vidar | 19198e75f7c830441360a42b06e10415f4368300a7590c119c237ea8c67bf23e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250211-en
resource tags

arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2025 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe
Size

6.2MB
MD5

9f680720826812af34cbc66e27e0281f
SHA1

fb580afbf6fb913e83eea1fb99be9c95b6ec39d5
SHA256

19198e75f7c830441360a42b06e10415f4368300a7590c119c237ea8c67bf23e
SHA512

482fb7ca414b9070849017a9ec390597dd6fb1a18cb7e819b498b786dc1467dadd928d2f054baec880307274296f6b66a971deb63b14f0fc27f39094fcb2be8e
SSDEEP

49152:QU4K1Qy8nPDdZiBSFfscuj9ADJZlShhV7+pXLRB5TYAUhJSh7DUtiGlMlHDNuc6X:QNbrnrShj9AVYhgB5IJsnUw918SvljW

Score

10^/10

vidar credential_access discovery stealer

Malware Config

Extracted

Family

vidar

https://t.me/b4cha00

https://steamcommunity.com/profiles/76561199825403037

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0

Signatures

Detect Vidar Stealer 7 IoCs

stealer

resource	yara_rule
behavioral2/memory/3476-2-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral2/memory/3476-3-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral2/memory/3476-4-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral2/memory/3476-11-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral2/memory/3476-12-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral2/memory/3476-13-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral2/memory/3476-38-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Downloads MZ/PE file 1 IoCs

flow	pid	Process
32	2304	Process not Found

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3688	chrome.exe
1960	chrome.exe
3936	chrome.exe
1852	chrome.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1544	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BitLockerToGo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BitLockerToGo.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133839443319402299"	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3476	BitLockerToGo.exe
3476	BitLockerToGo.exe
3476	BitLockerToGo.exe
3476	BitLockerToGo.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 2212 wrote to memory of 3476	2212	2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe	105
PID 3476 wrote to memory of 3688	3476	BitLockerToGo.exe	106
PID 3476 wrote to memory of 3688	3476	BitLockerToGo.exe	106
PID 3688 wrote to memory of 2032	3688	chrome.exe	107
PID 3688 wrote to memory of 2032	3688	chrome.exe	107
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 3176	3688	chrome.exe	108
PID 3688 wrote to memory of 2528	3688	chrome.exe	109
PID 3688 wrote to memory of 2528	3688	chrome.exe	109
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110
PID 3688 wrote to memory of 4300	3688	chrome.exe	110

C:\Users\Admin\AppData\Local\Temp\2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-13_9f680720826812af34cbc66e27e0281f_frostygoop_hijackloader_poet-rat_snatch.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xe0,0x104,0x7ffb116ecc40,0x7ffb116ecc4c,0x7ffb116ecc58
      4⤵
      PID:2032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,15654906950411694795,17436013843367478357,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=1880 /prefetch:2
      4⤵
      PID:3176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,15654906950411694795,17436013843367478357,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      PID:2528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,15654906950411694795,17436013843367478357,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=2260 /prefetch:8
      4⤵
      PID:4300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,15654906950411694795,17436013843367478357,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,15654906950411694795,17436013843367478357,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4508,i,15654906950411694795,17436013843367478357,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=4564 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4192,i,15654906950411694795,17436013843367478357,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=4684 /prefetch:8
      4⤵
      PID:4044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4672,i,15654906950411694795,17436013843367478357,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=4688 /prefetch:8
      4⤵
      PID:3828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4144,i,15654906950411694795,17436013843367478357,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=4720 /prefetch:8
      4⤵
      PID:2404

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjBEQjgwMEUtODhGNi00MzM4LTgyMEMtOUI5Q0Y2MjkyQkUwfSIgdXNlcmlkPSJ7NDMwQjQzQUYtMTlCMi00NEFELUFGQTMtMTk1NzY5MzIwNDlFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NEVFMDJGODYtRUExOC00NzQyLUI2QTQtN0FDQ0YwMTU5Q0QwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMyMzYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDI1MTE0ODAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODc3Mjg2NDA4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1544

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\430972a2-1a3e-49c9-8c25-a3836d7aacdb.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c353453146dac52b6ca715d772f39eab

SHA1
91e67b7b7b4fb5f082b3860640b82f8d3b1a91fd

SHA256
115b674d3610baab329c84c7e35c920470ecee7afda618586b703aaa1754941d

SHA512
ffb2ce4eb52332129fdf0be58547154c90c143b939d9b5be0ddd2c5ceef67f91aff035e1eaadf88e9fd84d09f8932a2ea8b38566f09086b66e008dfabc6d1a81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
353dadbc10b503282d27cbdaa589d86b

SHA1
963febc31c329072cdb30e0164e5c1bbdcbe7389

SHA256
07280d7052f986f4cf7d229c6826738e59fcfaf0f90118809ff56127b410d560

SHA512
dcf08dc4b751962987423c7c9a046308e6a0b5105fe446a2a5effda04fe7cbd9f498456deafba8acbddbb57b5ff3dbc5794c9417d7460bb977b20c6e8c352873

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
e277af9ed25c786e6df2fcb1bbc502ed

SHA1
225e8410f0f033e0c9a0fbef4ab787dd78d9dca2

SHA256
1fba32ac9c0aa01ff4d7f5492a514885385f04df055c16ed51fa9cb2e32949af

SHA512
1c9a4e3db52771bbcac6e1ffb308aa81d14802a4b44bdef1df3709114caf0d6ec80cc0ef173a1f4bca8f530ed9f16279f204c7e87df0d300e29cd94561df602e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
76e95d89adea4be219c6fc2e6df1c60d

SHA1
828ee470dd9247ae1f6519bd68a5272f7865e80c

SHA256
36b6bb003a5581f19185a9ee9e2a6fb5a5301fc7332d58bad8aec764af93d1d0

SHA512
87575ea8f6dd524fcf5be138d96ee461f3ba0beaecd9923d3ec83e1a7566b09a5362a0f727366a54167161df901d48ef02acc22efc6c825e697b5b207de0ac8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
247KB

MD5
6d31463182fb316f6a2d235cb22a7ff8

SHA1
9a328bf696a73944b146583076c6bc531a2af334

SHA256
26d4c904b7e44cbe23051adc41e2976dfcef4c4efb5a0d2b9d5dd793432938be

SHA512
238a4d5564cbe35b08a558f69b13c6024a879a5c2ba88bed5a63fdae1ea59732386d36b7033b1a95491dd1730f698e1bed4353d8865678a859fd64bdfed7d778

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
247KB

MD5
5155ab5b337820671de2ac05bc315814

SHA1
89d91e7e19ec2b11369a7b77e8b3de3d63c787be

SHA256
f43fb3359f3912fb6ae4fcc819e2d90e86201ea5403529add6ae948844a9492f

SHA512
14635f48e2e5670180b8318a113d60190f30dfc3e40e3d4e5862e4d38b405ba36a89c2eb9bbb618e7995b0163947f9c50f7d69d7ad3959bf30a90a96dffc32ce

Download Submit
memory/3476-38-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3476-4-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3476-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3476-13-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3476-1-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3476-12-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3476-11-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3476-2-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download