vidar | bcba841ec1c29c8febe31bd52a06da1bbd88faa7aafca3c88aed068d83e07783

Analysis

max time kernel
138s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
17/04/2025, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe
Size

1.3MB
MD5

e9a4da7003603ce1d5045a8c7b44611d
SHA1

5b51f43b8d16dea516abc5cf3231042a10ecf09c
SHA256

bcba841ec1c29c8febe31bd52a06da1bbd88faa7aafca3c88aed068d83e07783
SHA512

026432c88637fa22e2a1bb723d90249d1803e9f01f31d61bbd023198bdfe2304e279a954c07fbc92977f59453ab612a41630111845416f23ed4075fc7157e70f
SSDEEP

24576:pXfINFPFU9z/46aw5vHZnWHItRf4fYRE7BHlcADadfj/EIS6CwvhYt4zju+p0juY:pXfINtFU9z/46aw5vHZnWHItRf4Qy7BR

Score

10^/10

vidar 05384aad30607e06c3d580d2ad87a31d credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.4

Botnet

05384aad30607e06c3d580d2ad87a31d

https://t.me/f07nd

https://steamcommunity.com/profiles/76561199843252735

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 35 IoCs

stealer

resource	yara_rule
behavioral2/memory/2660-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-11-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-12-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-17-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-18-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-21-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-26-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-27-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-31-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-35-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-77-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-78-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-79-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-80-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-83-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-87-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-88-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-92-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-93-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-96-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-465-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-522-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-527-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-530-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-531-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-533-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-534-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-541-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-543-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-544-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-545-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2660-548-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5928	chrome.exe
4428	msedge.exe
5304	msedge.exe
2928	msedge.exe
6060	chrome.exe
3376	chrome.exe
4860	chrome.exe
5540	chrome.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1364 set thread context of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5388	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133893884620377871"	chrome.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2660	MSBuild.exe
2660	MSBuild.exe
2660	MSBuild.exe
2660	MSBuild.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
2660	MSBuild.exe
2660	MSBuild.exe
2660	MSBuild.exe
2660	MSBuild.exe
2660	MSBuild.exe
2660	MSBuild.exe
2660	MSBuild.exe
2660	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6060	chrome.exe
Token: SeCreatePagefilePrivilege	6060	chrome.exe
Token: SeShutdownPrivilege	6060	chrome.exe
Token: SeCreatePagefilePrivilege	6060	chrome.exe
Token: SeShutdownPrivilege	6060	chrome.exe
Token: SeCreatePagefilePrivilege	6060	chrome.exe
Token: SeShutdownPrivilege	6060	chrome.exe
Token: SeCreatePagefilePrivilege	6060	chrome.exe
Token: SeShutdownPrivilege	6060	chrome.exe
Token: SeCreatePagefilePrivilege	6060	chrome.exe
Token: SeShutdownPrivilege	6060	chrome.exe
Token: SeCreatePagefilePrivilege	6060	chrome.exe
Token: SeShutdownPrivilege	6060	chrome.exe
Token: SeCreatePagefilePrivilege	6060	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
6060	chrome.exe
4428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 1364 wrote to memory of 2660	1364	2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe	78
PID 2660 wrote to memory of 6060	2660	MSBuild.exe	79
PID 2660 wrote to memory of 6060	2660	MSBuild.exe	79
PID 6060 wrote to memory of 4452	6060	chrome.exe	80
PID 6060 wrote to memory of 4452	6060	chrome.exe	80
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 4864	6060	chrome.exe	81
PID 6060 wrote to memory of 5052	6060	chrome.exe	82
PID 6060 wrote to memory of 5052	6060	chrome.exe	82
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83
PID 6060 wrote to memory of 4328	6060	chrome.exe	83

C:\Users\Admin\AppData\Local\Temp\2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-17_e9a4da7003603ce1d5045a8c7b44611d_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff735edcf8,0x7fff735edd04,0x7fff735edd10
      4⤵
      PID:4452
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1972,i,4708058952920608657,3567233548481250132,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=1968 /prefetch:2
      4⤵
      PID:4864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2068,i,4708058952920608657,3567233548481250132,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2248 /prefetch:11
      4⤵
      PID:5052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2380,i,4708058952920608657,3567233548481250132,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2496 /prefetch:13
      4⤵
      PID:4328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,4708058952920608657,3567233548481250132,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,4708058952920608657,3567233548481250132,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4252,i,4708058952920608657,3567233548481250132,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4268 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4780,i,4708058952920608657,3567233548481250132,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5288,i,4708058952920608657,3567233548481250132,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:2208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5484,i,4708058952920608657,3567233548481250132,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7fff6214f208,0x7fff6214f214,0x7fff6214f220
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2340,i,13391623926395438404,7977426714648475008,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1876,i,13391623926395438404,7977426714648475008,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2380,i,13391623926395438404,7977426714648475008,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,13391623926395438404,7977426714648475008,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,13391623926395438404,7977426714648475008,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5304
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\t2dt0" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2308
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5388

