kutaki | hxxp://h3a[.]in/jdtesc

Resubmissions

17/03/2025, 02:44

250317-c8ad2s1ky5 1

17/03/2025, 02:34

250317-c2ncbsxwds 10

17/03/2025, 02:29

250317-cyyc5axvct 10

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://h3a.in/jdtesc

Score

10^/10

kutaki discovery keylogger stealer

Malware Config

Extracted

Family

kutaki

http://91.223.82.87/~ojorobia/laptop/laptop.php

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki
Kutaki family
kutaki

Drops startup file 14 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wlydzkfk.exe	RTGS.cmd
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wlydzkfk.exe	RTGS.cmd
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe	RTGS.cmd
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe	RTGS.cmd
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe	RTGS.cmd
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe	RTGS.cmd
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wlydzkfk.exe	RTGS.cmd
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wlydzkfk.exe	RTGS.cmd
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe	RTGS.cmd
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe	RTGS.cmd
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe	RTGS.cmd
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe	RTGS.cmd
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe	RTGS.cmd
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe	RTGS.cmd

Executes dropped EXE 7 IoCs

pid	Process
4640	glndlzfk.exe
4424	glndlzfk.exe
5496	glndlzfk.exe
5732	glndlzfk.exe
2176	glndlzfk.exe
2960	wlydzkfk.exe
2436	wlydzkfk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RTGS.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RTGS.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RTGS.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlydzkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlydzkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RTGS.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	glndlzfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	glndlzfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RTGS.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	glndlzfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	glndlzfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RTGS.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RTGS.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	glndlzfk.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
4676	taskkill.exe
3192	taskkill.exe
1484	taskkill.exe
1784	taskkill.exe
4276	taskkill.exe
3420	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133866522058084607"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3192	chrome.exe
3192	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeDebugPrivilege	3192	taskkill.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe
Token: SeCreatePagefilePrivilege	3804	chrome.exe
Token: SeShutdownPrivilege	3804	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe
3804	chrome.exe

Suspicious use of SetWindowsHookEx 42 IoCs

pid	Process
5504	RTGS.cmd
5504	RTGS.cmd
5504	RTGS.cmd
4640	glndlzfk.exe
4640	glndlzfk.exe
4640	glndlzfk.exe
1876	RTGS.cmd
1876	RTGS.cmd
1876	RTGS.cmd
4424	glndlzfk.exe
4424	glndlzfk.exe
4424	glndlzfk.exe
3316	RTGS.cmd
3316	RTGS.cmd
3316	RTGS.cmd
5496	glndlzfk.exe
5496	glndlzfk.exe
5496	glndlzfk.exe
3780	RTGS.cmd
3780	RTGS.cmd
3780	RTGS.cmd
5732	glndlzfk.exe
5732	glndlzfk.exe
5732	glndlzfk.exe
5256	RTGS.cmd
5256	RTGS.cmd
5256	RTGS.cmd
2176	glndlzfk.exe
2176	glndlzfk.exe
2176	glndlzfk.exe
4480	RTGS.cmd
4480	RTGS.cmd
4480	RTGS.cmd
2960	wlydzkfk.exe
2960	wlydzkfk.exe
2960	wlydzkfk.exe
4712	RTGS.cmd
4712	RTGS.cmd
4712	RTGS.cmd
2436	wlydzkfk.exe
2436	wlydzkfk.exe
2436	wlydzkfk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 2936	3804	chrome.exe	87
PID 3804 wrote to memory of 2936	3804	chrome.exe	87
PID 3804 wrote to memory of 5512	3804	chrome.exe	88
PID 3804 wrote to memory of 5512	3804	chrome.exe	88
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4856	3804	chrome.exe	89
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90
PID 3804 wrote to memory of 4528	3804	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://h3a.in/jdtesc
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbe68ddcf8,0x7ffbe68ddd04,0x7ffbe68ddd10
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1972,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1992,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2288,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4404,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4544,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4852,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4716,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4984,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=208,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5800,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5784,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5860,i,11028134492786699313,2151414996525277304,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3920

C:\Users\Admin\AppData\Local\Temp\Temp1_RTGS.zip\RTGS.cmd
"C:\Users\Admin\AppData\Local\Temp\Temp1_RTGS.zip\RTGS.cmd"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4640

C:\Users\Admin\AppData\Local\Temp\Temp1_RTGS.zip\RTGS.cmd
"C:\Users\Admin\AppData\Local\Temp\Temp1_RTGS.zip\RTGS.cmd"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:844
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im glndlzfk.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3192
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4424

C:\Users\Admin\AppData\Local\Temp\Temp1_RTGS.zip\RTGS.cmd
"C:\Users\Admin\AppData\Local\Temp\Temp1_RTGS.zip\RTGS.cmd"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2792
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im glndlzfk.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:1484
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5496

C:\Users\Admin\AppData\Local\Temp\Temp1_RTGS.zip\RTGS.cmd
"C:\Users\Admin\AppData\Local\Temp\Temp1_RTGS.zip\RTGS.cmd"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:388
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im glndlzfk.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:1784
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5732

C:\Users\Admin\AppData\Local\Temp\Temp1_RTGS.zip\RTGS.cmd
"C:\Users\Admin\AppData\Local\Temp\Temp1_RTGS.zip\RTGS.cmd"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im glndlzfk.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:4276
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2176

C:\Users\Admin\Downloads\RTGS\RTGS.cmd
"C:\Users\Admin\Downloads\RTGS\RTGS.cmd"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4108
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im glndlzfk.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:3420
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wlydzkfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wlydzkfk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2960

