valleyrat_s2 | 647607184fbd96a9c4ba2bb2c7289edf5e165f36a1b9a6d82deecbce0c7902b7

Analysis

max time kernel
149s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
06/12/2025, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Size 555KB
Sample251206-tha2bswmbj
SHA256 647607184fbd96a9c4ba2bb2c7289edf5e165f36a1b9a6d82deecbce0c7902b7
MD5 cee267eeff6d606bf57458108cbaa647
SHA1 cb1e50573c4d6efd7d90e4aca5148b61650d3c9c
SHA512 3d8b5248d59fbe2d5df6b6870245ceb8a731957c1e68e29084735d6077ac71c410b0f9cb0465ce85acedb9c29fc5f4a2fe8aadb5c3b8ee02b624124e09f40e66
SSDEEP 6144:cpTnIwct9qUoCzBiFQDVMHrYsXECCzE0H1pSkFmSPB9ZORXPAxJ:cpTIwDGiAVMcsKZSkjfZORXPA7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor discovery valleyrat_s2 persistence

Malware Config

Extracted

Family

valleyrat_s2

Version

192.163.166.13:6666
127.0.0.1:8888
127.0.0.1:80

Attributes

campaign_date
2025.12. 4

Signatures

ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Valleyrat_s2 family
valleyrat_s2

Executes dropped EXE 5 IoCs

pid	Process
3524	app_240615875.exe
3868	WinSvc1.exe
5184	WinSvc2.exe
3468	WinSvc1.exe
396	WinSvc2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-503569783-3534512106-765729973-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinService1 = "C:\\Users\\Admin\\AppData\\Roaming\\WinSvc1.exe"	2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-503569783-3534512106-765729973-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinService2 = "C:\\Users\\Admin\\AppData\\Roaming\\WinSvc2.exe"	2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2116	5184	WerFault.exe	90
3572	396	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinSvc2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134095105901218083"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3948	2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
3948	2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5664	chrome.exe
5664	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe
5400	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe
Token: SeShutdownPrivilege	5400	chrome.exe
Token: SeCreatePagefilePrivilege	5400	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5400	chrome.exe
5400	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3524	3948	2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe	78
PID 3524 wrote to memory of 5400	3524	app_240615875.exe	79
PID 5400 wrote to memory of 3252	5400	chrome.exe	80
PID 5400 wrote to memory of 2796	5400	chrome.exe	81
PID 5400 wrote to memory of 5504	5400	chrome.exe	82
PID 5400 wrote to memory of 5504	5400	chrome.exe	82
PID 5400 wrote to memory of 4504	5400	chrome.exe	83
PID 5400 wrote to memory of 4504	5400	chrome.exe	83
PID 5400 wrote to memory of 1416	5400	chrome.exe	85
PID 5400 wrote to memory of 2532	5400	chrome.exe	86
PID 5400 wrote to memory of 1416	5400	chrome.exe	85
PID 5400 wrote to memory of 2532	5400	chrome.exe	86
PID 5400 wrote to memory of 4500	5400	chrome.exe	88
PID 5400 wrote to memory of 4500	5400	chrome.exe	88
PID 3948 wrote to memory of 3868	3948	2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe	89
PID 3948 wrote to memory of 5184	3948	2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe	90
PID 5400 wrote to memory of 5680	5400	chrome.exe	104
PID 5400 wrote to memory of 5832	5400	chrome.exe	106
PID 5400 wrote to memory of 5832	5400	chrome.exe	106
PID 5400 wrote to memory of 224	5400	chrome.exe	107
PID 5400 wrote to memory of 224	5400	chrome.exe	107
PID 5400 wrote to memory of 3104	5400	chrome.exe	108
PID 5400 wrote to memory of 4060	5400	chrome.exe	109
PID 5400 wrote to memory of 3340	5400	chrome.exe	110
PID 5400 wrote to memory of 2088	5400	chrome.exe	111
PID 5400 wrote to memory of 2088	5400	chrome.exe	111
PID 5400 wrote to memory of 2864	5400	chrome.exe	112
PID 5400 wrote to memory of 2864	5400	chrome.exe	112
PID 5400 wrote to memory of 5664	5400	chrome.exe	113

