salatstealer | 35fcd9a92974ed0a8866eebef90a00780afc1f6ecc70dec50c1e06eae047526a

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
18/11/2025, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.8MB
Sample251118-tpblfawrds
SHA256 35fcd9a92974ed0a8866eebef90a00780afc1f6ecc70dec50c1e06eae047526a
MD5 1f3bf9342581be8a14c6b4cea6470d63
SHA1 d3bfb3998db260c9dca7f4e0dfbd185ef71fbb1c
SHA512 4c4f4cc95a43a39640788e600e66c006cdaab916fefb1a72d05aa062928e089f76176ca180e0ac0ea9f2cd6238cc9b9cae9eff0a6008f63c18d1b6be073c053a
SSDEEP 98304:eVb0FB32VdUw9SMsuEnwHx+Nd3JTIgTXLeU7:Wb0FB3am8DsHwHSPc6p7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Detect SalatStealer payload 17 IoCs

resource	yara_rule
behavioral2/memory/6008-151-0x00000000004D0000-0x000000000105B000-memory.dmp	family_salatstealer
behavioral2/memory/3504-172-0x0000000000310000-0x0000000000E9B000-memory.dmp	family_salatstealer
behavioral2/memory/1624-183-0x00000000008D0000-0x000000000145B000-memory.dmp	family_salatstealer
behavioral2/memory/844-210-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-213-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-219-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-221-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-223-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-225-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-228-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-233-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-235-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-237-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-239-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-241-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-243-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer
behavioral2/memory/844-247-0x00000000001C0000-0x0000000000D4B000-memory.dmp	family_salatstealer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdSearch.exe"	p2_3947.exe

Salatstealer family
salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	1636	powershell.exe
20	1636	powershell.exe
21	1636	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 12 IoCs

pid	Process
3528	loader_tmp_7972.exe
5832	p1_6317.exe
3996	p2_3947.exe
3932	xdwdSearch.exe
3640	xdwdSearcher.exe
6008	p3_4734.exe
844	csrss.exe
3504	csrss.exe
1624	csrss.exe
4820	xdwdSearch.exe
1244	xdwdSearch.exe
4336	xdwdSearch.exe

Loads dropped DLL 10 IoCs

pid	Process
2340	Process not Found
5008	Process not Found
3932	xdwdSearch.exe
3640	xdwdSearcher.exe
4560	Process not Found
2832	elevation_service.exe
1212	elevation_service.exe
4820	xdwdSearch.exe
1244	xdwdSearch.exe
4336	xdwdSearch.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1816	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
15	raw.githubusercontent.com

