stormkitty | 373d1f853c91d91ca2bc663d3776eefb66189d3c424c683224039d5d6f477099

Analysis

max time kernel
102s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe
Size

21.4MB
MD5

759850b1ce1d64533dfea82dcf5c00b3
SHA1

06ef173730c2b389ce26e19c65f27c6fbf6d61b3
SHA256

373d1f853c91d91ca2bc663d3776eefb66189d3c424c683224039d5d6f477099
SHA512

bec70ed7abf337d0318e10f415ab26b0f1ab91e7f26881793617e16c539593d1ea60623dc7fe95ac1155bb778502b74f73428d364e4b5bca672f370128fba110
SSDEEP

393216:XNVguCXVYHSTEUq9D1CvTQ2S9nekuCdQkUkEwmkO77j+vPhwrgxuA:XNVgLXVpT94WQ2S9nvViVkKvj6PHxF

Score

10^/10

stormkitty collection credential_access discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/3608-2-0x0000000000B00000-0x0000000001300000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4884 created 3424	4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	56

Uses browser remote debugging 2 TTPs 10 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3444	msedge.exe
1784	msedge.exe
3576	msedge.exe
2068	msedge.exe
1212	chrome.exe
6088	chrome.exe
3016	chrome.exe
2312	msedge.exe
5028	chrome.exe
1128	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ipinfo.io
15	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 3608	4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	93

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5388	cmd.exe
5632	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegAsm.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe
4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
3608	RegAsm.exe
1212	chrome.exe
1212	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3608	RegAsm.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
1212	chrome.exe
1212	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3608	4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	93
PID 4884 wrote to memory of 3608	4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	93
PID 4884 wrote to memory of 3608	4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	93
PID 4884 wrote to memory of 3608	4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	93
PID 4884 wrote to memory of 3608	4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	93
PID 4884 wrote to memory of 3608	4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	93
PID 4884 wrote to memory of 3608	4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	93
PID 4884 wrote to memory of 3608	4884	2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe	93
PID 3608 wrote to memory of 2312	3608	RegAsm.exe	94
PID 3608 wrote to memory of 2312	3608	RegAsm.exe	94
PID 2312 wrote to memory of 600	2312	msedge.exe	95
PID 2312 wrote to memory of 600	2312	msedge.exe	95
PID 2312 wrote to memory of 4636	2312	msedge.exe	96
PID 2312 wrote to memory of 4636	2312	msedge.exe	96
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97
PID 2312 wrote to memory of 1248	2312	msedge.exe	97

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-03-30_759850b1ce1d64533dfea82dcf5c00b3_frostygoop_ghostlocker_sliver.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffec94ff208,0x7ffec94ff214,0x7ffec94ff220
      4⤵
      PID:600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2280,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2460,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3612,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3628,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4748,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4352,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4708,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:8
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5216,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4784,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5132,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5944,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5944,i,3110161697183065386,2905813033268707319,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
      4⤵
      PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5388
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5612
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5632
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:5644
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6024
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:6064
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:6080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffed8fadcf8,0x7ffed8fadd04,0x7ffed8fadd10
      4⤵
      PID:4928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2024,i,14232530155788048473,16611173422048178842,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2020 /prefetch:2
      4⤵
      PID:5688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1628,i,14232530155788048473,16611173422048178842,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2296 /prefetch:3
      4⤵
      PID:5096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2404,i,14232530155788048473,16611173422048178842,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2568 /prefetch:8
      4⤵
      PID:4688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3256,i,14232530155788048473,16611173422048178842,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3264,i,14232530155788048473,16611173422048178842,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4472,i,14232530155788048473,16611173422048178842,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4492 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:3016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4812,i,14232530155788048473,16611173422048178842,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4748 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4804

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
39f920d61e31a958865e2349967c582f

SHA1
23d9b73e00f410b75678f7f8ef06a766f197d11a

SHA256
c24c32636d5d645b773351b3ff91d12a3ce9f3db7518d3bb59dce2f9aa155463

SHA512
1bdb15f3cbd28076c1bff65b3de4c7fa7e5fc5f4c66f6ab9b7586b7116f6b64e764a5e33572459d744c288e981ef84c23b823d9979b73a6c2b7f0e2b01e2771c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8734b4a181214bb62f91cfa36c7e2c98

SHA1
9cff323f10778a23d73ac3dcffc038d3bf661b78

SHA256
e06afe980fa56c8dad3e7c6b8d0d8f1e7eb9a4860ac715e966026fb7631c3ba5

SHA512
e8648a54da9aa24b6cba1f0377a0ce33979ea097554bb6347f252cad894ad4134e1fe839abc80eb48e2510061d5c6937e80374d32f95afd4cc8567b57694ac36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0db1d88802048ff847bfcf47035335bd

SHA1
bb54059e5b145da464f6521ae67353889ce00771

SHA256
416525d2bfeaeab0950175c0eab55ad35e84518ef5299f10565023800788cf9a

SHA512
32c5b42febdb38c3a30eb5179b8aa20a5e731b0e83aab16ec73d27b4108bfc89eb6316f71a988388cb5df19267ba823f6d0220fab5584667ba0adb0da1152a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
28KB