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:6064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\t2dt0\zmoh4o

Filesize
288KB

MD5
23ae7b89bfdc1198e09a953e9b49dbce

SHA1
3f6d5b7cf402471ed7a540ddb4db281924447c04

SHA256
6c5340a69a891b6fa83a8becc4883bdb9591dc451e7b6ffeb7adf80d6d1acc0d

SHA512
9b36375ed3862513b9ec4ee748f90bf507e6c3ba9dac691003b3e66d70ce665bc4997c84afc755d3e3791551f0d5907f43a92fcb930e77a67da6bedf6d5e505a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0cf13dc8-f5ab-4760-ba23-87711b29ac38.tmp

Filesize
78KB

MD5
98249d9757c7629ce9b857965e3ebb34

SHA1
79eb4c25175e71159d858282932430a8427b82df

SHA256
fada6968b7c722ede1de63996662a1464386c487b7dc4ac91c6e47674809bf44

SHA512
923e2ba47af6b335f401bea138ce37e61688f234b16ed963e0ee2219997023de07bbc44327ea9c03d973a220f70b0a935bda0708bd63338dee271477913966d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
414B

MD5
5e508d066b5584b7420b477feec92734

SHA1
b3b241d1a74eab0078155a138d10968985e1c177

SHA256
be92feec2cceb89b41adc6c43c4019662719ebb26b74c00d24ea35c7a2e65d74

SHA512
f4a9da39478fac75af7b300cba54cebe28d521bca3fa68a879517e8ba9f576a5fd244feb4a0476cd9a05af2c7dee57b7951477d6e9c7ea9c1b5d0faefe3f2cbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
1781354d27507643c155a786707c38a7

SHA1
2640329f5fa81556f623a621d593cf34ac7c4aec

SHA256
53facdb807aa83e6148a7c9aa06da7783307ee5012b638eb05210554f85cde80

SHA512
abfe8088d4714d74d0011578f8964a74c7d79362cb5b54e1742ac5b0b5cfae4d108d8a11843121bcb4d96f3c693c02a7c02164edf5157f21e51355e23721c37c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aa76037d-2c25-4bd5-9f81-89e3f85aefc7\index-dir\the-real-index

Filesize
1KB

MD5
91ee81b9f03f8e445b8edc252203997b

SHA1
c2443b5f68f3908a44ad878f95533828013eb095

SHA256
4934f6075a207e1735fdf9da1c7a98584438e3cd707eed5ac0fc5a0c8792fff5

SHA512
e0a66b6de1126bc1b6bee07abc74de1c173d2efbf457093d87518462768bfa801f3d118df5f0857ed545502ae028a7ddddf025f28ba377f57360f239ab9e2333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aa76037d-2c25-4bd5-9f81-89e3f85aefc7\index-dir\the-real-index~RFe57cdb0.TMP

Filesize
1KB

MD5
866aa621fd0f39bcf00fe6f823c7e0bb

SHA1
b765cf5e0883d13d2ad72feb77f2f2f994d78b4d

SHA256
3b17ee346d3d212a34852eada6b7ab763abefe0f5b29173939cbd02c243388fa

SHA512
048be219f0288de896f0082d476ebef5ac3ce7db72f24541ede2da5a08396ee5874d3cac1ceeeaf89648ea31c5c215444f836dbd0dfd1c76eb28b18c8407e906

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
a9f7e2204d11ab11d1f82ee7cf34b7c7

SHA1
46fd172bbdcc9a89794f3b068942103aedd85001

SHA256
a1df53a72c781b93b1290526ed334d505a2f5fc7af4bfc0f77b6de1dfd9b0b10

SHA512
33d86c74ccf0ff490e7208e4741df3e4d1275338531d5927b15c1db14b66c39b9af52616316d3a82b584007596445b357c1287787c51aae1c2f1ca36dcdbbdf1

Download Submit
memory/2660-87-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-96-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-78-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-79-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-80-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-83-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-88-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-92-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-93-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-465-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-522-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-527-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-530-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-531-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-533-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-534-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-541-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-543-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-544-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-545-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-548-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download