isrstealer | 4d4e7a37101a9fa0810a3ff324a87c302a1328dcaeae6a9c637752e871a1a678

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2025 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
Size

408KB
MD5

dc35c41440704458ed7a60c0ac026f62
SHA1

28459a2a602943fb5f44cb7424061c390fefb502
SHA256

4d4e7a37101a9fa0810a3ff324a87c302a1328dcaeae6a9c637752e871a1a678
SHA512

f522adf75f7915caf3a87551f4704303ddde487da920c6a2a762d4fc821f5c6749b2496cdd5b5193252eb97f01cdcc3dc77584be90e6833e32f2410b955f8081
SSDEEP

6144:v7l/Mts0sXrneChRWcSUEC8ctAom2C+do4ON1ZA0bYQpBuLGlY+6iPHS/ei:hMSeChscpEBctA2Q11aPQ3/6/ei

Score

10^/10

isrstealer discovery persistence spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/4548-13-0x0000000000400000-0x0000000000459000-memory.dmp	family_isrstealer
behavioral2/files/0x000c000000023c9a-23.dat	family_isrstealer
behavioral2/memory/4548-76-0x0000000000400000-0x0000000000459000-memory.dmp	family_isrstealer
behavioral2/memory/4144-92-0x0000000000400000-0x0000000000459000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Detected Nirsoft tools 4 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2696-40-0x0000000000400000-0x0000000000454000-memory.dmp	Nirsoft
behavioral2/memory/2696-45-0x0000000000400000-0x0000000000454000-memory.dmp	Nirsoft
behavioral2/memory/2696-47-0x0000000000400000-0x0000000000454000-memory.dmp	Nirsoft
behavioral2/memory/2696-49-0x0000000000400000-0x0000000000454000-memory.dmp	Nirsoft

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2696-40-0x0000000000400000-0x0000000000454000-memory.dmp	WebBrowserPassView
behavioral2/memory/2696-45-0x0000000000400000-0x0000000000454000-memory.dmp	WebBrowserPassView
behavioral2/memory/2696-47-0x0000000000400000-0x0000000000454000-memory.dmp	WebBrowserPassView
behavioral2/memory/2696-49-0x0000000000400000-0x0000000000454000-memory.dmp	WebBrowserPassView

Downloads MZ/PE file 1 IoCs

flow	pid	Process
37	2216	Process not Found

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Control Panel\International\Geo\Nation	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
Key value queried	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Control Panel\International\Geo\Nation	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe

Executes dropped EXE 6 IoCs

pid	Process
2284	GAKFB.exe
4264	GAKFB.exe
2696	GAKFB.exe
1480	intelgfx.exe
4144	intelgfx.exe
2552	intelgfx.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\invidiadriver = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\intelgfx.exe"	reg.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5016 set thread context of 4548	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	89
PID 5016 set thread context of 4100	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	90
PID 2284 set thread context of 4264	2284	GAKFB.exe	93
PID 4264 set thread context of 2696	4264	GAKFB.exe	94
PID 1480 set thread context of 4144	1480	intelgfx.exe	99
PID 1480 set thread context of 2552	1480	intelgfx.exe	100

