xworm | 4c6183029dcf2e4d604c473c2dfb4f72037b6a8f13d9183b0842fd201e422d7a

Analysis

max time kernel
65s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ikTdqf.html
Size

7KB
MD5

aa5d13590623abb5d3963a8af5dfb85d
SHA1

8dcb62e75f970ac4f9f78e2558f335951b599774
SHA256

4c6183029dcf2e4d604c473c2dfb4f72037b6a8f13d9183b0842fd201e422d7a
SHA512

94899bfebc29d4d76c1a8d0e9b787ae50386a5e8718194791d27d86eb7e67e1b0e1a9b0a4e68031905c767419bd767b9d2666ac5ffd0a8dd87c0bf842ac7282b
SSDEEP

96:CMq9SlLh2B3Zq36uWl/PtxyjttJQ8Maoah3vL5LaNclmnU1Eh2sS:T1lLhwJrPahtJxMaoah3vG12sS

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

band-hypothesis.gl.at.ply.gg:6089

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023b83-109.dat	family_xworm
behavioral1/memory/820-112-0x0000000000240000-0x0000000000256000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Downloads MZ/PE file 1 IoCs

flow	pid	Process
89	3020	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
820	RedWare V3.exe
3876	RedWare V3.exe
3276	RedWare V3.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
92	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133857361891679516"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 5104	1968	chrome.exe	87
PID 1968 wrote to memory of 5104	1968	chrome.exe	87
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 2156	1968	chrome.exe	88
PID 1968 wrote to memory of 3020	1968	chrome.exe	89
PID 1968 wrote to memory of 3020	1968	chrome.exe	89
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90
PID 1968 wrote to memory of 4876	1968	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ikTdqf.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe8894cc40,0x7ffe8894cc4c,0x7ffe8894cc58
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2168,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4624,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4984,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4024,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4940,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4956,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3152,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3472,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3176 /prefetch:8
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5648,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3272,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5944,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3212,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5548,i,18383757986140686976,2310526377981149660,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:4964

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3128

C:\Users\Admin\Downloads\RedWare V3.exe
"C:\Users\Admin\Downloads\RedWare V3.exe"
1⤵
- Executes dropped EXE
PID:820

C:\Users\Admin\Downloads\RedWare V3.exe
"C:\Users\Admin\Downloads\RedWare V3.exe"
1⤵
- Executes dropped EXE
PID:3876

C:\Users\Admin\Downloads\RedWare V3.exe
"C:\Users\Admin\Downloads\RedWare V3.exe"
1⤵
- Executes dropped EXE
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
1b8e29f143562599a875f9dae3c07e34

SHA1
d714a81ce4e8d4cefa339c24c6516e52a23713d4

SHA256
5e3dccc1ecb20604ce5365c3b23ca76da21b34be73b2f040c09c054e97d47c57

SHA512
a2b3ae5ddd4011788fd54ef711c444e21c1ae147ec74adb715a2a3a6f2636410817d0490b35f1837cf30832c4216061f4c9bb45d9a966ba4d5309f13557bb490

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
b17248387d144991669d4c5c50059b9e

SHA1
045465a62ca643a8cd433b8a99aa9f3a161bea4b

SHA256
3ab980f2bf957850abf4f0f5a6a46516cedd29032a07f6bed8aa9e180db93165

SHA512
2e07e7427f42a16d18fbb09cbb00ceb4e8c1b25d13c9033a5156db7817906969cfa77c1e28081f766c05919991bbbd6a23fa5e1df5edfa3700ec11e4b762646c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
f24642da96f29ad6e81558d855639311

SHA1
c7ae5d02e2a40b845dfdc129c870c915c28d0347

SHA256
8db261907c82b6803b7d58501e8b6be661f9c9349ef7092b581df7c8230bc320

SHA512
dae456989a9c8ecddab96870170639529da0420e3b541f096346b1f46729939afe3d55d36b857f0cd54ab5de6bd7b7c53c9c06dcb1bb0b466709a0a338ae4c8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
e1a9ebb07fc9c4474a758629141e3e9d

SHA1
68a601b3509b2b0b7b9ef9e937eebcb002ed04a9

SHA256
0ee44ddf319740c23166cc38f7170f769889864c8f9054d08378d8649dd441ee

SHA512
f2a464b59735cf80c039c06c56bec985740a0c9da6a7d8b3bfe9f87dc1ce9623de621951448ea92ca005315663b372efe5b2d4dbb30bb0e616321b93de1c1596

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
26507d553f53220e784cdb6e08d5cdf0

