deerstealer | cabf319baf5f3c955f6e251d101bdc61a1d7c3ced40e3f313c7d43f8571c00dd

Analysis

max time kernel
149s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
17/10/2025, 21:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload_2223.exe
Size 5.2MB
Sample251017-z91c7ae14c
SHA256 cabf319baf5f3c955f6e251d101bdc61a1d7c3ced40e3f313c7d43f8571c00dd
MD5 fefd3627416d34ab1f1aef77720fdfe0
SHA1 6de469e68db986fc78aca190bcacbdeeb77d1cc9
SHA512 ad59df0cd791bf329fdb6bde850e4d3b0a03b6c838355daced5731f557ed62859f3208de0a448299fb6d9891a878fd07562473577086ceec911aa85cabae8660
SSDEEP 98304:qnfhrIIZAI7CX+02W79/J6cRT+G/OXBkNnmuFndHWmZL8POjhPJ+yXMR:qnfhrTZfGXh9/JXRT/OxkoWrZA8P9U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery deerstealer donutloader hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\EBJWriter
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Signatures

DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
stealer deerstealer
Deerstealer family
deerstealer

Detects DeerStealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/5536-46-0x00007FF731AE0000-0x00007FF731DF3000-memory.dmp	family_deerstealer
behavioral2/memory/5536-50-0x00007FF731AE0000-0x00007FF731DF3000-memory.dmp	family_deerstealer
behavioral2/memory/5536-51-0x00007FF731AE0000-0x00007FF731DF3000-memory.dmp	family_deerstealer
behavioral2/memory/5536-82-0x00007FF731AE0000-0x00007FF731DF3000-memory.dmp	family_deerstealer

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5536-127-0x00007FF731AE0000-0x00007FF731DF3000-memory.dmp	family_donutloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b2e3-17.dat	family_hijackloader

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader

Executes dropped EXE 3 IoCs

pid	Process
1568	payload_2223.tmp
5640	Matri_Debug29.exe
1808	Matri_Debug29.exe

Loads dropped DLL 3 IoCs

pid	Process
5640	Matri_Debug29.exe
1808	Matri_Debug29.exe
5536	XenoAnaly.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 5536	1808	Matri_Debug29.exe	82

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Matri_Debug29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Matri_Debug29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	payload_2223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	payload_2223.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5640	Matri_Debug29.exe
1808	Matri_Debug29.exe
1808	Matri_Debug29.exe
1808	Matri_Debug29.exe
1808	Matri_Debug29.exe
5536	XenoAnaly.exe
5536	XenoAnaly.exe
1440	chrome.exe
1440	chrome.exe
5536	XenoAnaly.exe
5536	XenoAnaly.exe
5536	XenoAnaly.exe
5536	XenoAnaly.exe
5536	XenoAnaly.exe
5536	XenoAnaly.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1808	Matri_Debug29.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe
Token: SeShutdownPrivilege	1440	chrome.exe
Token: SeCreatePagefilePrivilege	1440	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe
1440	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 136 wrote to memory of 1568	136	payload_2223.exe	79
PID 136 wrote to memory of 1568	136	payload_2223.exe	79
PID 136 wrote to memory of 1568	136	payload_2223.exe	79
PID 1568 wrote to memory of 5640	1568	payload_2223.tmp	80
PID 1568 wrote to memory of 5640	1568	payload_2223.tmp	80
PID 1568 wrote to memory of 5640	1568	payload_2223.tmp	80
PID 5640 wrote to memory of 1808	5640	Matri_Debug29.exe	81
PID 5640 wrote to memory of 1808	5640	Matri_Debug29.exe	81
PID 5640 wrote to memory of 1808	5640	Matri_Debug29.exe	81
PID 1808 wrote to memory of 5536	1808	Matri_Debug29.exe	82
PID 1808 wrote to memory of 5536	1808	Matri_Debug29.exe	82
PID 1808 wrote to memory of 5536	1808	Matri_Debug29.exe	82
PID 1808 wrote to memory of 5536	1808	Matri_Debug29.exe	82
PID 5536 wrote to memory of 1440	5536	XenoAnaly.exe	83
PID 5536 wrote to memory of 1440	5536	XenoAnaly.exe	83
PID 1440 wrote to memory of 3720	1440	chrome.exe	84
PID 1440 wrote to memory of 3720	1440	chrome.exe	84
PID 1440 wrote to memory of 4408	1440	chrome.exe	85
PID 1440 wrote to memory of 4408	1440	chrome.exe	85
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 3728	1440	chrome.exe	86
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87
PID 1440 wrote to memory of 5008	1440	chrome.exe	87