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b344-135.dat	upx
behavioral2/memory/6008-137-0x00000000004D0000-0x000000000105B000-memory.dmp	upx
behavioral2/memory/844-149-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/6008-151-0x00000000004D0000-0x000000000105B000-memory.dmp	upx
behavioral2/memory/3504-158-0x0000000000310000-0x0000000000E9B000-memory.dmp	upx
behavioral2/memory/3504-172-0x0000000000310000-0x0000000000E9B000-memory.dmp	upx
behavioral2/memory/1624-179-0x00000000008D0000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/1624-183-0x00000000008D0000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/844-210-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-213-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-219-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-221-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-223-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-225-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-228-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-233-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-235-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-237-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-239-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-241-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-243-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx
behavioral2/memory/844-247-0x00000000001C0000-0x0000000000D4B000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\csrss.exe	csrss.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe	csrss.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\xdwdSearcher.exe	p2_3947.exe
File created	C:\Windows\xdwd.dll	p2_3947.exe
File opened for modification	C:\Windows\xdwdSearcher.exe	p2_3947.exe
File opened for modification	C:\Windows\xdwd.dll	p2_3947.exe
File opened for modification	C:\Windows\xdwdSearcher.exe	xdwdSearch.exe
File opened for modification	C:\Windows\xdwdSearcher.exe	xdwdSearcher.exe
File opened for modification	C:\Windows\xdwdSearcher.exe	xdwdSearch.exe
File opened for modification	C:\Windows\xdwdSearcher.exe	xdwdSearch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	p3_4734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	p2_3947.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6124	schtasks.exe
4740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1816	powershell.exe
1816	powershell.exe
6008	p3_4734.exe
6008	p3_4734.exe
6008	p3_4734.exe
6008	p3_4734.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
3504	csrss.exe
3504	csrss.exe
2832	elevation_service.exe
2832	elevation_service.exe
1636	powershell.exe
1636	powershell.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
1624	csrss.exe
1624	csrss.exe
1212	elevation_service.exe
1212	elevation_service.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe
844	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
844	csrss.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	3996	p2_3947.exe
Token: SeDebugPrivilege	3932	xdwdSearch.exe
Token: SeDebugPrivilege	3640	xdwdSearcher.exe
Token: SeIncBasePriorityPrivilege	3932	xdwdSearch.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	4820	xdwdSearch.exe
Token: SeDebugPrivilege	1244	xdwdSearch.exe
Token: SeDebugPrivilege	4336	xdwdSearch.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3528	4580	file.exe	79
PID 4580 wrote to memory of 3528	4580	file.exe	79
PID 3528 wrote to memory of 5832	3528	loader_tmp_7972.exe	80
PID 3528 wrote to memory of 5832	3528	loader_tmp_7972.exe	80
PID 5832 wrote to memory of 1816	5832	p1_6317.exe	81
PID 5832 wrote to memory of 1816	5832	p1_6317.exe	81
PID 3528 wrote to memory of 3996	3528	loader_tmp_7972.exe	83
PID 3528 wrote to memory of 3996	3528	loader_tmp_7972.exe	83
PID 3996 wrote to memory of 2396	3996	p2_3947.exe	86
PID 3996 wrote to memory of 2396	3996	p2_3947.exe	86
PID 3996 wrote to memory of 2264	3996	p2_3947.exe	88
PID 3996 wrote to memory of 2264	3996	p2_3947.exe	88
PID 2264 wrote to memory of 6124	2264	cmd.exe	90
PID 2264 wrote to memory of 6124	2264	cmd.exe	90
PID 3996 wrote to memory of 3836	3996	p2_3947.exe	91
PID 3996 wrote to memory of 3836	3996	p2_3947.exe	91
PID 3836 wrote to memory of 4740	3836	cmd.exe	93
PID 3836 wrote to memory of 4740	3836	cmd.exe	93
PID 3528 wrote to memory of 6008	3528	loader_tmp_7972.exe	98
PID 3528 wrote to memory of 6008	3528	loader_tmp_7972.exe	98
PID 3528 wrote to memory of 6008	3528	loader_tmp_7972.exe	98
PID 6008 wrote to memory of 844	6008	p3_4734.exe	99
PID 6008 wrote to memory of 844	6008	p3_4734.exe	99
PID 6008 wrote to memory of 844	6008	p3_4734.exe	99
PID 844 wrote to memory of 1636	844	csrss.exe	100
PID 844 wrote to memory of 1636	844	csrss.exe	100
PID 844 wrote to memory of 1636	844	csrss.exe	100
PID 844 wrote to memory of 3504	844	csrss.exe	102
PID 844 wrote to memory of 3504	844	csrss.exe	102
PID 844 wrote to memory of 3504	844	csrss.exe	102
PID 844 wrote to memory of 1624	844	csrss.exe	104
PID 844 wrote to memory of 1624	844	csrss.exe	104
PID 844 wrote to memory of 1624	844	csrss.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\loader_tmp_7972.exe
  "C:\Users\Admin\AppData\Local\Temp\loader_tmp_7972.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Users\Admin\AppData\Local\Temp\p1_6317.exe
    C:\Users\Admin\AppData\Local\Temp\p1_6317.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -Command "Set-MpPreference -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1816
- - C:\Users\Admin\AppData\Local\Temp\p2_3947.exe
    C:\Users\Admin\AppData\Local\Temp\p2_3947.exe
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" netsh advfirewall firewall add rule name="Zjt+r[!ArtekrJ" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe" enable=yes & exit
      4⤵
      PID:2396
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6124
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\xdwdSearcher.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3836
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\xdwdSearcher.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4740
- - C:\Users\Admin\AppData\Local\Temp\p3_4734.exe
    C:\Users\Admin\AppData\Local\Temp\p3_4734.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Users\Admin\AppData\Local\Adobe\csrss.exe
      C:\Users\Admin\AppData\Local\Adobe\csrss.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:844
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
    - - C:\Program Files\Google\Chrome\Application\csrss.exe
        
        "C:\Program Files\Google\Chrome\Application\csrss.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1624

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\xdwdSearcher.exe
C:\Windows\xdwdSearcher.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1212

