stealc | a0c4faaa16d893503f915c69548418a9f1500236885b16026a8e6758f7d414aa

Resubmissions

12/12/2025, 06:22

251212-g49esscj5110

02/12/2025, 16:28

251202-tyzdvsvmdw10

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2025, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe
Size 5.0MB
Sample251202-tyzdvsvmdw
SHA256 a0c4faaa16d893503f915c69548418a9f1500236885b16026a8e6758f7d414aa
MD5 708d3d81b162487b8e1e1ec4d0cc1f1b
SHA1 9a0a790cb536228d8f3af3d797497191037768d4
SHA512 fdae8e46e5e2971167ea0f382e1a178f792a02363066af09f62b5582f9194ba005c2f6b8b155e45a936d65ba7476f08848d8600b2aa44d11e177eb820980dd79
SSDEEP 49152:LzXg9M/MBbmWhZuozUiiqXdxNr3X/Sg+MUst1gD1p82N/3:L3UsksiiedvPZzQ/3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

0473ab0852fb153f2f2a3f2bde94a4dc 1111 discovery stealc vidar spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

1111

http://37.221.66.19

Attributes

url_path
/05f640dd85154ef9.php

rc4.plain

Extracted

Family

vidar

Version

16.8

Botnet

0473ab0852fb153f2f2a3f2bde94a4dc

Signatures

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2944-1005-0x0000000140000000-0x0000000140188000-memory.dmp	family_vidar_v15
behavioral1/memory/2944-1135-0x0000000140000000-0x0000000140188000-memory.dmp	family_vidar_v15

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Downloads MZ/PE file 2 IoCs

flow	pid	Process
34	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe
39	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Control Panel\International\Geo\Nation	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe

Executes dropped EXE 2 IoCs

pid	Process
2944	MNYtsZgQ4OyQ.exe
2760	5MaM6K44czov.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2760 set thread context of 5196	2760	5MaM6K44czov.exe	113

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MNYtsZgQ4OyQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MNYtsZgQ4OyQ.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5196	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe
4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe
2944	MNYtsZgQ4OyQ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
5716	msedge.exe
5716	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5196	AppLaunch.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
5716	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 5704	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	84
PID 4248 wrote to memory of 5704	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	84
PID 4248 wrote to memory of 2976	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	93
PID 4248 wrote to memory of 2976	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	93
PID 4248 wrote to memory of 3480	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	97
PID 4248 wrote to memory of 3480	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	97
PID 4248 wrote to memory of 1980	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	101
PID 4248 wrote to memory of 1980	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	101
PID 4248 wrote to memory of 5596	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	104
PID 4248 wrote to memory of 5596	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	104
PID 4248 wrote to memory of 6092	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	107
PID 4248 wrote to memory of 6092	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	107
PID 4248 wrote to memory of 2944	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	110
PID 4248 wrote to memory of 2760	4248	2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe	112
PID 2760 wrote to memory of 5196	2760	5MaM6K44czov.exe	113
PID 2760 wrote to memory of 5196	2760	5MaM6K44czov.exe	113
PID 2944 wrote to memory of 1424	2944	MNYtsZgQ4OyQ.exe	114
PID 1424 wrote to memory of 3924	1424	chrome.exe	115
PID 2944 wrote to memory of 1424	2944	MNYtsZgQ4OyQ.exe	114
PID 1424 wrote to memory of 5396	1424	chrome.exe	116
PID 1424 wrote to memory of 4844	1424	chrome.exe	117
PID 1424 wrote to memory of 5396	1424	chrome.exe	116
PID 1424 wrote to memory of 3300	1424	chrome.exe	118
PID 1424 wrote to memory of 3300	1424	chrome.exe	118
PID 1424 wrote to memory of 4592	1424	chrome.exe	120
PID 1424 wrote to memory of 4592	1424	chrome.exe	120
PID 1424 wrote to memory of 2740	1424	chrome.exe	121
PID 1424 wrote to memory of 2740	1424	chrome.exe	121
PID 1424 wrote to memory of 4392	1424	chrome.exe	122
PID 1424 wrote to memory of 4392	1424	chrome.exe	122
PID 1424 wrote to memory of 2432	1424	chrome.exe	123
PID 1424 wrote to memory of 2432	1424	chrome.exe	123
PID 2944 wrote to memory of 4880	2944	MNYtsZgQ4OyQ.exe	125
PID 4880 wrote to memory of 5716	4880	msedge.exe	126
PID 5716 wrote to memory of 5512	5716	msedge.exe	127
PID 5716 wrote to memory of 1876	5716	msedge.exe	128
PID 5716 wrote to memory of 4160	5716	msedge.exe	129
PID 5716 wrote to memory of 1876	5716	msedge.exe	128
PID 5716 wrote to memory of 1876	5716	msedge.exe	128
PID 5716 wrote to memory of 4648	5716	msedge.exe	130
PID 5716 wrote to memory of 4648	5716	msedge.exe	130
PID 5716 wrote to memory of 3964	5716	msedge.exe	131
PID 5716 wrote to memory of 3964	5716	msedge.exe	131
PID 5716 wrote to memory of 3964	5716	msedge.exe	131
PID 5716 wrote to memory of 5092	5716	msedge.exe	132
PID 5716 wrote to memory of 5092	5716	msedge.exe	132
PID 5716 wrote to memory of 5092	5716	msedge.exe	132
PID 2944 wrote to memory of 5716	2944	MNYtsZgQ4OyQ.exe	126