MD5
b955c12fe28c2e8c6fd26c816f88954d

SHA1
ef1c3aabe5a03d2684b55fe43a25706ec1d713d2

SHA256
bc79cb38069f1d2a6b05f350cc3fdefbb7e0d8764cc0c0ae822a74173031533b

SHA512
328bebd66d412aa6f6f9b42d54460c7849508bbf42472de8c26faa7c9c0c978ae58c8ce41890b95635fec2aa2950c9bef46c76c152f2a25bd15974cefccd4aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
05a44bb2081f76eaa391e470635146cd

SHA1
a413fe64dd714ba0874f5a91f28d163af50c3108

SHA256
a77c265a6a407a6cd3471375790849fed40c78f518cb7515c3e03fc415f1a4ef

SHA512
a926f4970eb01cc58e576ac93f5495cb0deb9a2f8c33af79642f6d8aeff1102e2aced07cdb84c38ffd22825a28d4af4824a710d977a7409b9fc331c7e8f51cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
8251fc87452e5da9900a82e259918431

SHA1
f3820c6b6cf2d1ce8703b464eb628336e86daa15

SHA256
91f801791044d2ea6315850c3749e5c7572507970b7e08ca1f45a4b7d98be505

SHA512
5ac7be8dfc5be0517c45ef415f69a11a7a9dac439b23d5f312d02178619222dfc08579c8d3e900df38a9f75da25c798d921bdfb70dcd7487011f3f13758f86e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
ea9194b7d364b3458b9234bd70b00264

SHA1
6b39f9d61add3110a9e3ddf1fdb7a671c3b2e4f7

SHA256
42b8547323bd0362b4247a8fcf338ef15aa82cad78cc58d0aba911e53dd25f78

SHA512
acfd9690348d83a08a7f4d5b5bf769bbab0c2db6569e93e757cc0dcf8adeaad1f00040e434c9d5200ff99c1c10ec3a571748b7bbf6fb1cab0036c8294c1a0c6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\212.102.63.147.zip

Filesize
436KB

MD5
16be152fb7b1a3d5183ce130626933e7

SHA1
5366be536b17d747d9ecd400cb0ad34b5b9e2310

SHA256
d74b5c66c7007ee15d3825f2f64071d77b44ca5865a9214c5635d4912d123248

SHA512
b89204eb9e5dd8afa512e4cb250f0cd25b0f5be7aa9e71b6e4fe2778449428b1ccee7c7d99db9900f4b14586b457c6fcdd714232a85d778a75ab2c192cd7a389

Download Submit
C:\Users\Admin\AppData\Local\Temp\212.102.63.147\Browsers\Firefox\FirefoxBookmarks.txt

Filesize
81B

MD5
ea511fc534efd031f852fcf490b76104

SHA1
573e5fa397bc953df5422abbeb1a52bf94f7cf00

SHA256
e5fe7f327ae62df007bd1117aa7f522dbbcd371ec67953f66d786424cb1d7995

SHA512
f7d8e575a2332b0fbd491b5e092b7ed6b0942a5165557fcc5d215d873b05103aa6ba01843133871c1c7ac81b10182a15895be49885c98d1a379dd55f88004fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\212.102.63.147\System\Process.txt

Filesize
4KB

MD5
e0b576d5f28f1cb8f596ae208d010c4b

SHA1
4c4464f783f2602dfe4ee6094ca3688f404307ef

SHA256
cc6f1a70b6013714afae8a484033a77b48090b93137e7f8e958176e01d661455

SHA512
155bad86ba1c9416994d3e2e9d1fd5b8c34851bcff47c38930ef32cfe46c6dc61eb492a70e62a2de3c6f5f5ed67b6de49a2fb302c2990eb771459e7331e06cff

Download Submit
memory/3608-410-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download
memory/3608-5-0x0000000006750000-0x0000000006C7C000-memory.dmp

Filesize
5.2MB

Download
memory/3608-258-0x0000000007A10000-0x0000000007A76000-memory.dmp

Filesize
408KB

Download
memory/3608-261-0x0000000007FB0000-0x0000000008042000-memory.dmp

Filesize
584KB

Download
memory/3608-394-0x0000000008700000-0x0000000008CA4000-memory.dmp

Filesize
5.6MB

Download
memory/3608-187-0x0000000007190000-0x00000000071B2000-memory.dmp

Filesize
136KB

Download
memory/3608-0-0x0000000000B00000-0x0000000001300000-memory.dmp

Filesize
8.0MB

Download
memory/3608-213-0x00000000071C0000-0x0000000007514000-memory.dmp

Filesize
3.3MB

Download
memory/3608-500-0x0000000007900000-0x0000000007920000-memory.dmp

Filesize
128KB

Download
memory/3608-501-0x0000000007C10000-0x0000000007C5C000-memory.dmp

Filesize
304KB

Download
memory/3608-4-0x0000000005A50000-0x0000000005C12000-memory.dmp

Filesize
1.8MB

Download
memory/3608-3-0x0000000005830000-0x0000000005842000-memory.dmp

Filesize
72KB

Download
memory/3608-2-0x0000000000B00000-0x0000000001300000-memory.dmp

Filesize
8.0MB

Download
memory/3608-1-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download