vidar | 8a51d26be760d2515fdbe742bc84bd08d05d4e7f665bdd3c37b8c425f839675e

Analysis

max time kernel
141s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2025, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

573KB
MD5

017e837d6e14a2412d5b7b385f8bca28
SHA1

3596a371841ec6cad17cdbfcde4425d980cb69e5
SHA256

8a51d26be760d2515fdbe742bc84bd08d05d4e7f665bdd3c37b8c425f839675e
SHA512

3aa9e36006182f8e640d8efb84fb505d8449c0d7feea0a803c5e7b283a11603ced81b076016acd15aedb15b0a1f060b7c76ebc53063c8fe9f54be925bf79c855
SSDEEP

12288:5ONjf6etLUrXh2ceG+9LKLdEEo4Edka+9LKLdEEo4Edk:5mfZxMaKLdjRaaKLdjR

Score

10^/10

vidar c466785b3a34d7b3c4d6db04a068b664 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.5

Botnet

c466785b3a34d7b3c4d6db04a068b664

https://t.me/v00rd

https://steamcommunity.com/profiles/76561199846773220

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 36 IoCs

stealer

resource	yara_rule
behavioral1/memory/6056-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-9-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-10-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-15-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-16-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-19-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-23-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-24-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-29-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-33-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-75-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-76-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-77-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-78-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-81-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-85-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-86-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-90-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-91-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-104-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-420-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-485-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-488-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-490-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-491-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-494-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-495-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-500-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-501-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-502-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-503-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-504-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/6056-507-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5708	chrome.exe
772	chrome.exe
2792	chrome.exe
5140	msedge.exe
3136	msedge.exe
1656	msedge.exe
4964	chrome.exe
5648	chrome.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3976 set thread context of 6056	3976	file.exe	90

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4296	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133894534312848750"	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6056	MSBuild.exe
6056	MSBuild.exe
6056	MSBuild.exe
6056	MSBuild.exe
4964	chrome.exe
4964	chrome.exe
6056	MSBuild.exe
6056	MSBuild.exe
6056	MSBuild.exe
6056	MSBuild.exe
6056	MSBuild.exe
6056	MSBuild.exe
6056	MSBuild.exe
6056	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
5140	msedge.exe
5140	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
5140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 3976 wrote to memory of 6056	3976	file.exe	90
PID 6056 wrote to memory of 4964	6056	MSBuild.exe	96
PID 6056 wrote to memory of 4964	6056	MSBuild.exe	96
PID 4964 wrote to memory of 4732	4964	chrome.exe	97
PID 4964 wrote to memory of 4732	4964	chrome.exe	97
PID 4964 wrote to memory of 2284	4964	chrome.exe	98
PID 4964 wrote to memory of 2284	4964	chrome.exe	98
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 2224	4964	chrome.exe	99
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100
PID 4964 wrote to memory of 3692	4964	chrome.exe	100

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffda307dcf8,0x7ffda307dd04,0x7ffda307dd10
      4⤵
      PID:4732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1548,i,6567706106312273749,12584440212508004249,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2172 /prefetch:3
      4⤵
      PID:2284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2072,i,6567706106312273749,12584440212508004249,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2068 /prefetch:2
      4⤵
      PID:2224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2396,i,6567706106312273749,12584440212508004249,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2556 /prefetch:8
      4⤵
      PID:3692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,6567706106312273749,12584440212508004249,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,6567706106312273749,12584440212508004249,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4288,i,6567706106312273749,12584440212508004249,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4332 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4648,i,6567706106312273749,12584440212508004249,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4720 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5380,i,6567706106312273749,12584440212508004249,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5392 /prefetch:8
      4⤵
      PID:896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5500,i,6567706106312273749,12584440212508004249,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5520 /prefetch:8
      4⤵
      PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ffda21af208,0x7ffda21af214,0x7ffda21af220
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1960,i,9220632733844662076,18102685789716962423,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2224,i,9220632733844662076,18102685789716962423,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1876,i,9220632733844662076,18102685789716962423,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:8
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3568,i,9220632733844662076,18102685789716962423,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3564,i,9220632733844662076,18102685789716962423,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1656
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\sjecj" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1664
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4296

