stormkitty | 373d1f853c91d91ca2bc663d3776eefb66189d3c424c683224039d5d6f477099

Analysis

max time kernel
92s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe
Size

21.4MB
MD5

759850b1ce1d64533dfea82dcf5c00b3
SHA1

06ef173730c2b389ce26e19c65f27c6fbf6d61b3
SHA256

373d1f853c91d91ca2bc663d3776eefb66189d3c424c683224039d5d6f477099
SHA512

bec70ed7abf337d0318e10f415ab26b0f1ab91e7f26881793617e16c539593d1ea60623dc7fe95ac1155bb778502b74f73428d364e4b5bca672f370128fba110
SSDEEP

393216:XNVguCXVYHSTEUq9D1CvTQ2S9nekuCdQkUkEwmkO77j+vPhwrgxuA:XNVgLXVpT94WQ2S9nvViVkKvj6PHxF

Score

10^/10

stormkitty collection credential_access discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/1324-2-0x0000000000700000-0x0000000000F00000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 212 created 3488	212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	56

Uses browser remote debugging 2 TTPs 10 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4592	msedge.exe
808	chrome.exe
3320	chrome.exe
5064	msedge.exe
2040	msedge.exe
2424	msedge.exe
4688	chrome.exe
4452	chrome.exe
2028	chrome.exe
464	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ipinfo.io
12	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 212 set thread context of 1324	212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	90

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3652	cmd.exe
3656	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegAsm.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe
212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
1324	RegAsm.exe
4688	chrome.exe
4688	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
4688	chrome.exe
4688	chrome.exe
4688	chrome.exe
4688	chrome.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	RegAsm.exe
Token: SeShutdownPrivilege	4688	chrome.exe
Token: SeCreatePagefilePrivilege	4688	chrome.exe
Token: SeShutdownPrivilege	4688	chrome.exe
Token: SeCreatePagefilePrivilege	4688	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
4688	chrome.exe
4688	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 1324	212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	90
PID 212 wrote to memory of 1324	212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	90
PID 212 wrote to memory of 1324	212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	90
PID 212 wrote to memory of 1324	212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	90
PID 212 wrote to memory of 1324	212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	90
PID 212 wrote to memory of 1324	212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	90
PID 212 wrote to memory of 1324	212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	90
PID 212 wrote to memory of 1324	212	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	90
PID 1324 wrote to memory of 464	1324	RegAsm.exe	91
PID 1324 wrote to memory of 464	1324	RegAsm.exe	91
PID 464 wrote to memory of 4824	464	msedge.exe	92
PID 464 wrote to memory of 4824	464	msedge.exe	92
PID 464 wrote to memory of 3256	464	msedge.exe	93
PID 464 wrote to memory of 3256	464	msedge.exe	93
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94
PID 464 wrote to memory of 3588	464	msedge.exe	94

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3488
- C:\Users\Admin\AppData\Local\Temp\2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff83837f208,0x7ff83837f214,0x7ff83837f220
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2352,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2196,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2740,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3520,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3580,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4188,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4244,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=3656,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5280,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5604,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5656,i,2079451307423645443,7889902780792988701,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
      4⤵
      PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3652
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:3260
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3656
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:3036
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2636
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff84734dcf8,0x7ff84734dd04,0x7ff84734dd10
      4⤵
      PID:4736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2080,i,13456046792193799019,13895463708302814596,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2076 /prefetch:2
      4⤵
      PID:2968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1588,i,13456046792193799019,13895463708302814596,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2176 /prefetch:3
      4⤵
      PID:1684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2392,i,13456046792193799019,13895463708302814596,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2552 /prefetch:8
      4⤵
      PID:764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3032,i,13456046792193799019,13895463708302814596,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3112 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4452
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3024,i,13456046792193799019,13895463708302814596,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3068 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4340,i,13456046792193799019,13895463708302814596,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3020 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:3320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4760,i,13456046792193799019,13895463708302814596,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4776 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4944,i,13456046792193799019,13895463708302814596,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3940 /prefetch:8
      4⤵
      PID:1932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4800,i,13456046792193799019,13895463708302814596,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5068 /prefetch:8
      4⤵
      PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3656

