99a8e6ecf9bbea7d906e154d5fc699051645d5efc3c6319a2b45513f64589efc

Analysis

max time kernel
899s
max time network
719s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2025, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Welrast_64.exe
Size 2.7MB
Sample251007-yd535askz3
SHA256 123423017a860591694b92eaf14eb3b633d80899c00b0d34d525469e79e6c340
MD5 49853690ee7cbec3703fcd75b06d7ce3
SHA1 2d150763434a61c39634769e7563211e040fc0fe
SHA512 5b993c40965c2df9ffd5eccb0e4e3fea0a24e001775bb1ddfd0a62826f12166843f49200fb766787f17fca64253904cd901b4030137a8033da055cb8b3dada9d
SSDEEP 49152:oLGgjkiZrCiximtlVwcOSgEbTehBjHsYrNN2TF6wk8TAnXk/U:oHkiZrHTVw77yeffAPk8Sks
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\International\Geo\Nation	fdfbvd.exe

Executes dropped EXE 5 IoCs

pid	Process
2584	fdfbvd.exe
2804	advasv.exe
2552	dascsaCV.exe
2724	dzvsac.exe
4708	TimeManager.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Time Manager = "C:\\ProgramData\\TimeManager.exe"	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dzvsac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TimeManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Welrast_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdfbvd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	advasv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dascsaCV.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	advasv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	advasv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2552	dascsaCV.exe
2552	dascsaCV.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3408	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	dascsaCV.exe
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2584	2668	Welrast_64.exe	85
PID 2668 wrote to memory of 2584	2668	Welrast_64.exe	85
PID 2668 wrote to memory of 2584	2668	Welrast_64.exe	85
PID 2584 wrote to memory of 2804	2584	fdfbvd.exe	86
PID 2584 wrote to memory of 2804	2584	fdfbvd.exe	86
PID 2584 wrote to memory of 2804	2584	fdfbvd.exe	86
PID 2584 wrote to memory of 2552	2584	fdfbvd.exe	88
PID 2584 wrote to memory of 2552	2584	fdfbvd.exe	88
PID 2584 wrote to memory of 2552	2584	fdfbvd.exe	88
PID 2584 wrote to memory of 2724	2584	fdfbvd.exe	89
PID 2584 wrote to memory of 2724	2584	fdfbvd.exe	89
PID 2584 wrote to memory of 2724	2584	fdfbvd.exe	89
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 2552 wrote to memory of 3408	2552	dascsaCV.exe	56
PID 3408 wrote to memory of 448	3408	Explorer.EXE	90
PID 3408 wrote to memory of 448	3408	Explorer.EXE	90
PID 448 wrote to memory of 4708	448	cmd.exe	92
PID 448 wrote to memory of 4708	448	cmd.exe	92
PID 448 wrote to memory of 4708	448	cmd.exe	92

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Users\Admin\AppData\Local\Temp\Welrast_64.exe
  "C:\Users\Admin\AppData\Local\Temp\Welrast_64.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Roaming\fdfbvd.exe
    "C:\Users\Admin\AppData\Roaming\fdfbvd.exe" -s -ptdgndgmsratgg4hfsghsrfH
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Users\Admin\AppData\Roaming\advasv.exe
      "C:\Users\Admin\AppData\Roaming\advasv.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:2804
  - - C:\Users\Admin\AppData\Roaming\dascsaCV.exe
      "C:\Users\Admin\AppData\Roaming\dascsaCV.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2552
  - - C:\Users\Admin\AppData\Roaming\dzvsac.exe
      "C:\Users\Admin\AppData\Roaming\dzvsac.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\TimeManager.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\ProgramData\TimeManager.exe
    C:\ProgramData\TimeManager.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TimeManager.exe

Path C:\ProgramData\TimeManager.exe
Size 240KB
SHA256 7a71f9d7b7c062bf016f441f72e7f9a202ee8c2075b0f20a6e3bd93d4d329d67
MD5 fdd0087c2106e7aa72a5cbfdc88e6272
SHA1 b02d553382f81289617c0f334caf22911811f161
SHA512 6efbc27b3645fd567ea8d861768197c27d5f7834fa973aee397460113e1ce63f22d67b21f85b1f77ec114c503a28e9bdf4a11f55f9a6abf039f86cd9a1241387
SSDEEP 3072:HGtGMyegYZI4xoH3MnKEpmViQ1Tf3KLSfqouG:mEMy5hH3MHpLQwUqon
MD5 SHA1 SHA512 SSDEEP

