stormkitty | 319d78b1aa7153267c5d2a6ecee8d7d02f489c9e8678742b410dd38931c8fea5

Analysis

max time kernel
102s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2025, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe
Size

6.0MB
MD5

e2e81ef1300b970259e1339287d3125c
SHA1

c8e9f2366df39a7c07621be96a477a3c4debab74
SHA256

319d78b1aa7153267c5d2a6ecee8d7d02f489c9e8678742b410dd38931c8fea5
SHA512

85f68096cb8048c26557733c663f8667478b2d7b8b79f30f9f4bb007b0995fdd09f0c426981526b1dfe05b487c526cef58e310e45e4fde79ac99723e4e99f0fd
SSDEEP

98304:H0zim6BOOUPsZPF27j37dl+adKRF7xzl+qAmXEUydxjGyrrdkXu/SvFJu:UziJO3k5F27j37dsacR/zl+qIU21v1k6

Score

10^/10

stormkitty collection credential_access discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b105-27.dat	family_stormkitty
behavioral2/memory/4624-37-0x0000000000460000-0x00000000004A4000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3880	chrome.exe
864	chrome.exe
2064	chrome.exe
4184	chrome.exe
4688	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
5904	oldu busefer.exe
4624	tmp2q7q9by_.exe

Loads dropped DLL 4 IoCs

pid	Process
5904	oldu busefer.exe
5904	oldu busefer.exe
5904	oldu busefer.exe
5904	oldu busefer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tmp2q7q9by_.exe
Key opened	\REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tmp2q7q9by_.exe
Key opened	\REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tmp2q7q9by_.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
2	ipinfo.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2q7q9by_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4824	cmd.exe
4896	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	tmp2q7q9by_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	tmp2q7q9by_.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
4624	tmp2q7q9by_.exe
864	chrome.exe
864	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
864	chrome.exe
864	chrome.exe
864	chrome.exe
864	chrome.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	tmp2q7q9by_.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe
Token: SeShutdownPrivilege	864	chrome.exe
Token: SeCreatePagefilePrivilege	864	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
864	chrome.exe
864	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 5904	2160	2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe	79
PID 2160 wrote to memory of 5904	2160	2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe	79
PID 5904 wrote to memory of 2440	5904	oldu busefer.exe	80
PID 5904 wrote to memory of 2440	5904	oldu busefer.exe	80
PID 2440 wrote to memory of 4624	2440	cmd.exe	81
PID 2440 wrote to memory of 4624	2440	cmd.exe	81
PID 2440 wrote to memory of 4624	2440	cmd.exe	81
PID 4624 wrote to memory of 4824	4624	tmp2q7q9by_.exe	82
PID 4624 wrote to memory of 4824	4624	tmp2q7q9by_.exe	82
PID 4624 wrote to memory of 4824	4624	tmp2q7q9by_.exe	82
PID 4824 wrote to memory of 5072	4824	cmd.exe	85
PID 4824 wrote to memory of 5072	4824	cmd.exe	85
PID 4824 wrote to memory of 5072	4824	cmd.exe	85
PID 4824 wrote to memory of 4896	4824	cmd.exe	86
PID 4824 wrote to memory of 4896	4824	cmd.exe	86
PID 4824 wrote to memory of 4896	4824	cmd.exe	86
PID 4824 wrote to memory of 4900	4824	cmd.exe	87
PID 4824 wrote to memory of 4900	4824	cmd.exe	87
PID 4824 wrote to memory of 4900	4824	cmd.exe	87
PID 4624 wrote to memory of 2416	4624	tmp2q7q9by_.exe	88
PID 4624 wrote to memory of 2416	4624	tmp2q7q9by_.exe	88
PID 4624 wrote to memory of 2416	4624	tmp2q7q9by_.exe	88
PID 2416 wrote to memory of 2252	2416	cmd.exe	90
PID 2416 wrote to memory of 2252	2416	cmd.exe	90
PID 2416 wrote to memory of 2252	2416	cmd.exe	90
PID 2416 wrote to memory of 1108	2416	cmd.exe	91
PID 2416 wrote to memory of 1108	2416	cmd.exe	91
PID 2416 wrote to memory of 1108	2416	cmd.exe	91
PID 4624 wrote to memory of 864	4624	tmp2q7q9by_.exe	92
PID 4624 wrote to memory of 864	4624	tmp2q7q9by_.exe	92
PID 864 wrote to memory of 1004	864	chrome.exe	93
PID 864 wrote to memory of 1004	864	chrome.exe	93
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 5228	864	chrome.exe	94
PID 864 wrote to memory of 2924	864	chrome.exe	95
PID 864 wrote to memory of 2924	864	chrome.exe	95

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tmp2q7q9by_.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tmp2q7q9by_.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\onefile_2160_133894180383236588\oldu busefer.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp2q7q9by_.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\tmp2q7q9by_.exe
      C:\Users\Admin\AppData\Local\Temp\tmp2q7q9by_.exe
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:4624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4824
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4896
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2416
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:864
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff9af3dcf8,0x7fff9af3dd04,0x7fff9af3dd10
        6⤵
        
        PID:1004
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1984,i,12384026994927527382,16053069239849500253,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=1972 /prefetch:2
        6⤵
        