C:\Users\Admin\AppData\Local\Temp\payload_2223.exe
"C:\Users\Admin\AppData\Local\Temp\payload_2223.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:136
- C:\Users\Admin\AppData\Local\Temp\is-QMOL6.tmp\payload_2223.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QMOL6.tmp\payload_2223.tmp" /SL5="$E022A,4445496,882176,C:\Users\Admin\AppData\Local\Temp\payload_2223.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Users\Admin\AppData\Local\Temp\is-LHJBM.tmp\Matri_Debug29.exe
    "C:\Users\Admin\AppData\Local\Temp\is-LHJBM.tmp\Matri_Debug29.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5640
  - - C:\ProgramData\EBJWriter\Matri_Debug29.exe
      C:\ProgramData\EBJWriter\Matri_Debug29.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\XenoAnaly.exe
        
        C:\Users\Admin\AppData\Local\Temp\XenoAnaly.exe
        5⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5536
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98d03dcf8,0x7ff98d03dd04,0x7ff98d03dd10
        7⤵
        
        PID:3720
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1980,i,5891046167296078590,11560364765520266804,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2100 /prefetch:11
        7⤵
        
        PID:4408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2072,i,5891046167296078590,11560364765520266804,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2068 /prefetch:2
        7⤵
        
        PID:3728
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2372,i,5891046167296078590,11560364765520266804,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2536 /prefetch:13
        7⤵
        
        PID:5008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3236,i,5891046167296078590,11560364765520266804,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3300 /prefetch:1
        7⤵
        
        PID:1928
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3244,i,5891046167296078590,11560364765520266804,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3324 /prefetch:1
        7⤵
        
        PID:2344
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4184,i,5891046167296078590,11560364765520266804,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4216 /prefetch:9
        7⤵
        
        PID:3368
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4624,i,5891046167296078590,11560364765520266804,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4676 /prefetch:1
        7⤵
        
        PID:1972
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,5891046167296078590,11560364765520266804,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5444 /prefetch:14
        7⤵
        
        PID:5692
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5436,i,5891046167296078590,11560364765520266804,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5492 /prefetch:14
        7⤵
        
        PID:4500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5460,i,5891046167296078590,11560364765520266804,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5540 /prefetch:14
        7⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Roaming\EBJWriter\XPFix.exe
        
        "C:\Users\Admin\AppData\Roaming\EBJWriter\XPFix.exe" "C:\Users\Admin\AppData\Roaming\EBJWriter\XPFix.exe" /u
        5⤵
        