SHA1
096969d118d52ab17d5c4fdc9abfe3a97d7d72bf

SHA256
f530676fdc3a2eaeeddc80fe2f745684afc9bd461cb1979974ace303a770f6c6

SHA512
2507143d0e77c0a5cf2b55957218ff02312d7d0e00b49b956ac103e9757f52c5269979aa69b4ca16bafdad9f4a31ccc98361c36de14347ccdd3638309f792f47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
85eb72ca72e3774e075b6be22f6049ad

SHA1
4d80167b397ce12869a110492a5bf9d4b16a85c8

SHA256
c597558359be27a1595e7d8597d0569e2ee75582cabfdd96c33216ad19c7f634

SHA512
cda419d6fc952bf64d89ad1cbcbf4ccabf6bf5ff447a16c7035dee4ffe83d6d9e44d09032ef05f159bb9688000c76ab77d55d8315728c175beae17f20a8848ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4df967eb4743418fda4696aaabff6e93

SHA1
e0ec879badba622ed64608fd5b0504e36a777ff1

SHA256
58c23856ec0c051edc2b6adf46ea715035f46c8ae4264d2e237c2d41ca1e22d4

SHA512
9bd9ec26c43b509338d186bc3900e1b6dec01af983d48aa479947c99b6a44edd9c56dd0eb3b1eb7a9bff1254aea871d1693fe5d34d5dd5dd068ee52a9d02e8b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7296426658a23ab0afedac479e8c3cbf

SHA1
4c54b8cbbc35796fc9ded4432165ec6e687c18ab

SHA256
301a465b2d1b18f3ec0ade0d196bf7afb2f8bd44a95b5b4598ceb9e754924224

SHA512
74d7bb9d79fd998540a9a487f07d790f15b16838bf6c36c710d0025b9cbb0ce8706643803a3036233d4b4e7654f57d1ccd0811e071498e0d8b5d211899b3e273

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
4a5feb98ba42ba70848875a621f70db6

SHA1
ce30cca23de12f119ab4a84e78da30f8e34d551e

SHA256
fd8e918f048c5bb8990036df05d656be2e4613c484651ac9e8ec961a9eeb99ae

SHA512
6359a8929d8e105b86b15650160da22a999953ecd1919cc2a144fe914bdc655e8aab9e7863dcedf1962246f69453a4b072228a970b59622c2c5c5ff5b473e516

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
2ea0fa9512fb12ed25ed7ffc021a6bc4

SHA1
e0e3708d5f6d18b17373f667144ddc6609e96573

SHA256
0fdd3b1ed82f773ce91a02e2dccfda473872f82f4728c80a551a63a3361acf9f

SHA512
8aa54bc1ba3521879947d8a8426c27a9ca199d8a80420a129d393390b2ee24bab28a07590b44cecc1cd864c8b6a5e2e3c78c43d52a138ddccfbe0e8cb74eb05b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
91125f91a6d3e7ab3e4e65393d6f7edd

SHA1
3f26ec007ad1a7e8c58543578fa1177e706a6f92

SHA256
7be6cbf493e1057931436c1ca2a0061dd4d0acbd104aedf882a44f84cbc29f97

SHA512
01263f6e06a6e63002ea2affe5bff2c4019f6ad2e5ee12a45a6e27c880b11058ecd6d522dd7e9cd977dc35fa52481ad0a3e79b0e868be6cfd6361cfc44968625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
8abe348b6f637f8d769907b8849c8034

SHA1
807d93275c91d247d04514998a622546b3b3a643

SHA256
97c04892662d86d5b995c36516869eec69d072604d77e8b3efbd637638f0232e

SHA512
47c27af61f0be738189b8a2bff31be4dcfc40d7b303b879bcf242e85ec2d15d23956641d3f4c0fa651fc071a5568ccc8840ee5ea24256d19d209b131c349687a

Download Submit
C:\Users\Admin\Downloads\RedWare V3.exe

Filesize
65KB

MD5
8e0620072a142972c350d7fecbc511eb

SHA1
27fd6d5dcbcefac646c0cff0d3dd11ecebcbfb45

SHA256
a4c8b9583001d6f38417c5a59d96c7020c788c81995df8b9a3cd15ad61c43640

SHA512
fa17eace548070bfe8a0faa5f131714c63f25ea9df817bf37adb0006b392b9be62ae61177896a08a9bd4e6c74f1e80adf02c730d2aac34ac627d6c452aef4b92

Download Submit
memory/820-114-0x00007FFE739D0000-0x00007FFE74491000-memory.dmp

Filesize
10.8MB

Download
memory/820-113-0x00007FFE739D0000-0x00007FFE74491000-memory.dmp

Filesize
10.8MB

Download
memory/820-112-0x0000000000240000-0x0000000000256000-memory.dmp

Filesize
88KB

Download
memory/820-111-0x00007FFE739D3000-0x00007FFE739D5000-memory.dmp

Filesize
8KB

Download