stealc | ae5b9a35f35d710b849c3bfb37e848a129855768bd9929b7a85702de3e76e0c8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20-12-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea2c30769d298e35ba11cd5c5ed2b04f.exe
Size

289KB
MD5

ea2c30769d298e35ba11cd5c5ed2b04f
SHA1

e47bc5c3db4cfbc68dfbe6c48a88c87c29b38a13
SHA256

ae5b9a35f35d710b849c3bfb37e848a129855768bd9929b7a85702de3e76e0c8
SHA512

5e8dd5244fd0c420c79aaf5c9aa7f112189696ae4f7caaa8082acff3e401df3d1d9f84ce4c8ef0c0a768fac4c2495afb192d72e40e2737b8144cb21adebaedb8
SSDEEP

6144:UBM4zzQdbt97XKCVqSYkRYfeIUd+NHHDWn9mWhi:4M44dN3YWTITHDqBi

Score

10^/10

stealc logsdiller credential_access discovery spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

LogsDiller

http://185.219.81.132

Attributes

url_path
/c3d039fb36c40339.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2872	chrome.exe
2208	chrome.exe
2064	chrome.exe
2460	chrome.exe
748	chrome.exe
1716	chrome.exe
340	chrome.exe
484	chrome.exe

Loads dropped DLL 2 IoCs

pid	Process
2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe
2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea2c30769d298e35ba11cd5c5ed2b04f.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ea2c30769d298e35ba11cd5c5ed2b04f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ea2c30769d298e35ba11cd5c5ed2b04f.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe
2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe
2872	chrome.exe
2872	chrome.exe
2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe
2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe
748	chrome.exe
748	chrome.exe
2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe
2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2872	chrome.exe
748	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2872	2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe	30
PID 2120 wrote to memory of 2872	2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe	30
PID 2120 wrote to memory of 2872	2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe	30
PID 2120 wrote to memory of 2872	2120	ea2c30769d298e35ba11cd5c5ed2b04f.exe	30
PID 2872 wrote to memory of 2724	2872	chrome.exe	31
PID 2872 wrote to memory of 2724	2872	chrome.exe	31
PID 2872 wrote to memory of 2724	2872	chrome.exe	31
PID 2872 wrote to memory of 2624	2872	chrome.exe	32
PID 2872 wrote to memory of 2624	2872	chrome.exe	32
PID 2872 wrote to memory of 2624	2872	chrome.exe	32
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2568	2872	chrome.exe	34
PID 2872 wrote to memory of 2416	2872	chrome.exe	35
PID 2872 wrote to memory of 2416	2872	chrome.exe	35
PID 2872 wrote to memory of 2416	2872	chrome.exe	35
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36
PID 2872 wrote to memory of 1872	2872	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\ea2c30769d298e35ba11cd5c5ed2b04f.exe
"C:\Users\Admin\AppData\Local\Temp\ea2c30769d298e35ba11cd5c5ed2b04f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef84f9758,0x7fef84f9768,0x7fef84f9778
    3⤵
    PID:2724
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1396,i,4445331084068208812,12236132439242953480,131072 /prefetch:2
    3⤵
    PID:2568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=1396,i,4445331084068208812,12236132439242953480,131072 /prefetch:8
    3⤵
    PID:2416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1396,i,4445331084068208812,12236132439242953480,131072 /prefetch:8
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2132 --field-trial-handle=1396,i,4445331084068208812,12236132439242953480,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2308 --field-trial-handle=1396,i,4445331084068208812,12236132439242953480,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2316 --field-trial-handle=1396,i,4445331084068208812,12236132439242953480,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1720 --field-trial-handle=1396,i,4445331084068208812,12236132439242953480,131072 /prefetch:2
    3⤵
    PID:2464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2868 --field-trial-handle=1396,i,4445331084068208812,12236132439242953480,131072 /prefetch:8
    3⤵
    PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef83a9758,0x7fef83a9768,0x7fef83a9778
    3⤵
    PID:1640
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1388,i,511823171496914040,1393023594648150293,131072 /prefetch:2
    3⤵
    PID:3024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1388,i,511823171496914040,1393023594648150293,131072 /prefetch:8
    3⤵
    PID:2932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1388,i,511823171496914040,1393023594648150293,131072 /prefetch:8
    3⤵
    PID:1276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2332 --field-trial-handle=1388,i,511823171496914040,1393023594648150293,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2764 --field-trial-handle=1388,i,511823171496914040,1393023594648150293,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2760 --field-trial-handle=1388,i,511823171496914040,1393023594648150293,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1120 --field-trial-handle=1388,i,511823171496914040,1393023594648150293,131072 /prefetch:2
    3⤵
    PID:2580