        PID:3564

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4980

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d777a00c36de0dc7fdc4cf3aaebd540c8269fec8ffb8d9be60dddda73e040283
MD5 a911f987b22dd618ccb7f63e78634925
SHA1 c2f6609ab8d20c386550e82a9341abb8008ac1e9
SHA512 b804c2d73d95b16569cc7bae33442343479b8ee0de6473796feea3d7e4169939a4274f4ee5fda53f2f4ab68f63ecb217073c7a856c37acd32325c8c889e14959
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 0e979937d69c019ac8831abfce69b6e5ba5b16abf7c4daf168350965809da531
MD5 84ed4ea2074de9e9a365f4f3e334a08c
SHA1 2ab4012c23abf8824c1b1fdf7c84ce3165879159
SHA512 62441034bdf55f4cfaef9229e5b5807a6b6204307df4d78e4878a76236e52aff5a60f19ba07819ef5d6cd342b9a35bf23718e3815ee7aa0f699fa2b91f1e58f1
SSDEEP 192:+YfWXH+iDKaAjZ8PRpI9eHS+WN4JcZDrEeSpQyIsnA/g4:+YOXHGCXIcc5D2Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 889e6379fcdaf4bad44a036a3f41ab118f63253b8ea5af590e6a584f7f01d371
MD5 0a6b3d254b9c7867e021632adea569fe
SHA1 db49e7a4b54de592202755e65be0b88112d07b18
SHA512 9dc2913c8f558ea433730916716470c6479bbe0bb535b9940092ec6f7b811dba9f2d41c2232231d01f305391de3846d24b6edd148bbaf678b429ba0df2128794
SSDEEP 384:w0RS7pLuLco94dX6fPkXqKf/pUZNCgVLH2Hf1sFrUA/HGqwC9OSR:wIS7pLuLhqZ6fPkXqKf/pUZNCgVLH2Hy
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 93cc5e3b7e9ac53dd261eb4186474c770d56a0cae403b9ef772af609410572d5
MD5 d8bb2bf16f3003806e4082ae1446f523
SHA1 304c3d966e53e92e5868558b0583d08940da47a6
SHA512 e78f5a2465f8b8ca6346bb19685e717a265555cfd12156b3d7643ae55e0edb6bc1ff60d565d4fcabea78577f413c5807affa00c23b3c3b172f78997c173b6fc9
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe61a40f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe61a40f.TMP
Size 48B
SHA256 bdf2a2d5987fa360378d98d0703e1bfc1bc8528fe63496b59fe391655012abde
MD5 3f1852be4ed17e4fdde22f30508713cf
SHA1 2a6bd29a26d262b521b0ce6d5b43017e9aad8ee3
SHA512 52484e2341fcce7dd30550ed49abe92c0dc7260bb983c249946c08c3930d3b0526419b08b7e874a7ae2cfb764fe1cd2dde647789fd00be99c1e5e26a6319c9ea
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 cc8992978805918405ca5a7f6d0da867c66e3f1f1958c1e73d49c8bfe5e99628
MD5 ad7ad89e370af28cf833a4203211b81c
SHA1 a55be974ccb02d42eea8c87eb08faa45ad0100b8
SHA512 e8ed7e6587a911145e62d53e784ea42578459167549cebcf219f111dea022d06b8a80ecabdc07b8f4a47538c791155325cd9c995e1cbfdf8b7c12ce40a90f935
SSDEEP 3072:5XGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT2:5WMExki2KL64sbWRtHqldg+G/M2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 1641cb5ece20955f1e6603fec22f99f5d76854602fc82cb4b2a04f14aecbe8e9
MD5 bdc54b484e6e583595a3620849cd133d
SHA1 9f90bd2518546f6fa6dc0735e54d99680c829024
SHA512 6dcf16512f27fde115d0839eda03b9ce5e8d7acb8ac6c60c56d8404fa98311adb0267240991f6324f21f6f851f90c197f56f46cd3d2acf71845bd9bf3fd004f7
SSDEEP 3072:aXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cTP:aWMExki2KL64sbWRtHqldg+G/MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 336ffaa582ec883848c30a4a68ed6e829913fb3872daf0e0d69ba905a6ce301a
MD5 f48448be6d8be9cd8cd48d1952a2e2a9
SHA1 d65b0cb032357cdacebc9463021dd3b661eae28b
SHA512 e4db21d28ddb2660f0e1f2401f24481a1359770a471a8c40856b1b47e26b49eedd43a7743b7a90fbd759da72817e7085fb420358dcc65d269710726977224e7d
SSDEEP 3072:uXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT2:uWMExki2KL64sbWRtHqldg+G/M2
MD5 SHA1 SHA512 SSDEEP