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSearch.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwdSearch.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdSearch.exe.log
Size 642B
SHA256 07cd502f2fffb7c6a891a219527278857fed0061bac452445b945c4753899f2f
MD5 fd08d0d1c404b16d00be959c6656523f
SHA1 d4849d6219a49ab44a105a99d451ded26173470c
SHA512 2f788cb4d91b021966ae25ab68c7a0973cb1e5f53425e6324d5af71d6e0a5fcf8b15da341335acc30740a9aa4a6104502c377da1fad6e81f6460c5fd017329c5
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_rrnwuopx.ud0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rrnwuopx.ud0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

loader_tmp_7972.exe

Path C:\Users\Admin\AppData\Local\Temp\loader_tmp_7972.exe
Size 3.7MB
SHA256 4e14cd03ea4e0e8e44d71b7b60415895c1d0c316fe01777e59915c6b8de2ced5
MD5 5eda4972707f56c329d3a57c7955dd1f
SHA1 e1b01cebf32d9db530aa9751659f619f78d27654
SHA512 da4d2319436d2f876563d3f8549c89312bbabe0f2e83af1712cc117c6316bc5c8f18c6c8b2a02dfa554a8a5e9b9653657b1f279f83d1acfd7b775cc1ccb9318e
SSDEEP 98304:+FM2rAf/U7DEprkjr8gIe1QXOEMYwwjyUGx2VoE+RGa0p:BWQNkjnI7+owwOUGxCoEuGa
MD5 SHA1 SHA512 SSDEEP

Submit Download

p1_6317.exe

Path C:\Users\Admin\AppData\Local\Temp\p1_6317.exe
Size 6KB
SHA256 cd8ea15d1fd045626e9063075e4676852c888d95f2814d34b538c16863f994bd
MD5 5a0b194a779484a28b42ff45d89c5753
SHA1 33c18b8a34834e33ebc483c7a4102cac517483be
SHA512 0b658ce03daf8db3acaadfb077b3ad1a16c3cc23407c504445dd4ad52299361676bfc7097152534b504b6d545a7f1369359e7a6860d54065e4a022a27f431228
SSDEEP 96:6InXrL4aQiWWzOGuk/SEy5yAik6iusHru+uH1O4IC:6IXrLtU5cAiSg+9
MD5 SHA1 SHA512 SSDEEP

Submit Download

p2_3947.exe

Path C:\Users\Admin\AppData\Local\Temp\p2_3947.exe
Size 473KB
SHA256 95b3ab0d4191815ef84e9c005e15f3881cdbf0ef7ffb93f6c4e212e9b57ba7a8
MD5 3f1a360927659119926a96db0f3d6ccf
SHA1 a2da6bfe90882ddeaba5645ec346fc30be52d9f1
SHA512 b11b96f8c3a5a5e11a9819bda41a990814870d96cb302185ea8cd62121ae9f591994c2963d6924cca7e2387b96404176da937a18ac38d5453e99da3a269e2495
SSDEEP 12288:HUwC8g84kKUQIigtW+BIAs6LNMdXNEgTyJds0J7vA:0fxme0hPsWSEXJlA
MD5 SHA1 SHA512 SSDEEP

Submit Download

p3_4734.exe

Path C:\Users\Admin\AppData\Local\Temp\p3_4734.exe
Size 3.1MB
SHA256 614694acd84dd5396d573e4119610d9339683de336b6ee4e3409c4bcde13fadd
MD5 3990cdaa94ca97a75ca039fe07c53351
SHA1 36b6e028e3f63ff6290527fa5baf682683c419d9
SHA512 7774c902c3a83061112e56fa86583388a9508a74de077aa21ac58f13f19672024327e5823f62a871cbd8a4e0428bef957e97d4d6fd138d709607b1c28b6a80aa
SSDEEP 98304:oM2rAf/U7DEprkjr8gIe1QXOEMYwwjyUGx2VoE+RG:9WQNkjnI7+owwOUGxCoEuG
MD5 SHA1 SHA512 SSDEEP

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/844-149-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-225-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-239-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-210-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-235-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-233-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-241-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-243-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-228-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-237-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-223-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-247-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-221-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-219-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/844-213-0x00000000001C0000-0x0000000000D4B000-memory.dmp

