

url_path
/c708352984fb7ac0.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2844	chrome.exe
1116	chrome.exe
896	chrome.exe
1656	chrome.exe
1452	chrome.exe
2672	chrome.exe
2708	chrome.exe
2136	chrome.exe

Loads dropped DLL 2 IoCs

pid	Process
2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe
2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f12ecb7e8dd8bfb2d68df43267aeba89.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f12ecb7e8dd8bfb2d68df43267aeba89.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f12ecb7e8dd8bfb2d68df43267aeba89.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe
2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe
2708	chrome.exe
2708	chrome.exe
2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe
2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe
896	chrome.exe
896	chrome.exe
2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe
2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe
Token: SeShutdownPrivilege	896	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2708	chrome.exe
896	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2708	2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe	31
PID 2348 wrote to memory of 2708	2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe	31
PID 2348 wrote to memory of 2708	2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe	31
PID 2348 wrote to memory of 2708	2348	f12ecb7e8dd8bfb2d68df43267aeba89.exe	31
PID 2708 wrote to memory of 2740	2708	chrome.exe	32
PID 2708 wrote to memory of 2740	2708	chrome.exe	32
PID 2708 wrote to memory of 2740	2708	chrome.exe	32
PID 2708 wrote to memory of 2640	2708	chrome.exe	33
PID 2708 wrote to memory of 2640	2708	chrome.exe	33
PID 2708 wrote to memory of 2640	2708	chrome.exe	33
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2600	2708	chrome.exe	35
PID 2708 wrote to memory of 2668	2708	chrome.exe	36
PID 2708 wrote to memory of 2668	2708	chrome.exe	36
PID 2708 wrote to memory of 2668	2708	chrome.exe	36
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37
PID 2708 wrote to memory of 2324	2708	chrome.exe	37

C:\Users\Admin\AppData\Local\Temp\f12ecb7e8dd8bfb2d68df43267aeba89.exe
"C:\Users\Admin\AppData\Local\Temp\f12ecb7e8dd8bfb2d68df43267aeba89.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6fc9758,0x7fef6fc9768,0x7fef6fc9778
    3⤵
    PID:2740
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1360,i,10788432352639906302,11034763396668418089,131072 /prefetch:2
    3⤵
    PID:2600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1360,i,10788432352639906302,11034763396668418089,131072 /prefetch:8
    3⤵
    PID:2668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1360,i,10788432352639906302,11034763396668418089,131072 /prefetch:8
    3⤵
    PID:2324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2076 --field-trial-handle=1360,i,10788432352639906302,11034763396668418089,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2444 --field-trial-handle=1360,i,10788432352639906302,11034763396668418089,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2460 --field-trial-handle=1360,i,10788432352639906302,11034763396668418089,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1372 --field-trial-handle=1360,i,10788432352639906302,11034763396668418089,131072 /prefetch:2
    3⤵
    PID:2588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=1360,i,10788432352639906302,11034763396668418089,131072 /prefetch:8
    3⤵
    PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef69a9758,0x7fef69a9768,0x7fef69a9778
    3⤵
    PID:2132
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1112 --field-trial-handle=1276,i,3590512389386792505,14409725430237932990,131072 /prefetch:2
    3⤵
    PID:2644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1276,i,3590512389386792505,14409725430237932990,131072 /prefetch:8
    3⤵
    PID:2356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1548 --field-trial-handle=1276,i,3590512389386792505,14409725430237932990,131072 /prefetch:8
    3⤵
    PID:2052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2016 --field-trial-handle=1276,i,3590512389386792505,14409725430237932990,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2612 --field-trial-handle=1276,i,3590512389386792505,14409725430237932990,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2720 --field-trial-handle=1276,i,3590512389386792505,14409725430237932990,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1288 --field-trial-handle=1276,i,3590512389386792505,14409725430237932990,131072 /prefetch:2
    3⤵
    PID:2008

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1100

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
1d6994c9e7456e30a9c2dcecdc184047

SHA1
ad85ecf6f00da14dbde2b4b22e52809a02ad11cb

SHA256
32d641a0b1a4d012ac26b4511e84b1ce3a0c129fccd4e85a78a31d46b14f1a8d

SHA512
45820fc375361f0518efc53e283a5421a58ace75b2d4d94c9a190ac75a3b3717b9b797e8d27cec3014fcc9e9ea27f2ffc586777d8d658e0e24d379fe7604c607

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Affiliation Database

Filesize
32KB

MD5
69e3a8ecda716584cbd765e6a3ab429e

SHA1
f0897f3fa98f6e4863b84f007092ab843a645803

SHA256
e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

SHA512
bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
2eb5dfa29c33308372ee56b17efc2434

SHA1
d129371183d62b9c9c2f5b428d3a0c2e1beb73e2

SHA256
37b21753d2b9a179f922708078e43027aa3ba7ed4a90442dd07425a1e1c32aa3

SHA512
cd59533debd24b945aff2fffa7abaabbf8246c8d1b0d5bd0ee84ebced671b196256417e3ab583a9a87d0c4a4d4455becdc52de9bb689c084abd6fca2323d27b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\000003.log

Filesize
76B

MD5
cc4a8cff19abf3dd35d63cff1503aa5f

SHA1
52af41b0d9c78afcc8e308db846c2b52a636be38

SHA256
cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

SHA512
0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

Filesize
192B

MD5
f9f010cf8a84fecb457935b2ef28d908

SHA1
5ab6836bd106f23e4a6126647010560575436915

SHA256
f964118dcece47e92903eb2d60662da43743c9d5e9ec2bea507ab8d5e31b9ec7

SHA512
a93b54d47a05d460949f3c1009f4ad9a75d65201a823aaaf3e3d8db736006b65092acd3886314255174cd6768a3a599e22554e0f3f07d72422a090ef17d1b35f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\History