Submit Download

11ED9BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\11ED9BA.tmp
Size 3.8MB
SHA256 6ed7cf2fe2d8ccad4e7a5a62a98935f7373d362fc15c5380eed9f15362dc303d
MD5 fc20c100a7d4920c87e221b71694d79c
SHA1 9e96ecdb6ccdda776831137bcc065357e3470b7b
SHA512 e695b7c827d4c6d48324b663584f8ad993573ab6f908f7582aa161fbd0677e67d75c13153743d3492a8c2fbf196252f6cc03fecd26aaa74b904fe3d18c1c5a93
SSDEEP 98304:ZrPsJhVEXx1+wGFZd0JapJ7u3KrisFiZqSkAhC6JX+xJb:tPiVtLFZuJapQ3KrhYkSvw6szb
MD5 SHA1 SHA512 SSDEEP

Submit Download

55B63B.tmp

Path C:\Users\Admin\AppData\Local\Temp\55B63B.tmp
Size 40B
SHA256 0314559f876514e3c8ab967931267870dd4f79e9b50b88757675db94fc371b34
MD5 72f8a694b94074080ddde610f6229645
SHA1 ce911ea6628be78fd4ecb8bc9849c43746d4c46b
SHA512 1827c763d253ec0e84b893a54d4d868e1fa4f5d67f636e3358f61cdc19e9e21005ed1de876d31b22979fb510921aa148a50807f09fe0adbba5eab4a732d0e8c5
MD5 SHA1 SHA512

Submit Download

XenoAnaly.exe

Path C:\Users\Admin\AppData\Local\Temp\XenoAnaly.exe
Size 625KB
SHA256 5c4444234b06090033f2dd507c0b86d59472e7bbccb7675339a10e22fc7a1eff
MD5 cb15886b318e4e670a2fc9e79dff39a6
SHA1 a11cfdc99ac0f7bde01dae0457769dba9dc66ecc
SHA512 517512feba9c70e0ee98ae71982f5bb0bd443d9a3f9dc4bf6ab342c836b62d98efd964e38e55361b4c58ae32ca7911358ddb4e23400a293f7811725f89c55411
SSDEEP 12288:VZapVtoiL7wjlGfQ22yMXy0P09FTgb05f582o8gFYfo:VZaVttUjiG2TJ58L8bA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Grous.xs

Path C:\Users\Admin\AppData\Local\Temp\is-LHJBM.tmp\Grous.xs
Size 3.4MB
SHA256 fd2dbe411d137505f344a7cd6dbe87c543e13a162a1b352054d727707cff4a0f
MD5 7c30b2d9af5d803fad99deb86d00e8d5
SHA1 c20fbf027d4e53f9b2e5c38ba09a9cc8df6d5b4b
SHA512 9fce14296598f66cfe0494794df6e77ea28b073950e6360dbfb72cf31c39ec96df9180b49568e2071267f131ad8865de1611b6c467dce405c80227a738df0017
SSDEEP 49152:lTEUAOR5JAhGNGDdwgtfuCMrjvLjEcZ613uyXYjvM8eVLh9G1Wc2A1HwonnmAKeH:TlgerrXEcZM+yXYah9lwHwonoOFnD
MD5 SHA1 SHA512 SSDEEP

Submit Download

LMIGuardianDll.dll

Path C:\Users\Admin\AppData\Local\Temp\is-LHJBM.tmp\LMIGuardianDll.dll
Size 1.8MB
SHA256 afb7031f3ee67b956dd31e429734f832ee02296950518cf406db6c6c849b878b
MD5 faa595a1df46ef97da7cde53d09e3261
SHA1 7f4d0fe824c0feb3d64e90fa8877e7ec635dd3f6
SHA512 4bb74b7fe85ffe932689be57c103b091eedfe9af8de474a977bb3ff555b1887ec59d8aff5102e11282afb62f0f2f8fe25084dc878c07158f0f0276f55459ab37
SSDEEP 12288:ZjT8+tB00WZgCMAapoUDBk8S3bagPBZyndsvWTruSjtpmEKmn3D+SH6JlxAj:ZjTNZcokbagSTruSjtpX+SaJXAj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Matri_Debug29.exe