Download

memory/1624-179-0x00000000008D0000-0x000000000145B000-memory.dmp

Download

memory/1624-183-0x00000000008D0000-0x000000000145B000-memory.dmp

Download

memory/1636-161-0x0000000005040000-0x0000000005062000-memory.dmp

Download

memory/1636-201-0x0000000007580000-0x0000000007595000-memory.dmp

Download

memory/1636-180-0x00000000064E0000-0x0000000006526000-memory.dmp

Download

memory/1636-173-0x0000000005F00000-0x0000000005F1E000-memory.dmp

Download

memory/1636-184-0x0000000007330000-0x0000000007364000-memory.dmp

Download

memory/1636-186-0x0000000070FB0000-0x0000000071307000-memory.dmp

Download

memory/1636-193-0x0000000007370000-0x000000000738E000-memory.dmp

Download

memory/1636-194-0x0000000007390000-0x0000000007434000-memory.dmp

Download

memory/1636-185-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Download

memory/1636-196-0x00000000074C0000-0x00000000074DA000-memory.dmp

Download

memory/1636-195-0x0000000007AF0000-0x000000000816A000-memory.dmp

Download

memory/1636-197-0x0000000007510000-0x000000000751A000-memory.dmp

Download

memory/1636-198-0x0000000007660000-0x00000000076F6000-memory.dmp

Download

memory/1636-199-0x0000000007530000-0x0000000007541000-memory.dmp

Download

memory/1636-200-0x0000000007570000-0x000000000757E000-memory.dmp

Download

memory/1636-157-0x00000000026E0000-0x0000000002716000-memory.dmp

Download

memory/1636-202-0x00000000075E0000-0x00000000075FA000-memory.dmp

Download

memory/1636-203-0x00000000075D0000-0x00000000075D8000-memory.dmp

Download

memory/1636-204-0x00000000075F0000-0x0000000007612000-memory.dmp

Download

memory/1636-205-0x0000000008720000-0x0000000008CC6000-memory.dmp

Download

memory/1636-159-0x00000000050B0000-0x00000000056DA000-memory.dmp

Download

memory/1636-163-0x00000000057C0000-0x0000000005826000-memory.dmp

Download

memory/1636-170-0x00000000059F0000-0x0000000005D47000-memory.dmp

Download

memory/1636-174-0x0000000005F60000-0x0000000005FAC000-memory.dmp

Download

memory/1636-162-0x0000000005750000-0x00000000057B6000-memory.dmp

Download

memory/1816-23-0x000001C01DF00000-0x000001C01DF22000-memory.dmp

Download

memory/3504-172-0x0000000000310000-0x0000000000E9B000-memory.dmp

Download

memory/3504-158-0x0000000000310000-0x0000000000E9B000-memory.dmp

Download

memory/3528-33-0x00007FF6E4FC0000-0x00007FF6E5381000-memory.dmp

Download

memory/3528-141-0x00007FF6E4FC0000-0x00007FF6E5381000-memory.dmp

Download

memory/3932-218-0x000001E5BE8B0000-0x000001E5BEA63000-memory.dmp

Download

memory/3932-224-0x000001E5BE8B0000-0x000001E5BEA63000-memory.dmp

Download

memory/3932-208-0x000001E5BE8B0000-0x000001E5BEA63000-memory.dmp

Download

memory/3932-226-0x000001E5BE8B0000-0x000001E5BEA63000-memory.dmp

Download

memory/3932-234-0x000001E5BE8B0000-0x000001E5BEA63000-memory.dmp

Download

memory/3932-242-0x000001E5BE8B0000-0x000001E5BEA63000-memory.dmp

Download

memory/3932-236-0x000001E5BE8B0000-0x000001E5BEA63000-memory.dmp

Download

memory/3932-229-0x000001E5BE8B0000-0x000001E5BEA63000-memory.dmp

Download

memory/3932-238-0x000001E5BE8B0000-0x000001E5BEA63000-memory.dmp

Download

memory/3932-240-0x000001E5BE8B0000-0x000001E5BEA63000-memory.dmp

Download

memory/3996-32-0x000001C73ECD0000-0x000001C73ED4A000-memory.dmp

Download

memory/4580-28-0x00007FF6C1E10000-0x00007FF6C21EF000-memory.dmp

Download

memory/5832-17-0x0000000000C70000-0x0000000000C78000-memory.dmp

Download

memory/6008-137-0x00000000004D0000-0x000000000105B000-memory.dmp

Download

memory/6008-151-0x00000000004D0000-0x000000000105B000-memory.dmp

Download