C:\Users\Admin\AppData\Local\Temp\2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2025-12-02_708d3d81b162487b8e1e1ec4d0cc1f1b_cobalt-strike.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:6092
- C:\Users\Admin\AppData\Local\MNYtsZgQ4OyQ.exe
  "C:\Users\Admin\AppData\Local\MNYtsZgQ4OyQ.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fface9ddcf8,0x7fface9ddd04,0x7fface9ddd10
      4⤵
      PID:3924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1964,i,11373764617549289613,5702108890454071095,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=1960 /prefetch:2
      4⤵
      PID:5396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1544,i,11373764617549289613,5702108890454071095,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2164 /prefetch:3
      4⤵
      PID:4844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2416,i,11373764617549289613,5702108890454071095,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2516 /prefetch:8
      4⤵
      PID:3300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,11373764617549289613,5702108890454071095,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:4592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3240,i,11373764617549289613,5702108890454071095,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:2740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3184,i,11373764617549289613,5702108890454071095,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4252 /prefetch:2
      4⤵
      PID:4392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4544,i,11373764617549289613,5702108890454071095,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4656 /prefetch:1
      4⤵
      PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --edge-skip-compat-layer-relaunch
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x218,0x7fface9bf208,0x7fface9bf214,0x7fface9bf220
        5⤵
        
        PID:5512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1992,i,2466398320213782543,405020012445420111,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
        5⤵
        
        PID:1876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2108,i,2466398320213782543,405020012445420111,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
        5⤵
        
        PID:4160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1276,i,2466398320213782543,405020012445420111,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
        5⤵
        
        PID:4648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,2466398320213782543,405020012445420111,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        
        PID:3964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3508,i,2466398320213782543,405020012445420111,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        5⤵
        
        PID:5092
- C:\Users\Admin\AppData\Local\5MaM6K44czov.exe
  "C:\Users\Admin\AppData\Local\5MaM6K44czov.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of AdjustPrivilegeToken
    PID:5196

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3128

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 5cf3e9e27bf87b075e0873868fcc5b9ae5199c9fd90edc11987b32a8395a051b
MD5 d013e03de7476d44a63c5f906ebbc456
SHA1 015018953a8bfc9e62b6b2643787aabe24ac3086
SHA512 4c58c5c6fba6001be6277738817dc2a6a572f23542442d8d327eb7e8efb6c2d4daa50b3960f18d1817d1b6811d2ab06c7cb9184b11e5f56f519b212e7b2f8efe
MD5 SHA1 SHA512

Submit Download

5MaM6K44czov.exe

Path C:\Users\Admin\AppData\Local\5MaM6K44czov.exe
Size 3.9MB
SHA256 10ac444998acbf7df61a27205e104023d3722b4db77bc2ca3bac37b887d9998b
MD5 b0fecd343d788d212e763398c6252f65
SHA1 a08b66f59deb02ed954edbf95afd991e97ea7078
SHA512 3da85317912b51a25babbb11c9ef593ec692e305012d5251e12ec112d0752d15214b112a8a7e545890426fe377f4276e9e2edbaa22c15f86d57acd2150e721a8
SSDEEP 49152:92l14VZra+4G0yDfn1Xl+R2Yav7OPWtpmZIg+A8wE2Y:9hBC8OPWtp48wEf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 7c27862648b98192549b5a37fbae0bb7a9c2886b1df84348d98e1c63ce7978d0
MD5 4c9dea06b35fe5a42b7a831bee6e7734
SHA1 2be0f6def5527b216775678e43d58f5c73b01608
SHA512 44f62b14d41f521ba89fac880c0c7444bc241af309449e6400287b61d91600139e4b80960c992484ef0cca0077c0fabc2cebf5fe41752d86e02c0c95bbb37a31
SSDEEP 3072:dZW79BZS0lwR6BsmXWqqbx8TPgS5yCY0VLJbdYvjIBE:+7pS0lVUbxOgY00VLJbu7IBE
MD5 SHA1 SHA512 SSDEEP