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Login Data

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

Filesize
204B

MD5
c2905bd4329ddb60c944b79d9b91af52

SHA1
aac2cc89825ec2cbf9296a6fab014bc737e8ed5f

SHA256
e3757e32ef851241b900d80399efbd7c2643ca805f0a3b264039b758f4027c5c

SHA512
114335bf52d09316074b64a94af00ea0be0723d56bdad0e25090d733ff0c31a77626ca9a5f0bb9260b7bee73d693cd4ae34246a8ecc7dbc1f87febf5ee99f629

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

Filesize
192B

MD5
218e79d69f320300457d05851ccdc27a

SHA1
02390582f53613b4830f1dfb40293a43010df6c9

SHA256
afb444812f82b7d985f5868f7739ea624333942360f5454594965631098205de

SHA512
4d817a7868eb68ac9a8fc98a4577f15fc1289d2f1f49ac2dece8d9ab5544dd2ed65dc30a5b8eef2dba8c0953dd7d5f6f7dddab7037a6c8b72e890a74ee15c6cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

Filesize
128KB

MD5
111da4dc1df3962e70a79997988c7917

SHA1
2c79a183fd978762c588bb6851b46c56a5b3146f

SHA256
b95964cce7fcf39fbd7f723715295c6b5085fa05c7a20f1fd45905fc438be755

SHA512
b9e52d1de34f189d504e95376045ee1fc38469d2a2d1df83e90fa76d8852e6cfb73a8b886a29c0d196048f6b8044d23d68bda494b2e6051eb79babc4a5b7b541

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Web Data

Filesize
92KB

MD5
3f979e175a64895561f15a3683cb1a48

SHA1
a6073a94871603859922d58a00440f78e34406b3

SHA256
14cae50dfd68232d2af3cd240cb00dc63a3363436bbdd98ed1066ce581dbe8fd

SHA512
2af127ef5e01efb59eb7dd3889e5cd0ebab714ad591e2aea05dcfac86fb8531966f7a5a9ce86f2f3dee30b979934e2fbece29f49c682a00ce0d1ddf677b2cb45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
f30ba9b897fd1b3b95014da268bd9fd0

SHA1
73aa4b87172bdd2edc37d60a916fce684dbe890f

SHA256
cd22aed04791d4d74a3eba05634e558dc2afd709751bad7838b800aa76504538

SHA512
0d6f82d9c012edb19be6a9544dadc966d874f3afc4db4b5339769d028f6e4b4554b4788be9e22ba7318e12e7049dd7e8477f6c142318830efd5f6330e4ffea21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

Filesize
193B

MD5
e12541bf74764bdea598055534c6dc45

SHA1
054201cd5bde13063af425e7ad31f7483f78f314

SHA256
224012d98b504a569cab697e1415f5bb94fbf4ed495faddf97702ccbfe21d012

SHA512
0cb6b2785b24dc981c41f3482a690ff1192066e3763c82661da66e88c926358ab31333d1cdce966227d748282a87f39b1eeb362ecc05c58f44c060d6389c3398

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Favicons

Filesize
20KB

MD5
3eea0768ded221c9a6a17752a09c969b

SHA1
d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

SHA256
6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

SHA512
fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

Filesize
205B

MD5
16393e2284541d643c6822979a8ec9b3

SHA1
ea50ee73a5e0f9db7dd348d174b0f80c5717be99

SHA256
ecc1c2bda0b9bed5a662554cdefaf5310cbfd7eaa78f2848291131c136987857

SHA512
b133d3e2e6e2ca3580bb095fdd6dc865697bd8a9145f5703edab8e9019a40676a88c2eefbff8a9a8cbac27f29c60e3aef477da8eeba5ed7b2af5bd30dc1eac2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

Filesize
193B

MD5
745bd2bd83e98cab4e4e97293b6f8f37

SHA1
7d607a47ea7f38b4ddd82072a3fef9d797e84024

SHA256
aee09ed36cb70b8b5b0ea066581ea556782b2771a3162f68d795bc4882485974

SHA512
4b63e613e14f5c33706e5235f736e31918f506b3fc3de378e9d3ab99fc2945d83c6f8d1f25df9036901ed0713756238fa4904194948dc1745e3fe58b6fb1b0c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

Filesize
128KB

MD5
0ef2d4631390405d995390e54bc2bcbd

SHA1
0f464710a0c8597b0a472e96592d54caca4e2ecb

SHA256
238a90efbeddad6f59e3ff2e09b528f42417cefbda4acf2d9402f67607c9b691

SHA512
8b4a90ea4e21629c5c6455f94359976c53e74b2ae836b68a4e5bbfdeedf8892f05b8c185c0326f9353e7acd9c24a71f975e36186d28fbc8294353189ebe444b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

Filesize
200B

MD5
02271774f02b3ba45ca165cffb37d006

SHA1
e89c111a46e18faf2a7ca046c79bb6bc674f8094

SHA256
cd1a4fa2bb41c454fde391844cdf83d1a2489f8ba2407fe010295efb147eed51

SHA512
6574b9d83f5e07240620bce1dc23e8712b07e25abfcec80065fda160264ac9de427636fb1e2647bce2a427218c0efe9ef8c90f6b85531f9debfb98f713faeb98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
memory/2348-1-0x00000000013D0000-0x0000000001F33000-memory.dmp

Filesize
11.4MB

Download
memory/2348-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download