C:\Users\Admin\Downloads\RTGS\RTGS.cmd
"C:\Users\Admin\Downloads\RTGS\RTGS.cmd"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4444
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im wlydzkfk.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:4676
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wlydzkfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wlydzkfk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
414B

MD5
b4c1d7b331d799643b1d5758752a459d

SHA1
c253d231fe6012c72af4abf80fa59d66aaa19631

SHA256
4c67bb12bb4725015f79ad46347c2360de1c409c3b50762e7688a643d50ad594

SHA512
56bc6ff9e9e43c25fc7ff7a5b6737772e575138a3c05245506702ea136c9193e1e5d9b3c9b57d1e3755a2980237a0d1a95ee77ebdcb3c0e1582f93fa1b6993c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a6f97f0e05c4a5d5fc43487a866b3f77

SHA1
a73261da93eae857821e1fbd0f47d9024134167f

SHA256
b9c699f33be9da15140dbc651cc5c48530b5e17906dfc2c0625f0eda559fe6b0

SHA512
44e22149a993ba2e4304fde87c41dea0c355f7afabc762222052edeffd84a68b387903026c2948f8535f3d8de18a24807480bfa27cc5e99cfe8723835b6d94ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0c7ed35cb2075b3d25b2d6281257f694

SHA1
b93f848f857f16c32f33e9e096ee1ec53a1d0949

SHA256
e3cb01682f51d75fc45a81f274479635cac056a180023b967cdd4c2bbce00211

SHA512
541bac997a87247e5eb1fdb02ef69eeae0bac23ff9ef785645715058a706cc271fea45bf6af20afaa1c177835a470a6938a90b7982f97f712a28564061b090ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
126a5fa907cb10f011ea16bc04513de7

SHA1
7d703ae62faf08166c8d9633e71e8067fa79f699

SHA256
e79998eecb2651830e0eb06a8880489fcc79aa277bc01512aaab9eed45c8d320

SHA512
1007ac28b6bd67ff42645c99239bf2d3ec191407a1aee334f301ac42e7f1dff2c0d7dec75acb86ea32cff134451536175bd502ea7ab4f0bb3f0f1da192513e52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
38b4bb16a5c25b947334f023fa56e9ab

SHA1
8e612d40015f3142f2546a17b9bd05eabf0e3730

SHA256
d3c894a42ced4675950a3ae23d39f44322f9b731fcf71a2aab04721169d56078

SHA512
db23b91f94b26c3c9966f21b46e84724319edfb7dafe4f7aac64c9a89e5dda46c36b803795a7b6016e049472c5dd799ffccfd3ed96bca1fe9903cf3f6701ad6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a23b.TMP

Filesize
48B

MD5
5eded3cb44cc6b0b8b24ec35c3d5c655

SHA1
8385fd831a6f23d47e30e1a484ff189f3657e593

SHA256
82b8c108391859f2ffc4ed942603f3b579b369724c8b1e64c9b2774235bcfac2

SHA512
c98a97d19ca594974b1899ace86ba5060b384fde146206e891c1e5e32451adfe82e7a1f225f2da8fc48e78f71882e52f5c821514f0fddfcc1cac7807aeee2bcf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b9abed4f-d434-4cf5-93b1-d04f961433cf.tmp

Filesize
15KB

MD5
479bdb9e053135eba15da92973663bc8

SHA1
04445d497687d5f8af0490206114184230bebcd9

SHA256
260e6af3ae7ea680290e6459f4535b9e5e046330c8b7b739730a45b014f5ba47

SHA512
399cd2bef7fae6f9534462d0f5a0a254c85ecaa373633ec0aecedf5a0305a1582544961102be698ec97c59d998786b1114b69b199570305d38c944db3370d8d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
387d82634d34d3286c6a212f7f3db0ee

SHA1
4078b92b0940d9ebb896248564655177d4abda39

SHA256
9637b8b88a1b1272ca6efcb7b17357bf497c6de8857d4d91be6cc7c9c5f1563e

SHA512
3c8c615e507c2cbd93b3d4a8daaa61cd24ca4d7763d0a0499dcce54a94470d1b200a0c3f25fbe68a14eac74a65e95e5ade348915be619f5728c93f5cad06f4ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
6126187b2a0c782c60bf24f3ae989100

SHA1
c62cdde203e0b90b6f8332c906dfd86fc90030eb

SHA256
07bd16b2e4f41f08d3eedbcc8ac4374a8f1da67dfb57577093b53407a67beb2f

SHA512
3fd82096bd0a5b47f6c86d94f8ece2b39d5c040ba3d923b3c0893dd1b1280e4b134623c9a725b47faabcbe3ff54f5b7781fa6aae26dc79452e9258648a603cff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
c2c3017c7e79c5b4fd737cc64fa7a5af

SHA1
195dcc7d27d86d2acdab291256e50b619c2f05a6

SHA256
51dd1ea13f6dd3f59c548bc4d02c2fbb15c51cb1c0e66b6705d41d8f555ebc7d

SHA512
530970ef6fd824b0e9c68c851204a3d70d411b3ebfc4016962a90e58aded747002dfac36588255a024acdd79f39571950390a55af88ab84409274c85c4fe5707

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\glndlzfk.exe

Filesize
500KB

MD5
8092b76f06d46ae065e8334fa8f26234

SHA1
473dd2cf98b6ace253d83191389cba86d306b94c

SHA256
b4c2077be7a4185869fb91d5f651eb30e53f3eb31c35dee36a85101dc9d612ab

SHA512
1701121fcb0de54592f9c26431258f18276a9f0597cabc7b09553686c913ef5ab9fd2590f9b2f7e8edb671baaff18cf5a5939eb2caea77481fa80e959bf2d0f9

Download Submit