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
3495525d66935f7483ff821d128cda84

SHA1
d3b4ce99b64b0b0950e4531314a8db6ae21728e6

SHA256
9dbde8548f16831e91eb1a78de764564746e8d4c154eecf9ced3514e10d063d4

SHA512
30188a9f7bcf63ff5787cdfea7404d89a2cfd1ab29b95104044beedf606084616084036a5eaff17d80a9c5e52a2e1774e8fca28560aaeae154f720b79915db5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
fed4ab68611c6ce720965bcb5dfbf546

SHA1
af33fc71721625645993be6fcba5c5852e210864

SHA256
c41acdf5d0a01d5e9720ef9f6d503099950791b6f975ba698ccd013c4defa8c4

SHA512
f9ab23b3b4052f7fda6c9a3e8cd68056f21da5d0fcf28061331900cac6f31ef081705804d9a9d4103ee7d9c9bdb6aa4237987b7e821d2d96cd52da24219e55ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
4013ebc7b496bf70ecf9f6824832d4ae

SHA1
cfdcdac5d8c939976c11525cf5e79c6a491c272a

SHA256
fb1a67bdc2761f1f9e72bbc41b6fc0bf89c068205ffd0689e4f7e2c34264b22a

SHA512
96822252f121fb358aa43d490bb5f5ce3a81c65c8de773c170f1d0e91da1e6beb83cb1fb9d4d656230344cd31c3dca51a6c421fda8e55598c364092232e0ad22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb9a4039-5fee-44f8-a618-d20a135c468d\index-dir\the-real-index

Filesize
648B

MD5
d91f495cbbd140b78d9ef3e530b726a9

SHA1
bb74d3bafd7b002096e7a5a7182da88c3617abd5

SHA256
e01ab2675a6f6bbaf6edf52a68d762590e91147385e5a8cafe054de1b793f088

SHA512
ddce638fe9962af44079fd7b392fa6c4fb1f8b41a7cf98e9968a0a029faa35137dedc23f4f13637f86f9c5e8eb97678cdd770dbc73dc863787e5383b4fcf030d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb9a4039-5fee-44f8-a618-d20a135c468d\index-dir\the-real-index~RFe577b98.TMP

Filesize
648B

MD5
5606494c44a3c81e0330075a86b8cbf5

SHA1
a940aa20bd9901f4c59e8058596832887a999c42

SHA256
87be3b1f398210139bdd6eb61622bcf72435e1f66c402f751c42b9b191caa70d

SHA512
8e50712dcf6b16e5f0c8a2f9ac31b82ed9fe93329dc972d9b56017128b15b720baa394729c8093f198dd0c143cb312631da748a9ea0850a65414a386adf68a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
edb024a232b79e39ec755318b93fa836

SHA1
1cebe41e02a3c2bec5af71164e635b235a364297

SHA256
bda4a31b23b4f1694521601e56a7853efc23c785eda336570501bd70387f1258

SHA512
4f498e1f4f2adcc2b181b9e50f0fa3c7b7b9b274f3acd93beb5755744d542626fd457b6cd94db71460dc8e34656e6df04ad10a14f056d829bf2843fdfe7570ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
50dddaae1872363f09fff04eb547d52a

SHA1
57cf12f83188b8e185bb93931e0b8032512aa150

SHA256
be6579b907535a34e59d5166559bb0660a3c7b286ef194a9880fe0a5615118cb

SHA512
473e0010e5df08d644b75adb905ca19969695ad388dbf8b88e11968e8f567186d2f2acfebc5b3d296f269211e1384ca71b94b834c83c82160a021c01847c689a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
2f34a1f092237f14a9b5289f74fcf586

SHA1
a3af05641b18979b4785d067e1f6ba70bfbb55ec

SHA256
c041b6d8e1393a9ca51bd7637c108708ba6a26f63ff50d776125c6ffb4ca77bf

SHA512
c4fefc9d92daa6ac64d98ff6813c88a251fb43b6ae714fe2bc43488d3ecddc33354dba57de0b4c296c205a004c1d80b62df53b812e2d0d9faee88f360878303f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
ace07b1377d571f3dbf27acd2b8654c3

