vidar | d28bc1b8975df8985c266826dc2111d6c50989fce391f72327171df965231166

Analysis

max time kernel
139s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
20/04/2025, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe
Size

556KB
MD5

d510396277a666720627f5df62bd53eb
SHA1

7acf176af54493aac227097b01a38242c069c28b
SHA256

d28bc1b8975df8985c266826dc2111d6c50989fce391f72327171df965231166
SHA512

e459a1212969aecd935bcf1182ad887b7cc5319ebf1b489ae9bc3a18e2855994de46ab7ff8a7d6f968ff844b8beac243bd3b4b2fd6a572bfc1ad0a689c960154
SSDEEP

12288:sgSCNzaLuvMRXdxQBXZqEvRXJQNf+9LKLdEEo4Edka+9LKLdEEo4Edk:sgvFaKQdEOaKLdjRaaKLdjR

Score

10^/10

vidar c466785b3a34d7b3c4d6db04a068b664 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.5

Botnet

c466785b3a34d7b3c4d6db04a068b664

https://t.me/v00rd

https://steamcommunity.com/profiles/76561199846773220

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 33 IoCs

stealer

resource	yara_rule
behavioral2/memory/3244-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-11-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-12-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-17-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-18-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-21-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-27-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-31-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-35-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-77-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-78-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-79-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-80-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-83-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-87-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-88-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-89-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-93-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-96-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-467-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-520-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-521-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-528-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-529-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-551-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-552-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-553-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-554-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-555-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3244-558-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5704	msedge.exe
2760	msedge.exe
2056	chrome.exe
5116	chrome.exe
4980	chrome.exe
5920	chrome.exe
2356	chrome.exe
6044	msedge.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5924	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133896326799038622"	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3244	MSBuild.exe
3244	MSBuild.exe
3244	MSBuild.exe
3244	MSBuild.exe
2056	chrome.exe
2056	chrome.exe
3244	MSBuild.exe
3244	MSBuild.exe
3244	MSBuild.exe
3244	MSBuild.exe
3244	MSBuild.exe
3244	MSBuild.exe
3244	MSBuild.exe
3244	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
6044	msedge.exe
6044	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe
Token: SeShutdownPrivilege	2056	chrome.exe
Token: SeCreatePagefilePrivilege	2056	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
2056	chrome.exe
6044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 2224 wrote to memory of 3244	2224	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	77
PID 3244 wrote to memory of 2056	3244	MSBuild.exe	78
PID 3244 wrote to memory of 2056	3244	MSBuild.exe	78
PID 2056 wrote to memory of 1968	2056	chrome.exe	79
PID 2056 wrote to memory of 1968	2056	chrome.exe	79
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 4956	2056	chrome.exe	80
PID 2056 wrote to memory of 5028	2056	chrome.exe	81
PID 2056 wrote to memory of 5028	2056	chrome.exe	81
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83
PID 2056 wrote to memory of 4992	2056	chrome.exe	83

C:\Users\Admin\AppData\Local\Temp\2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98055dcf8,0x7ff98055dd04,0x7ff98055dd10
      4⤵
      PID:1968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1916,i,1488440292930279141,16848488458686625713,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      PID:4956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1484,i,1488440292930279141,16848488458686625713,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=2124 /prefetch:11
      4⤵
      PID:5028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,1488440292930279141,16848488458686625713,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=2400 /prefetch:13
      4⤵
      PID:4992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,1488440292930279141,16848488458686625713,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2348,i,1488440292930279141,16848488458686625713,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4248,i,1488440292930279141,16848488458686625713,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=4272 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:5920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4628,i,1488440292930279141,16848488458686625713,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=4772 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5336,i,1488440292930279141,16848488458686625713,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:5672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5400,i,1488440292930279141,16848488458686625713,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ff9720df208,0x7ff9720df214,0x7ff9720df220
      4⤵
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1860,i,17805962748079629771,1267263823822401996,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
      4⤵
      PID:132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2060,i,17805962748079629771,1267263823822401996,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
      4⤵
      PID:804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1944,i,17805962748079629771,1267263823822401996,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3448,i,17805962748079629771,1267263823822401996,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3456,i,17805962748079629771,1267263823822401996,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\ycjw4" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2024
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5924