Path C:\Users\Admin\AppData\Local\Temp\is-LHJBM.tmp\Matri_Debug29.exe
Size 395KB
SHA256 26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d
MD5 93a4e2b886e2815b6b732a2380b0f068
SHA1 5cbfa13b74917aabbfb4d714c53afb1ac20b10e6
SHA512 230cedc2543d05ac39693cf79d0a2e571f06c198f32a70449b9f36d76202debc53373864ec34cb95cc94d26a54803224a615535fa4826c81e4e519c64fdd1904
SSDEEP 3072:MbtPTcKt1PbrCA4/dYbXurcxA84/LFtZdBsct:IdTz8h/Btu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Studfraer.dqy

Path C:\Users\Admin\AppData\Local\Temp\is-LHJBM.tmp\Studfraer.dqy
Size 23KB
SHA256 3c2e9d57f2483adfe1251b3e4fcc31bbd98e04612fe6e0e47d5480c23ab1e0c3
MD5 58bbbc0a608a8bb079da4c8129e2d71c
SHA1 7554792e4ffd46f1692c28cfa4d126d19c553513
SHA512 e553f7e21a07787fb867df305e140887dc6583e63a0b65d4cca0918cff951110d6bf8960dbdd9ddf7aef34c9bd2fab60dcf242eb849bb8d16407695da61b6b33
SSDEEP 384:qUfUlbBEfucJtpnhZLob2BycLR6DIfRRuM2taP4gbSwWAMrvaIWZMbG7lP:qUfUlumSpnh62BbRwQRoYPTewWTLa/ZX
MD5 SHA1 SHA512 SSDEEP

Submit Download

payload_2223.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QMOL6.tmp\payload_2223.tmp
Size 3.5MB
SHA256 34443e18d987170a4d837e5dcc94a28c543d6416e4df93b1431bc069ba546995
MD5 befa8de8083e21fb34b310aa102595f5
SHA1 86883cb2bca307d39ee341ec0d54cc34bc80a95d
SHA512 dc836759bf206572d736f85725d49b3dd25f4134f054e7bb49780e8b4e5688f8f395cb97eb9b16d487f646cbaa77034a0797706a95f992cc2b60fc1d58d195a5
SSDEEP 49152:s/TEMS7OtZsSllCqph5ZsR8yp1QTKV9affqR2QKBLk333Trn:s/Ttyq5ZDyp1hV9MfGKBLk333TT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/136-0-0x0000000000060000-0x0000000000147000-memory.dmp

Download

memory/136-31-0x0000000000060000-0x0000000000147000-memory.dmp

Download

memory/1568-5-0x00000000029E0000-0x00000000029E1000-memory.dmp

Download

memory/1568-30-0x0000000000390000-0x000000000071F000-memory.dmp

Download

memory/1808-43-0x0000000074320000-0x000000007449D000-memory.dmp

Download

memory/1808-33-0x0000000074320000-0x000000007449D000-memory.dmp

Download

memory/1808-44-0x0000000074320000-0x000000007449D000-memory.dmp

Download

memory/1808-34-0x00007FF99C480000-0x00007FF99C689000-memory.dmp

Download

memory/1808-41-0x0000000074320000-0x000000007449D000-memory.dmp

Download

memory/1808-38-0x0000000074320000-0x000000007449D000-memory.dmp

Download

memory/1808-37-0x0000000074335000-0x0000000074336000-memory.dmp

Download

memory/5536-46-0x00007FF731AE0000-0x00007FF731DF3000-memory.dmp

Download

memory/5536-82-0x00007FF731AE0000-0x00007FF731DF3000-memory.dmp

Download

memory/5536-127-0x00007FF731AE0000-0x00007FF731DF3000-memory.dmp

Download

memory/5536-51-0x00007FF731AE0000-0x00007FF731DF3000-memory.dmp

Download

memory/5536-50-0x00007FF731AE0000-0x00007FF731DF3000-memory.dmp

Download

memory/5640-19-0x00007FF99C480000-0x00007FF99C689000-memory.dmp

Download

memory/5640-18-0x00000000742D0000-0x000000007444D000-memory.dmp

Download