SHA1
1c696902720b03db38a49b0a53c0d623382fb4f7

SHA256
91d884d82ad9ea3dd3f20049bedd95d903772963a552a1279cf736ee2bd4cd33

SHA512
e52c96bbcb41b9249b54cac79252515c74c0d3311713e6573da725d25a6fe12ed83586772519e1cb0c939bf619a8e84c0b7418eb316cbd0f54772d008fdecb80

Download Submit
C:\Users\Admin\AppData\Local\Temp\212.102.63.147.zip

Filesize
430KB

MD5
d6403f5944845e358796fc222ecfbeb4

SHA1
d228d1aeb52847b04d01d00321f8fc4035701601

SHA256
729cf71604ca78fa4721d3253a181f72c916a1118bfbffb34345cf15825d2696

SHA512
11ea179bafa1340d6fb1d8f493f0db3cb431f30d55e2dd945d8fb2f49d3dd97e931b7d3c3d6bbe91a6448fd7a3bf39364c3864c2cc50c4340c8c31bd71960547

Download Submit
C:\Users\Admin\AppData\Local\Temp\212.102.63.147\Browsers\Firefox\FirefoxBookmarks.txt

Filesize
81B

MD5
ea511fc534efd031f852fcf490b76104

SHA1
573e5fa397bc953df5422abbeb1a52bf94f7cf00

SHA256
e5fe7f327ae62df007bd1117aa7f522dbbcd371ec67953f66d786424cb1d7995

SHA512
f7d8e575a2332b0fbd491b5e092b7ed6b0942a5165557fcc5d215d873b05103aa6ba01843133871c1c7ac81b10182a15895be49885c98d1a379dd55f88004fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\212.102.63.147\System\Process.txt

Filesize
4KB

MD5
475638a05ab14dc73b32f8eae3dd138b

SHA1
064226cf9067ac292ae1c7d48a704b7f8fc5c977

SHA256
68bb8a7c6214a42709e138987a6c9023a7f7afb283f220e82d85247a566b9d31

SHA512
4606bac10cea1c5ad2e714ed626312f0de4374ebe65d920e8279553e112cb8ef162953ac80efba7d0e288746af3f14c8afdb1fbfaee47e15a29606de3a6c1d3a

Download Submit
memory/1324-274-0x0000000006CB0000-0x0000000007004000-memory.dmp

Filesize
3.3MB

Download
memory/1324-0-0x0000000000700000-0x0000000000F00000-memory.dmp

Filesize
8.0MB

Download
memory/1324-331-0x0000000007770000-0x0000000007802000-memory.dmp

Filesize
584KB

Download
memory/1324-341-0x0000000007810000-0x0000000007876000-memory.dmp

Filesize
408KB

Download
memory/1324-217-0x0000000006C80000-0x0000000006CA2000-memory.dmp

Filesize
136KB

Download
memory/1324-427-0x0000000008130000-0x00000000086D4000-memory.dmp

Filesize
5.6MB

Download
memory/1324-454-0x000000007458E000-0x000000007458F000-memory.dmp

Filesize
4KB

Download
memory/1324-5-0x0000000006360000-0x000000000688C000-memory.dmp

Filesize
5.2MB

Download
memory/1324-2-0x0000000000700000-0x0000000000F00000-memory.dmp

Filesize
8.0MB

Download
memory/1324-520-0x00000000071E0000-0x0000000007200000-memory.dmp

Filesize
128KB

Download
memory/1324-521-0x0000000007600000-0x000000000764C000-memory.dmp

Filesize
304KB

Download
memory/1324-1-0x000000007458E000-0x000000007458F000-memory.dmp

Filesize
4KB

Download
memory/1324-3-0x0000000005340000-0x0000000005352000-memory.dmp

Filesize
72KB

Download
memory/1324-4-0x0000000005560000-0x0000000005722000-memory.dmp

Filesize
1.8MB

Download