vidar | 3ceea626c1796347ccdf784ca0477992c39248d5f83851649e50d72df135becb

Analysis

max time kernel
105s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2025, 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-21_f673ead8ea61be7cd25a6bc11aa8f921_cobalt-strike_hijackloader.exe
Size

1.3MB
MD5

f673ead8ea61be7cd25a6bc11aa8f921
SHA1

d7cae6301dfc7e6a3049653f6d6e3b3cbbb52ca7
SHA256

3ceea626c1796347ccdf784ca0477992c39248d5f83851649e50d72df135becb
SHA512

5cf93bf8b9d91059f0e9b172c85cb5b4f2d1baac1ea83b354eac3400b414f8575c5a14e6332ff7736c00da0cfe81983c71b78189dda7d51bac1b93f982325484
SSDEEP

24576:MSoc97WbdaoDJ0ialHJ1hs+aeOWwjQ6VgL9pXW+hJdK1JNm:Ac97UN161hs+aaqgL9pGkJdK1JY

Score

10^/10

vidar 7a48c83a230d8076280af316c6d72f8f credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.5

Botnet

7a48c83a230d8076280af316c6d72f8f

https://t.me/v00rd

https://steamcommunity.com/profiles/76561199846773220

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 36 IoCs

stealer

resource	yara_rule
behavioral1/memory/4552-4-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-5-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-6-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-13-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-14-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-19-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-20-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-23-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-27-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-28-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-29-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-33-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-36-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-74-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-75-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-76-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-77-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-80-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-84-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-85-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-86-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-90-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-93-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-481-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-511-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-514-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-516-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-517-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-520-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-521-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-522-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-523-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-527-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-528-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-529-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7
behavioral1/memory/4552-532-0x00000000010D0000-0x00000000010F9000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
448	msedge.exe
2940	msedge.exe
4164	msedge.exe
4720	chrome.exe
5672	chrome.exe
5044	chrome.exe
3152	chrome.exe
5836	chrome.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 4552	3040	2025-04-21_f673ead8ea61be7cd25a6bc11aa8f921_cobalt-strike_hijackloader.exe	94

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4804	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133896858182758653"	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4552	explorer.exe
4552	explorer.exe
4552	explorer.exe
4552	explorer.exe
4720	chrome.exe
4720	chrome.exe
4552	explorer.exe
4552	explorer.exe
4552	explorer.exe
4552	explorer.exe
4552	explorer.exe
4552	explorer.exe
4552	explorer.exe
4552	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
448	msedge.exe
448	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 4552	3040	2025-04-21_f673ead8ea61be7cd25a6bc11aa8f921_cobalt-strike_hijackloader.exe	94
PID 3040 wrote to memory of 4552	3040	2025-04-21_f673ead8ea61be7cd25a6bc11aa8f921_cobalt-strike_hijackloader.exe	94
PID 3040 wrote to memory of 4552	3040	2025-04-21_f673ead8ea61be7cd25a6bc11aa8f921_cobalt-strike_hijackloader.exe	94
PID 3040 wrote to memory of 4552	3040	2025-04-21_f673ead8ea61be7cd25a6bc11aa8f921_cobalt-strike_hijackloader.exe	94
PID 3040 wrote to memory of 4552	3040	2025-04-21_f673ead8ea61be7cd25a6bc11aa8f921_cobalt-strike_hijackloader.exe	94
PID 4552 wrote to memory of 4720	4552	explorer.exe	95
PID 4552 wrote to memory of 4720	4552	explorer.exe	95
PID 4720 wrote to memory of 4836	4720	chrome.exe	96
PID 4720 wrote to memory of 4836	4720	chrome.exe	96
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4224	4720	chrome.exe	97
PID 4720 wrote to memory of 4960	4720	chrome.exe	98
PID 4720 wrote to memory of 4960	4720	chrome.exe	98
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99
PID 4720 wrote to memory of 6140	4720	chrome.exe	99