Submit Download

advasv.exe

Path C:\Users\Admin\AppData\Roaming\advasv.exe
Size 48KB
SHA256 f02f97d5e28ba69e50ab74318890d6657382fc982ce2c77a4ef326bb20495aaf
MD5 7824383a3b8c6c18cb1e6e8758118513
SHA1 3cc1cee9ea8eaf65373148a016749724498c556a
SHA512 5fc7ab68166fa3fff3c7f4ab5f6bf354b5c475b7eb8bc554221d91a76388aee6417fe6035531eaad3575349e85abc5932841c6edec930ea47d35b890736bfa92
SSDEEP 768:SVHumLEiQILpaYQsyM+ylaPGLFhjo7dkaQU7W:SVOiEiQILLjKPQU7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

dascsaCV.exe

Path C:\Users\Admin\AppData\Roaming\dascsaCV.exe
Size 240KB
SHA256 e56fa8a40c953d96e66273be75ac51a8213c3057233b199b18d13dbd5f0fb7c1
MD5 fb00504fec16c83eb6db4649f3090507
SHA1 7104d9628a5620d8c298054cbddb57b76d6cb882
SHA512 ebb899017a1667ffbde30c5a957351092e022db2a0d10a0620fd08252c9c4da78d5603e4776f1b332040af08cc7a7c488829ce2d1ebe8b84d89e6945701ebd73
SSDEEP 3072:wGtGMyegYZI4xoH3MnKEpmViQ1Tf3KLSfqouG:3EMy5hH3MHpLQwUqon
MD5 SHA1 SHA512 SSDEEP

Submit Download

dzvsac.exe

Path C:\Users\Admin\AppData\Roaming\dzvsac.exe
Size 6.4MB
SHA256 0558952b7f3be72afaa7bddd8d94d432e1dcf0a690f336083e3801bc268b9866
MD5 63cbcf78ddc6011aad67938693058f68
SHA1 b81e37479268b4756e8eecc0679a84934c214cfd
SHA512 6040f2891f2830677366b8e7639dab0f9d302924994b2614197144df0e94559e7a2b20efc837428317a7d614872770d440c003362598ac1d4759d657bdbed181
SSDEEP 98304:9EY/ZL780myvACvMv0/++cBZmEqAVbBJFtRdyX3O:9EYBL7rmyvEN+l3AV7fWO
MD5 SHA1 SHA512 SSDEEP

Submit Download

fdfbvd.exe

Path C:\Users\Admin\AppData\Roaming\fdfbvd.exe
Size 2.8MB
SHA256 a533c1f2705efed579475faad2fd72eb3d40ce5ff653ff1588accf3fa450fcf2
MD5 3e1e601fddb3e1cfca88ab98cb974c94
SHA1 06b7d33475ac39f30ef0c2949ea9b1f2249cb061
SHA512 c34a6f761f58150e1144df97647111e820a4f51f39dbc2a8a7bd036b624dc0e2f3653b677af20bbe8e8ad261b252bb31fca12886e143d2ac6438ca8bdb5bfc6a
SSDEEP 49152:g5rAGgVkiXFKiVeExlV+oUG+UnJehzXHqYhN/SPJ8wcaFCnnwBP5:g5gkiXF/jV+fbKq9L+BcaEwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2552-35-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2552-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2552-33-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

memory/2804-66-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2804-102-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2804-68-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3408-32-0x00000000032B0000-0x00000000032CA000-memory.dmp

Download

memory/3408-62-0x00000000032B0000-0x00000000032CA000-memory.dmp

Download

memory/3408-64-0x00000000032B0000-0x00000000032CA000-memory.dmp

Download

memory/3408-63-0x00000000032B0000-0x00000000032CA000-memory.dmp

Download

memory/3408-56-0x0000000001270000-0x0000000001271000-memory.dmp

Download

memory/3408-67-0x00000000032B0000-0x00000000032CA000-memory.dmp

Download

memory/3408-50-0x00000000032B0000-0x00000000032CA000-memory.dmp

Download

memory/3408-36-0x00000000032B0000-0x00000000032CA000-memory.dmp

Download