vidar | bcba841ec1c29c8febe31bd52a06da1bbd88faa7aafca3c88aed068d83e07783

Analysis

max time kernel
139s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2025, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe
Size

1.3MB
MD5

e9a4da7003603ce1d5045a8c7b44611d
SHA1

5b51f43b8d16dea516abc5cf3231042a10ecf09c
SHA256

bcba841ec1c29c8febe31bd52a06da1bbd88faa7aafca3c88aed068d83e07783
SHA512

026432c88637fa22e2a1bb723d90249d1803e9f01f31d61bbd023198bdfe2304e279a954c07fbc92977f59453ab612a41630111845416f23ed4075fc7157e70f
SSDEEP

24576:pXfINFPFU9z/46aw5vHZnWHItRf4fYRE7BHlcADadfj/EIS6CwvhYt4zju+p0juY:pXfINtFU9z/46aw5vHZnWHItRf4Qy7BR

Score

10^/10

vidar 05384aad30607e06c3d580d2ad87a31d credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.4

Botnet

05384aad30607e06c3d580d2ad87a31d

https://t.me/f07nd

https://steamcommunity.com/profiles/76561199843252735

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 34 IoCs

stealer

resource	yara_rule
behavioral1/memory/876-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-9-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-10-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-15-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-16-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-19-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-23-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-24-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-29-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-33-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-76-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-77-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-78-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-79-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-82-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-86-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-87-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-91-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-92-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-94-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-372-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-429-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-432-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-435-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-436-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-437-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-438-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-439-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-440-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-441-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/876-444-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1500	chrome.exe
5900	chrome.exe
4844	chrome.exe
4236	msedge.exe
4756	msedge.exe
6132	msedge.exe
392	chrome.exe
5812	chrome.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 864 set thread context of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
976	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133893884622871521"	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
876	MSBuild.exe
876	MSBuild.exe
876	MSBuild.exe
876	MSBuild.exe
392	chrome.exe
392	chrome.exe
876	MSBuild.exe
876	MSBuild.exe
876	MSBuild.exe
876	MSBuild.exe
876	MSBuild.exe
876	MSBuild.exe
876	MSBuild.exe
876	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	392	chrome.exe
Token: SeCreatePagefilePrivilege	392	chrome.exe
Token: SeShutdownPrivilege	392	chrome.exe
Token: SeCreatePagefilePrivilege	392	chrome.exe
Token: SeShutdownPrivilege	392	chrome.exe
Token: SeCreatePagefilePrivilege	392	chrome.exe
Token: SeShutdownPrivilege	392	chrome.exe
Token: SeCreatePagefilePrivilege	392	chrome.exe
Token: SeShutdownPrivilege	392	chrome.exe
Token: SeCreatePagefilePrivilege	392	chrome.exe
Token: SeShutdownPrivilege	392	chrome.exe
Token: SeCreatePagefilePrivilege	392	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
392	chrome.exe
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 864 wrote to memory of 876	864	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 876 wrote to memory of 392	876	MSBuild.exe	97
PID 876 wrote to memory of 392	876	MSBuild.exe	97
PID 392 wrote to memory of 4872	392	chrome.exe	98
PID 392 wrote to memory of 4872	392	chrome.exe	98
PID 392 wrote to memory of 4368	392	chrome.exe	99
PID 392 wrote to memory of 4368	392	chrome.exe	99
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 5332	392	chrome.exe	100
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101
PID 392 wrote to memory of 868	392	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc63ecdcf8,0x7ffc63ecdd04,0x7ffc63ecdd10
      4⤵
      PID:4872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1892,i,237552352192181046,62014446860510769,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2028 /prefetch:3
      4⤵
      PID:4368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1980,i,237552352192181046,62014446860510769,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1976 /prefetch:2
      4⤵
      PID:5332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2396,i,237552352192181046,62014446860510769,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2540 /prefetch:8
      4⤵
      PID:868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3244,i,237552352192181046,62014446860510769,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,237552352192181046,62014446860510769,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4284,i,237552352192181046,62014446860510769,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4304 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1500
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4676,i,237552352192181046,62014446860510769,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4700 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4788,i,237552352192181046,62014446860510769,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5316 /prefetch:8
      4⤵
      PID:5468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5504,i,237552352192181046,62014446860510769,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5528 /prefetch:8
      4⤵
      PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x210,0x2f4,0x7ffc63eaf208,0x7ffc63eaf214,0x7ffc63eaf220
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1932,i,3154856046615329063,17660462669117068889,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2116,i,3154856046615329063,17660462669117068889,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2576,i,3154856046615329063,17660462669117068889,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3496,i,3154856046615329063,17660462669117068889,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,3154856046615329063,17660462669117068889,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4756
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\riekx" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2016
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:976

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
414B

MD5
2168af42001e1b3887c09e8c41d80763

SHA1
1d4d5c2702bfd78abf242a90a1cf0afb036693c3

SHA256
9922370de49f652f14f73a463afc7a6f5f9d4fbf0335267c51443fe660380c5f

SHA512
aa9bd5b3253be459c25ed2950a93273790b3cb85e090736690bdf49edc96be3064ff9ff7edba3914f3172094c46f510d2151de2abeae868532fbf4d8fa05ce9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
a6adeeee753bc111719af2bbfd3df68a

SHA1
ec3b1dcf2255a156bbd9b27fd3c2e23693a95228

SHA256
10967052d0124d19c33b09e320e5e91685099d704f66f86cfbbaaa90f2754447

SHA512
7de4ef9a8bfcbc3705cb75990b2ad0ab11f89e95f523e3ede1cdc787028fde7893caeb364cf3ae7f546b05fa39981f9f9654d55f21e728a2738a84614ffb63ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
325B

MD5
9a4eeb453a024dd9bcb8c980a6843b32

SHA1
8e0c16ceff8924b40fe91eb2d0277ea6633b5944

SHA256
d21575efb95c5ef2bac91399d04b669221239e4bcc00caeaf29e1163b49c5a33

SHA512
c378c9db3eef47cd3923657e23b6765c266748309dca36d765d14921834189884df6aca066f3acdaeb6918a96869df59705622e61c2a1d4fbf467164689f3b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
01ad5b3424d716b1dc9787700d208896

SHA1
7d4308074b5c6917d9440792d897223e1e7f20a2

SHA256
852546a8c53efcb9d23b026fde1eb47d28942aa0d8e09800916fc4d3b60005a3

SHA512
ccf84fff4ba905aecd85b3bfb186b4416e119e99266d8373b79d90bbcbd6c77a80b49917c1a03ef09e14bfa3d57a8f90ccea87dd28d7daef9f0544eca452a88a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
038a201484bfcfe1f3b3b83e08ec8981

SHA1
8c61f5653d7ef7d40bc622a93320757a5d6d90fd

SHA256
a69a075593e04d0ff401a4d56f2243bee7f6bda6a8e6038c7a32f059cf72f38e

SHA512
1ec9798c6140c266e0e3ef1e209c76846c0aaa450c3178f90e32dc68ce2bbeee3ddf285ef7ab538760d115a0a6b5d15cc68da8b40c75bebd86e3267f21bd6db8

Download Submit
memory/876-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-94-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-78-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-79-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-82-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-86-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-87-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-92-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-372-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-429-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-432-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-435-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-436-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-437-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-438-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-439-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-440-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-441-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/876-444-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download