        PID:5228
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1508,i,12384026994927527382,16053069239849500253,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2264 /prefetch:11
        6⤵
        
        PID:2924
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,12384026994927527382,16053069239849500253,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2492 /prefetch:13
        6⤵
        
        PID:5136
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3204,i,12384026994927527382,16053069239849500253,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3216 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4688
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,12384026994927527382,16053069239849500253,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2744 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2064
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4288,i,12384026994927527382,16053069239849500253,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4308 /prefetch:9
        6⤵
        Uses browser remote debugging
        
        PID:4184
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4716,i,12384026994927527382,16053069239849500253,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4700 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3880

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
f52f8e6e8ecdecf8fb0a06e5723eb76a

SHA1
920957f4d655d3b54e23821ec02e05b2f20d626a

SHA256
90d6236b78a2d58475f0b8d871345897f17ae474bb82d8c719979c86d8357668

SHA512
27425f7016497103472bbee72aad6119bef4a810d5349f70bd29b7cff54139528548caf646441a19f7aa5610f5faa2aec077ce647eb96aeef1c58d5e2d4db453

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.43\Browsers\Firefox\FirefoxBookmarks.txt

Filesize
81B

MD5
ea511fc534efd031f852fcf490b76104

SHA1
573e5fa397bc953df5422abbeb1a52bf94f7cf00

SHA256
e5fe7f327ae62df007bd1117aa7f522dbbcd371ec67953f66d786424cb1d7995

SHA512
f7d8e575a2332b0fbd491b5e092b7ed6b0942a5165557fcc5d215d873b05103aa6ba01843133871c1c7ac81b10182a15895be49885c98d1a379dd55f88004fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.43\System\Process.txt

Filesize
4KB

MD5
65328eec8d046bbe3743c95a2bb9f021

SHA1
62c9fc1ce96878abb743a59bf38fb645928dc956

SHA256
ddd49148ffac4930d2f2df9f4f4019531898ab5e8b5876690e4a94e4bd7e88dd

SHA512
2a56ba63a4a181729b87f67fe788b754423925c10b6ac44a2b93621a3b2dde5ec7082e4f6701aa6cfdc6fe4e1badc88a3e26d2d76c00aa418aacb57078e90b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2160_133894180383236588\_bz2.pyd

Filesize
83KB

MD5
223fd6748cae86e8c2d5618085c768ac

SHA1
dcb589f2265728fe97156814cbe6ff3303cd05d3

SHA256
f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb

SHA512
9c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2160_133894180383236588\_lzma.pyd

Filesize
156KB

MD5
05e8b2c429aff98b3ae6adc842fb56a3

SHA1
834ddbced68db4fe17c283ab63b2faa2e4163824

SHA256
a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c

SHA512
badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2160_133894180383236588\oldu busefer.exe

Filesize
6.1MB

MD5
a254c77d5f97c4c35b91dcdd01a70904

SHA1
3a5a89db5020acf2533b1181dd078d90b36e2645

SHA256
92b50eb6ba29e19ce8854d2be8cc8d3283a112d6327abbd771438071538c06b9

SHA512
5f1c17d8e634bd4ebd1c1dead6c3d5af70996b76da06846478ad5961173cff65a14389ddd74e59aadbc9221f9f89d440cbd4eb8b25ad7526253e74ffa638efb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2160_133894180383236588\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2160_133894180383236588\vcruntime140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2q7q9by_.exe

Filesize
245KB

MD5
e6b880d080ab45ef1067a4dbef6c4464

SHA1
375054ec68252e90c57754d26ff40c4662eb01df

SHA256
c1168aaa187fa545c492d1e85f059db8b5ded7c2b1e88f8a2959987e4134843d

SHA512
1d48d9f8faa1af31d278b382ec5cec4e44d1061f22fbe277ae17eafd74aa9986d39410c76354ad5a4fa19931143d38337f8056eea477bb12cd32b49c8356f323

Download Submit
memory/4624-40-0x0000000005FE0000-0x000000000650C000-memory.dmp

Filesize
5.2MB

Download
memory/4624-43-0x0000000006B40000-0x0000000006BD2000-memory.dmp

Filesize
584KB

Download
memory/4624-42-0x0000000006690000-0x00000000066F6000-memory.dmp

Filesize
408KB

Download
memory/4624-125-0x0000000007590000-0x0000000007B36000-memory.dmp

Filesize
5.6MB

Download
memory/4624-36-0x000000007504E000-0x000000007504F000-memory.dmp

Filesize
4KB

Download
memory/4624-41-0x0000000005BD0000-0x0000000005BE2000-memory.dmp

Filesize
72KB

Download
memory/4624-37-0x0000000000460000-0x00000000004A4000-memory.dmp

Filesize
272KB

Download
memory/4624-39-0x0000000075040000-0x00000000757F1000-memory.dmp

Filesize
7.7MB

Download
memory/4624-38-0x00000000050A0000-0x0000000005262000-memory.dmp

Filesize
1.8MB

Download
memory/4624-226-0x000000007504E000-0x000000007504F000-memory.dmp

Filesize
4KB

Download
memory/4624-227-0x0000000075040000-0x00000000757F1000-memory.dmp

Filesize
7.7MB

Download
memory/4624-246-0x0000000075040000-0x00000000757F1000-memory.dmp

Filesize
7.7MB

Download