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2940

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
4af14b992d16a9097ddb4009c70b96b9

SHA1
2606b4a060c324c2048ea8d54374d4f2402886eb

SHA256
6ed45c34d54bb5f6e8b2a14aeb78406c243ca3d5eecd7a00089957e8c98dc7ce

SHA512
3d7642f60e8a54040b80872747cd6f37017c77ad3ec3f4370fe5641f8a0b76ffbf59f6592f9851d35ee192789b525e2e20d9cabb4c52f00cc08ea3bd94fa8987

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Affiliation Database

Filesize
32KB

MD5
69e3a8ecda716584cbd765e6a3ab429e

SHA1
f0897f3fa98f6e4863b84f007092ab843a645803

SHA256
e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

SHA512
bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
69955aff5463bc0c72230181f8d97ca4

SHA1
ae4e40e6e0ec50a4c1708d87b3ff7460e9ffe4ce

SHA256
eca870b196cbfca90eba84264e9d555715e79bdd489934d1363b9b59b0265423

SHA512
3f791cffdc99227d0e4d22adc2531b468662a5d6933a82b10582828c6e7f8e8f2abaaea2245eb6d543c2eb7896f2718773ce2287b959e09680df2f7543fddc63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\000003.log

Filesize
76B

MD5
cc4a8cff19abf3dd35d63cff1503aa5f

SHA1
52af41b0d9c78afcc8e308db846c2b52a636be38

SHA256
cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

SHA512
0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

Filesize
192B

MD5
0a01c5237bb1c8cb14808f19ada5a6a2

SHA1
ca9e3758a298f2c454c2d20fb555340a6b6871de

SHA256
eaa3ed534d0950fd29d392b345cb50326725c9e01e27574067f5142dd41e91d7

SHA512
b1b859218f91c9d25260ec0deb03a2959e23792e59c44434014c0c231872e72be88434555f0eee9d855ba9ffb84a672356393335cd5bd0588789327d7d2e3f74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Local Storage\leveldb\LOG

Filesize
196B

MD5
6ee11599ad6eea4234cb3d94204d2515

SHA1
cbd7351d3e481a9485010c418d6887c691405822

SHA256
4ebe7c55c4625c1a977327c03216395911dd74ae205b46a7aa9c431625f6e3e1

SHA512
4624f32f391bf2c4e56207ae2cde5f40b5f2bd81373b86295a52651c00ce4e985b7d28b42ddabe0d35adde06dfafab48bedd113db1e13dd78b95ce770d483d7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Login Data For Account

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

Filesize
204B

MD5
90c1f9be04216aa8b12682c7c5fb0e56

SHA1
e5409f1a67bac3ed6706539206d1758e636858dd

SHA256
99b6a919882be70974b6c721d278bb44e292523fd3874f8391f2ff702691262d

SHA512
d9d2a481031f06a911804dd00dcc74d3595ca098ec82420900c3aaf69384beafecc1c98732fd2bfe3590224a6fc8c4f10b18b81888031e6b1047a9d54ce30c64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000003.log

Filesize
46B

MD5
90881c9c26f29fca29815a08ba858544

SHA1
06fee974987b91d82c2839a4bb12991fa99e1bdd

SHA256
a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

SHA512
15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\CURRENT~RFf7724ee.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

Filesize
192B

MD5
3c5b8053313bc5e5cbd74926fe1e2c4c

SHA1
2b215517db42f2fd8b79ddc9b7b50cefa5b0a344

SHA256
67a2e160fe7b2b4b736078ef6f8b405f6ef370f3196863c9b18bd90179295934

SHA512
330ec299b434ec70b8f2b7fe5f95d8a4d864d0fd560548a25795a6a89ec133d50ffadff82226b0246d2638c4130301469694ba43963da8884551977cbec7e149

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

Filesize
128KB

MD5
82279be1243c7bfbcbb1dd5f1b0e2a5f

SHA1
79a88aa30e21876457048d61d71ac55da77b2b4f

SHA256
67f8580c192d6d183f6c3f8c49bacb8d93b694bbde3c76c091d24e3e1bdcdd9f

SHA512
3fe18df8fc00a83d38da6ca4cdbad016511b85aa46cac1363932338df9cf8ee932539986dc07c7f8cc50933dee0e865de7170c6bb69879dae09aed3c04a773cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Web Data