C:\Users\Admin\AppData\Local\Temp\2025-04-21_f673ead8ea61be7cd25a6bc11aa8f921_cobalt-strike_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-21_f673ead8ea61be7cd25a6bc11aa8f921_cobalt-strike_hijackloader.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffe58fedcf8,0x7ffe58fedd04,0x7ffe58fedd10
      4⤵
      PID:4836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2032,i,5216038721612330652,11207723278756025947,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2020 /prefetch:2
      4⤵
      PID:4224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2268,i,5216038721612330652,11207723278756025947,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      PID:4960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2380,i,5216038721612330652,11207723278756025947,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2416 /prefetch:8
      4⤵
      PID:6140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3260,i,5216038721612330652,11207723278756025947,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3272,i,5216038721612330652,11207723278756025947,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4308,i,5216038721612330652,11207723278756025947,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4328 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:3152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4648,i,5216038721612330652,11207723278756025947,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5324,i,5216038721612330652,11207723278756025947,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5332 /prefetch:8
      4⤵
      PID:3428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5376,i,5216038721612330652,11207723278756025947,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5392 /prefetch:8
      4⤵
      PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffe58fcf208,0x7ffe58fcf214,0x7ffe58fcf220
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1820,i,12541742840717165654,15923224572865861109,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:3
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2944,i,12541742840717165654,15923224572865861109,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:2
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2428,i,12541742840717165654,15923224572865861109,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:8
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3556,i,12541742840717165654,15923224572865861109,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3580,i,12541742840717165654,15923224572865861109,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\vasr9" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5064
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4804

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
6fd8a2a6d69f07409fc719e2fa306681

SHA1
5f1bfcfbcbeecf266a8f2b33657e7d648252ed44

SHA256
880275ff7b2c0f397e3525ec6f1b14eee91f010cdd4c08419e54874a37d31b75

SHA512
c94b2eecad7d9b4788cb7d3363a7df44e810713526907677a78ebf667f0f421011fd4211ed89c45d11a9743069adf6b28a95e95c86e6e6f83098a9440a173b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
df2d1721cd4e4eff7049314710dc7c11

SHA1
f5aed0158b2c0a00302f743841188881d811637a

SHA256
ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93

SHA512
11fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
30080ce3776fb49bd1c129810989de73

SHA1
c37194b0d3531d35978c5493b7ed30b543c7d671

SHA256
3951f52684a59b049374774aa44768c8f6ba638662fccb13f891875173883f3b

SHA512
eea4b62b2fd1958c7f8c2786d9f0a44fe9813f8e6a102bd7be032ca96e47acded30fa1440ba6c41e44eb5bf5a9deb667fb5dfa457c7fcc0493a40b38dabdac7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
b843e93548c101e7183272f5571e5ddd

SHA1
fd03301c18a14eb358a1ce5fde26d2d5a809709d

SHA256
debb5e00cd880882c5669fcdfbae90696c59f48f1df2213bb6860a5d6f3e9754

SHA512
7195dfafd7dff8563ed2de30395123fdac6e8e8ca47013e27efee2efd0f4cf3a7d2f9dfb43aa240b2e25f0ba89b6dcd9e281013479608a8472341c764fd323e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
477804790b777dded9a09444824f508b

SHA1
c3ac0460d70868c62b8da125536949c703a4a1c4

SHA256
96fef13435f61f2bcc222ee81d27ba6285cb34bb7d192efb1fcedccc27d391c5

SHA512
a26fcbbbdeafbfce773bec25c2d2609157abe9a063ce59387f6569098e28e316e694011070875bdcbd2c97210c9cf65013b608a9d83f36f0a497b99caa085ee5

Download Submit
memory/4552-85-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-93-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-29-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-33-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-36-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-27-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-23-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-20-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-74-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-75-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-76-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-77-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-80-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-84-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-4-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-86-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-90-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-28-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-19-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-14-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-13-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-6-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-5-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-481-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-511-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-514-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-516-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-517-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-520-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-521-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-522-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-523-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-527-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-528-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-529-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download
memory/4552-532-0x00000000010D0000-0x00000000010F9000-memory.dmp

Filesize
164KB

Download