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ycjw4\8gdtrq

Filesize
288KB

MD5
1bbe6c3ed97ba3ba0d5f4c169e11434b

SHA1
ad83b42f5fd1150a1472bfa3ef29892e9f0c4cc8

SHA256
773805ecfe44a1838054f58021f10df20598451870e7a015afbc4eeb68d8e184

SHA512
0c53d7edf4248a46f32f1f92496a99b2c6e5b628a847e8bd90c83657090b8ca271b5bca0e2d9bced8ae0d5dd46af4a801f59381044b15b47a08f5640f4958e8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
7c058aa7e580b22421c5d339762e9294

SHA1
ac2caf3b34eebe9cee4619224cd647e22ab0c05f

SHA256
ba0ac5f8cf85c0a283c07e3aa58dc5abe7b8e240f44f5f233e6c76c01e6347ab

SHA512
ff52413cd938a451a5dd4c9640bcb6e6b2480d987e5d9017a2fd1d0b0ab724860a04137553b0e399cd72a2b5d7ddbd5925cd68ffcfc607291af2b6a6c9f52419

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
3e569a9f96f64fe451844b3dc4f92fb6

SHA1
e693370b55cc6f8acc2cffff872dc11128ce2f95

SHA256
b47c752e461a09ae53fb0df05bd28cf6d34240044c058c8e9c68255dcea32e24

SHA512
f469208b9348cd391b0a7c80a5af4ebacab6eb4b4f23eff053ceb8f7bc9dde03bdcb9e83ae66637af366fb3c94f42a460230c56a8b825dca8cf50b01ae31fadb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
e93f7a7e895750f95a2b42200b2f4406

SHA1
eb9edc7a2f5aff5ae1ef937ec351ae1adc59034f

SHA256
16af01493a8deae2d5884e7a0b4e4cf7f9b67a1c762e6479679500cda4ac928d

SHA512
de7167f6575862feec3e02150f1ac00ac9daed7528f3edb6dadb42266a27530ada41f7e2094ade3feb970ca8745e3c02a18e364c0e9ce04dee177472c1f5420a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0a5bce69-6114-48c4-b814-506a4a536c97\index-dir\the-real-index

Filesize
1KB

MD5
30c73396b8e9e4bbc4c42d816eb6e381

SHA1
e87558080f7116cccd0049483b1f41d3e6b2e247

SHA256
8910f1ac2c64f530d7a477a5b41f6bfec34e74615a0d6bf503bb2e060054db95

SHA512
b8b3f41e2c64398480ce18c4137d4afb583bb8bda2993fc958ed4a7c17bcfaa950e3437bdf1ef4d8947ecebc6833fa117cf10de274d1bef2255e40a51975d036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0a5bce69-6114-48c4-b814-506a4a536c97\index-dir\the-real-index~RFe5bd01e.TMP

Filesize
1KB

MD5
89dc90fc408661954bb75f7e3a05c737

SHA1
91b7e0545c2f370cad530b9007c2e0c00a71d39b

SHA256
42fd6656054645d3db1165c60d8fe117658b23661145f4da032cd904c7d3c08f

SHA512
d4c77e9ced19601d03da88830780303e0e4284b62ab23eedce50fada540f2bb95df77fc1c1b47168c3ca59485ca3e8491d1103d91cb8b185ed04492c57faed85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
7559770c82747292d16d118e4cba4ef2

SHA1
49b5b8ba1e8b69f5516dc47799f03463037b1307

SHA256
31985f0738199431f7b31f990d5d870a2e32eced8ebc05cbe5f8f463b8408a1a

SHA512
f2eed04d0f53c44f7fca1906d80582609a83a17283153af3e62e3d8b63e50d0bdca71a34a525b4193b684663cbf8e08e00b430f74ea0b72aa79eed2f3662b61d

Download Submit
memory/3244-83-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-78-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-79-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-80-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-87-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-88-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-93-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-96-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-467-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-520-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-521-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-528-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-529-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-551-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-552-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-553-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-554-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-555-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3244-558-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download