Filesize
92KB

MD5
2f8a51056128c1209f7251c40a21169e

SHA1
4759639e0ee1b5b28fe470eda3b6e335cc714471

SHA256
aa6a37a2a3e774cf5926700139042100b85b55300c86770cc4fcda07a4dd87a2

SHA512
b7aa363fac1da429130cdb8d61dbd476438e9fa2ad9a458f1b8b501d4a39e2dd9eba994107a2cb315679ec228c0f6e07dca0d79d74565bf55e37eee563538696

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
07978aa1dc46dc0d24b39d2f4c90bd36

SHA1
1570a2ff12cff51f95a22e7477a994f53bd89e6d

SHA256
7b99ad2fd1d0c3125c6654d441f5987204c5b2847e43d6bb093f783d7fb2f3aa

SHA512
9c1864f40220d8da6a574fae73b20fd5f8da159dc534e340100677df4dec959d8fc248a3376f28aa230d885d49de1c4a9c12b0bfafa534a082a3880fabef0098

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

Filesize
193B

MD5
db2d2cbc71b214a200f1d086ef50423b

SHA1
c02fbbb650a85b1942d77765393baec647c3eb2f

SHA256
241fb50510bd765305efda28cbac41472975fe9b499d1f23d128c0043b8bae4d

SHA512
a7baebe12adad35d34ff3502118e61767e6d7f5e4bb019aad8fe20b003543fbd0e7f0d78d3b1f269281b564153b6d7bfeb32bdb6ba9b015ef9142b5ceae42716

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Favicons

Filesize
20KB

MD5
3eea0768ded221c9a6a17752a09c969b

SHA1
d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

SHA256
6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

SHA512
fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Local Storage\leveldb\LOG

Filesize
197B

MD5
d180eb21375b1b26c822de7d80d80701

SHA1
5908115dfcc3736e0b122c8664b81c6b1857f0de

SHA256
5e00d33b5c3dfb6d33960462dafda0a1d9f3e7cb2c3e848f972bd67278cd18d6

SHA512
f815f548ff283ccc18db6cf0d7a24d3c923a51df4580428c3e7e94c23df07f728b76a926a245df6b89a2ffc73ff277bfede1b062d9e86c600a5b5985bca7476e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

Filesize
205B

MD5
ece96a81a075b31a4e916d34ec2d78ad

SHA1
cce2b5a8d055d08acad0efc60bfee9b784b9cfd3

SHA256
117bd6cc0c0780319499f1010c166074add8b6180062b064c52a82cb23a10b28

SHA512
2a11669fac0c47d1cb901d5b1069b910239d3fb3bd48a22baee08be56579eaddd58d0a0ea71e8c87f2727c9e19a098c68117c15db497239e4759fb350a9522cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

Filesize
193B

MD5
afc4252efed26c60119635dc9899747c

SHA1
5a743bd7856667f674206dacb77eabe48290837c

SHA256
738d8db844ad8d0d339b10fc226300ce7caae6ae801ed6489a23163e8261523c

SHA512
d051f58cd1c567fd4e5ce005a4c56b55b432c169089e09a843c50ca7f88b1ba1a2f555a9564e8c3e8f5772b90619fc6b173ec4742b64176287fcf66481b93c53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

Filesize
128KB

MD5
9fdc242ee5e3ca1c13d69d2b1a9a793b

SHA1
8989457d470d632618de091105c87848a803cac6

SHA256
630fd2dbc19f0548854964522d1d1f1d8d3bfb4e27976f69b082e687bf5fb8c3

SHA512
32d21e356635af216168545ac1681a76a40115802cb67b6eab1fdfa86eed7925fee41f74c1eb751d8e53ea2e44ad6b3e16279f9fa9a4bd09693e975006af7ad3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\da22a6ff-95fc-421d-a8f4-fe7c5704b181.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
memory/2120-0-0x00000000003C0000-0x00000000003EB000-memory.dmp

Filesize
172KB

Download
memory/2120-3-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2120-273-0x00000000003C0000-0x00000000003EB000-memory.dmp

Filesize
172KB

Download
memory/2120-436-0x0000000000650000-0x000000000068D000-memory.dmp

Filesize
244KB

Download
memory/2120-438-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2120-2-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2120-1-0x0000000000650000-0x000000000068D000-memory.dmp

Filesize
244KB

Download
memory/2120-513-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download