Submit Download

MNYtsZgQ4OyQ.exe

Path C:\Users\Admin\AppData\Local\MNYtsZgQ4OyQ.exe
Size 5.3MB
SHA256 2e0a5ce820ca318301a6e027f930247f59c73d576fc54b0295b3169e58125660
MD5 280bad265e50d6673e281c3b414db178
SHA1 0f195459eda10d0d7f805dade3c95c0a565fcda2
SHA512 42d4ec98680b7b9cf1049493681b11b7b2de666f379fb941265f95f90b0623ae13160a44c867f7a0acd4b218a1f8c9ecdfeef39e00905615892dedab039784c5
SSDEEP 98304:5CAUDsP9IGfTxdL6UDtUdO4IeA/NhEHzhZJcNf83KKw/R:sAOsVXfTxdL6UDtUdO4IeA/NhEHzSPK+
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 502d629a47554eea903ec1d625ce8f8455b10505212a994297976cf089dac722
MD5 d2169ec78e0defecf4855bdc71e5816e
SHA1 85c3c1e1354e886f81e373c3d036d9439ae601d5
SHA512 7217c2395b976dd85d0f1d868385a801f00f34a71c7da49ba64146b7f87449663148545b5329f0e3d9a1c82425c6954e8f9ce5257618609baa416a31422ec9d5
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a7363f9608e51b97018ab0f8bc8d647260eaf39a3621f16f90add76d09d2bd71
MD5 193ffd3c226588341995af9c0aa50fc2
SHA1 aa879f8e0688ed1a20410085c42f1ddbfa36d7ba
SHA512 7a0d9d2819d6f4efe33dce23bd754bf8d37b12eda95a4baea2382c2a95007dc5c0643986d5f12e0d771b4276ed799de251b01324036a322505daf4af8c287281
SSDEEP 768:FF5BLv7I5wCPFdV6Zi63ECgi+GAx38pKDmsaOCjB:VJUV6ZL30g8mxRjB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 666172a1e105542778ff2633a92424e7c55708d9d2fa17400e9ff3630313df9e
MD5 e2ada9ea1509ab545998422891e398be
SHA1 8e8505dcdb3f247534c6af443f8318bbc7c882bd
SHA512 d17d8e24d880673dd0065bba536132eaaf2656702cfa137128a0426baaca537bd2312f9de64a65ae96b0dad7730b80000a3f000c2e927042820677461adfb270
SSDEEP 768:cF5BLv7I5wCPFdV6Zi63ECgrKGAx38poAmsaOCjB:MJUV6ZL3RghmxRjB
MD5 SHA1 SHA512 SSDEEP

Submit Download

SkPeiZ0pdowt

Path C:\Users\Admin\AppData\Local\Temp\SkPeiZ0pdowt
Size 40KB
SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
MD5 dfd4f60adc85fc874327517efed62ff7
SHA1 f97489afb75bfd5ee52892f37383fbc85aa14a69
SHA512 d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4
SSDEEP 96:iLSQCn8MouB6w9f/8iZqmvJKLPeymwil:iLSQG7Iw9fEiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2944-45-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/2944-1005-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/2944-1135-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/4248-9-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-5-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-14-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-15-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-57-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-58-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-3-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-2-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-4-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-0-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-7-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-6-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-8-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-10-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-12-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-13-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/4248-11-0x0000000140000000-0x00000001400C3000-memory.dmp

Download

memory/5196-116-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-82-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-136-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-134-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-132-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-130-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-128-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-126-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-124-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-120-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-118-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-140-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-114-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-112-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-110-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-108-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-122-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-100-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-106-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-104-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-102-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-96-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-94-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-92-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-90-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-86-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-84-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-138-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-80-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-78-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-76-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-74-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-72-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-70-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-68-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-66-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-62-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-60-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-59-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-64-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-985-0x00000000051B0000-0x0000000005204000-memory.dmp

Download

memory/5196-986-0x0000000005200000-0x000000000524C000-memory.dmp

Download

memory/5196-992-0x0000000005BC0000-0x0000000006164000-memory.dmp

Download

memory/5196-993-0x00000000056B0000-0x0000000005742000-memory.dmp

Download

memory/5196-996-0x0000000005610000-0x000000000561A000-memory.dmp

Download

memory/5196-142-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-144-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-148-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-150-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-152-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-154-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-146-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-98-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-88-0x0000000004FF0000-0x00000000050B3000-memory.dmp

Download

memory/5196-56-0x0000000004FF0000-0x00000000050BA000-memory.dmp

Download

memory/5196-55-0x00000000009B0000-0x0000000000A66000-memory.dmp

Download