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4100-8-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4100-10-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4100-14-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4548-13-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4548-7-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4548-6-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4548-76-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4100-88-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4144-92-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/2552-95-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GAKFB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	intelgfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	intelgfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	intelgfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GAKFB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GAKFB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2580	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2284	GAKFB.exe
2284	GAKFB.exe
2284	GAKFB.exe
2284	GAKFB.exe
2284	GAKFB.exe
2284	GAKFB.exe
2284	GAKFB.exe
2284	GAKFB.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe
Token: SeDebugPrivilege	2552	intelgfx.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
4100	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
4548	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
2284	GAKFB.exe
1480	intelgfx.exe
2552	intelgfx.exe
4144	intelgfx.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4548	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	89
PID 5016 wrote to memory of 4548	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	89
PID 5016 wrote to memory of 4548	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	89
PID 5016 wrote to memory of 4548	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	89
PID 5016 wrote to memory of 4548	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	89
PID 5016 wrote to memory of 4548	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	89
PID 5016 wrote to memory of 4548	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	89
PID 5016 wrote to memory of 4548	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	89
PID 5016 wrote to memory of 4100	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	90
PID 5016 wrote to memory of 4100	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	90
PID 5016 wrote to memory of 4100	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	90
PID 5016 wrote to memory of 4100	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	90
PID 5016 wrote to memory of 4100	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	90
PID 5016 wrote to memory of 4100	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	90
PID 5016 wrote to memory of 4100	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	90
PID 5016 wrote to memory of 4100	5016	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	90
PID 4548 wrote to memory of 2284	4548	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	91
PID 4548 wrote to memory of 2284	4548	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	91
PID 4548 wrote to memory of 2284	4548	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	91
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 2284 wrote to memory of 4264	2284	GAKFB.exe	93
PID 4264 wrote to memory of 2696	4264	GAKFB.exe	94
PID 4264 wrote to memory of 2696	4264	GAKFB.exe	94
PID 4264 wrote to memory of 2696	4264	GAKFB.exe	94
PID 4264 wrote to memory of 2696	4264	GAKFB.exe	94
PID 4264 wrote to memory of 2696	4264	GAKFB.exe	94
PID 4100 wrote to memory of 2228	4100	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	95
PID 4100 wrote to memory of 2228	4100	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	95
PID 4100 wrote to memory of 2228	4100	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	95
PID 2228 wrote to memory of 876	2228	cmd.exe	97
PID 2228 wrote to memory of 876	2228	cmd.exe	97
PID 2228 wrote to memory of 876	2228	cmd.exe	97
PID 4100 wrote to memory of 1480	4100	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	98
PID 4100 wrote to memory of 1480	4100	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	98
PID 4100 wrote to memory of 1480	4100	JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe	98
PID 1480 wrote to memory of 4144	1480	intelgfx.exe	99
PID 1480 wrote to memory of 4144	1480	intelgfx.exe	99
PID 1480 wrote to memory of 4144	1480	intelgfx.exe	99
PID 1480 wrote to memory of 4144	1480	intelgfx.exe	99
PID 1480 wrote to memory of 4144	1480	intelgfx.exe	99
PID 1480 wrote to memory of 4144	1480	intelgfx.exe	99
PID 1480 wrote to memory of 4144	1480	intelgfx.exe	99
PID 1480 wrote to memory of 4144	1480	intelgfx.exe	99
PID 1480 wrote to memory of 2552	1480	intelgfx.exe	100
PID 1480 wrote to memory of 2552	1480	intelgfx.exe	100
PID 1480 wrote to memory of 2552	1480	intelgfx.exe	100
PID 1480 wrote to memory of 2552	1480	intelgfx.exe	100
PID 1480 wrote to memory of 2552	1480	intelgfx.exe	100
PID 1480 wrote to memory of 2552	1480	intelgfx.exe	100
PID 1480 wrote to memory of 2552	1480	intelgfx.exe	100
PID 1480 wrote to memory of 2552	1480	intelgfx.exe	100

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Users\Admin\AppData\Local\Temp\GAKFB.exe
    "C:\Users\Admin\AppData\Local\Temp\GAKFB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\GAKFB.exe
      "C:\Users\Admin\AppData\Local\Temp\GAKFB.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\GAKFB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GAKFB.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2696
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dc35c41440704458ed7a60c0ac026f62.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UTFNF.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "invidiadriver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:876
- - C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
    "C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
      "C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4144
  - - C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
      "C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2552

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEJDOEM4MUEtOERCNy00NkQxLTkwMUItQzgwNzExOUVENkVEfSIgdXNlcmlkPSJ7RDA3OEZFQUItN0NEMi00ODM5LTk2QUQtMDE1NTJDRUEzRjczfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDBCQjEzRTgtRjU2QS00NTIwLTgxNEUtQzM2NEEwQkM5ODYyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTkzNTA0MDMyNiIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GAKFB.exe

Filesize
320KB

MD5
ccc2260269cb43ddadda9444e3d112f7

SHA1
ddab46acc12d7c60a15fa363f88030f1dd539fcb

SHA256
8ca1bd039407381c33fb7ab570b6e95b0ce64b0d5ef64a1968f9b55647cc1911

SHA512
787d0b4f5d89b840a4917c78e46f963c8c96a96ec005b45d085222ef307c2a76f074c4a65ca033b038e1b7d1419c7cd3c5c5f3075c3ea24e546c68bdd7643fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\UTFNF.txt

Filesize
152B

MD5
5f88391307396bd801e5d983e4f96ac4

SHA1
d426f3dad0cd9f13287b263028ad4587f2b1d9c8

SHA256
2d6e24c71a3081416896765d09901744dbd541553af2d831f2a17f6f38ac4dec

SHA512
0cc65532264fe5541dc75016c080004c111fecfb97f2f0063984a89089d49ea07a1bf6c1fa9b835ad32cfa986bac82d171351c6cf2163598199588aefdb402f8

Download Submit
C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe

Filesize
408KB

MD5
f9b9a3f68aae6652ee68ad1a8e557abb

SHA1
cd65e1ff116bc9587626bdad0f0ba2d211ed7109

SHA256
2fce4a7584db28ceefa1e6814953cd1303ef2e3fbc7bfa387abfa825b9a956f1

SHA512
68d8c33b19ac68fdaf1f51c0f029a6e146b057697ac3387fe16f73a67d2a7d13619c93fd5722b964a64d466637f0ab7a5b786fcdc16e0bb12d27dc0312a0bae9

Download Submit
memory/2552-95-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2696-45-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2696-40-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2696-47-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2696-49-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4100-10-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4100-88-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4100-14-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4100-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4144-92-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4264-37-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4264-42-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4264-35-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4264-39-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4264-34-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4264-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4548-6-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4548-76-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4548-7-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4548-13-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5016-2-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/5016-3-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download