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\sjecj\fkfusj

Filesize
288KB

MD5
3495d973dd04c335a8b2510f5bb64893

SHA1
4d8518a3b98a1e6261758fd6390a801fb5d817cd

SHA256
77f280a1c0097ce6caa48a78a344c07b6a06362b7973869e62b04615700c992f

SHA512
4a7e48be612baec1c938e2449ebcc498fdd6492933a53a39201410ad8153ad814d4a9496d3ceabb9f384fc4d8c7b358523ec3bf3ac972ae239a1d6501b470bab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
a37a9d4ac21b57377e96ce6f72d227f1

SHA1
99cb0c87ef66e9bd233ec20fc249c404afc94290

SHA256
ed51a3ef5f632c181df8d7d8af1bffc74441cca4fe4d4b0081e039d2c586d7f5

SHA512
06c4b63c33d0d4eca825ccd80adace4794cd9577b5612c0b5fcddd7b6624443c45ba90384319e3bf569bab10659041f5e90304bb074e9455cb8d02633bea4d8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
8b826a38a1ce4dbad16f134067bbfb71

SHA1
14b39d6b33a18e3a0ce4a413901258d76d3ad11d

SHA256
8e89c83df60df38341115a3389d2a1f739e65cd6b047b2592f376ff632d72ae5

SHA512
fd54adac23f39de5182c36cf49b818b2669590fa5148681356bdf89d192df38e8ed840fc9f99453128c9548ae9154239470453b6fa2a5782e95e8f98e4b79dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cf3da7267cb6a35a74a4dceb3097a615

SHA1
a1b06c52d03147a6adbad9d32436b3b497115584

SHA256
18a6d652dd17544c9feb2e01621ed64b958b1a26bcee81e29ab29d5a409dc222

SHA512
6238eb406a42dfdf3faf7b62c92c6c0993974617f2ff403f6cd0a23dd2d53893bd96e92e78bbe6ba35ff191cdbcb8ecd69318c76547df76341ce9f2d43aae71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8eb518b8-0d69-4be0-8146-80caaac45029\index-dir\the-real-index

Filesize
1KB

MD5
c2b38f206241c21eaf6e7703efa48253

SHA1
acca008d95bbf9f720dea6c3ce47601baa4aee60

SHA256
1936160b639029518f4308818e23314f00b00b0e541404ecf9e1d34bc611b6f4

SHA512
271ea10e31e07b396bef4cd1f3580101cdf69bfb7347756cc3fe9d513a81f058c41f5f3200cd230a238b9083f2ac38e8e1961db008dddbc5837bf8e1d90b6261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8eb518b8-0d69-4be0-8146-80caaac45029\index-dir\the-real-index~RFe57eeb5.TMP

Filesize
1KB

MD5
853924e017848163a18b2678cb6b285f

SHA1
6542d03c337fdb74153519b60fbe2471301ccef5

SHA256
2c4b0820586b6b2cc55c0d10f235676d5b60cbada0d5862ee5e5a6add1e8d809

SHA512
d7333055e978581e95166be929c1f41449cf0abfdebf02b4c232ac86e94a1ba90c5d3e0ed7971ab32449ef2932c216f7b18b1cdb13ad36c233ccbe4992a25872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
ebdee7c6ba3f166017512b28d25c75df

SHA1
d6f8dc84fc595d39c7723266e08599f22e2c649c

SHA256
14b15dd1d6ada825c936b466d8619ffd5501901189e5b0d402dbac12a74616a7

SHA512
12e913e2981e3f11067d815d6a29623760668084606954292f71fcaab7505052c0b59dae5125e20fa11c217749ac00aa15fb9d99ee0ee0e5c1410788102e3c48

Download Submit
memory/6056-85-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-104-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-75-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-78-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-81-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-86-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-420-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-485-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-488-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-490-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-491-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-494-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-495-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-500-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-501-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-502-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-503-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-504-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6056-507-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download