C:\Users\Admin\AppData\Local\Temp\2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2025-12-06_cee267eeff6d606bf57458108cbaa647_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\app_240615875.exe
  "C:\Users\Admin\AppData\Local\Temp\\app_240615875.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --app=http://108.187.4.64 --window-size=1200,800
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb65cadcf8,0x7ffb65cadd04,0x7ffb65cadd10
      4⤵
      PID:3252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1444,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2200 /prefetch:11
      4⤵
      PID:2796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2172,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:5504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2364,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2520 /prefetch:13
      4⤵
      PID:4504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3148 /prefetch:1
      4⤵
      PID:1416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      PID:2532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4168,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4192 /prefetch:9
      4⤵
      PID:4500
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5160,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:5680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5468,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5348 /prefetch:1
      4⤵
      PID:5832
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3200,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4540 /prefetch:1
      4⤵
      PID:224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5608,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:3104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5700,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:4060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5708,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5436,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4236 /prefetch:1
      4⤵
      PID:2088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4324,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:2864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3156,i,9230328900123408011,7560160208156628743,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4540 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5664
- C:\Users\Admin\AppData\Roaming\WinSvc1.exe
  "C:\Users\Admin\AppData\Roaming\WinSvc1.exe"
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Users\Admin\AppData\Roaming\WinSvc2.exe
  "C:\Users\Admin\AppData\Roaming\WinSvc2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 332
    3⤵
    - Program crash
    PID:2116

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5184 -ip 5184
1⤵
PID:1884

C:\Users\Admin\AppData\Roaming\WinSvc1.exe
C:\Users\Admin\AppData\Roaming\WinSvc1.exe
1⤵
- Executes dropped EXE
PID:3468

C:\Users\Admin\AppData\Roaming\WinSvc2.exe
C:\Users\Admin\AppData\Roaming\WinSvc2.exe
1⤵
- Executes dropped EXE
PID:396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 296
  2⤵
  - Program crash
  PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 396 -ip 396
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f1bc8e605013a3c82902b0be2f72d36fc63370c096a04720bbb9c9dc63fb8316
MD5 9493f2da0f29046ed49bfb5c4fbde3ae
SHA1 3fe6a50ea63bb3d900932338405b589dbe09f961
SHA512 f7602e82c72b2ef17955d4b474a56d57dcce519fc27ba9d944173e917f5607623c9bfcd4966e325f4227c49ffe62c0ffc66601886f56a5f14b7e71d6fd62f495
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 49d294e38ebc837726bb4a3136baad6f2a4657cb6a9f5df57b3437b62cb7a55e
MD5 7f2889e079ae20f49e22d21ab024d289
SHA1 39d7fe46b4d790678ef69c36cb0d304bf496241b
SHA512 618c2e32a8e2943e49a2267fb0b9c48ca196fbd4c1eebd410e6c1e3ad209e7486d8ab0d0015caa00e696470c1c1a45de689f4a91f987b70e58208cdfec632ea9
SSDEEP 192:3YYyXLcB3Q3Z8PRpA9/HJ5+WN4PtZ2zSn2uAkwhpQyIsnA/g4:3YZXL0XAZ5QZiSn2fPZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 0c8883e0ccc9048cf34bd6157f1eddf61a26c82a5a3e21b9ec65b98244a87c21
MD5 29f3cf360862b41e4b132ba9f4b3e13e
SHA1 7b7fa8f47c103194489f7ebcf845b5701c79ffc6
SHA512 079aeea52c9a3ffa9440d2ac40bff83ea3d49d9cb325502e29261928612ad0ef82c390b921b9c87ab2ed0d93d46fa294b7ebd26cd60a977ba1a5943aaca6d6a7
SSDEEP 384:uiJA7pLuLco9GjXc9PkXqKf/pUZNCgVLH2Hf1yDrU/4HGY+Hqf:ueA7pLuLhMrc9PkXqKf/pUZNCgVLH2He
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f2b771ba3a42bb09acee1948790f8740f4d886d202629307f1577c54a58c9a12
MD5 1ba398ce4b14ef2186f07732ad940067
SHA1 3fbfc1330c738f1663305cab23ddadd6199801ee
SHA512 6339bd5bf2b6208b3e86327ac4b9d7b95ff378b38382aaf05192923855c21b2908e00b58e74bb7487e80a8692469826b2a709f59b1dab7353a4d4ecb06695164
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57d3f9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d3f9.TMP
Size 48B
SHA256 97c7715c115b90e4ddcea9f4b03bb7ad7618604a83040e4ff4e562e3981d97ec
MD5 4a3c00c6f203f62d6cb41a3b2f9e1713
SHA1 8f207184de83194e083189c0e378b336061123e9
SHA512 748a476aacb21718bcbfd051a91bd847cbec247d01a0a5fbddfc6529b2d346d00fd4f1c72736f1a00569a439b3d097c7a40351f88a95bb9e3c5d0d460ddbb465
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 1a23b8c1dd8541a9f27eb44765126252f1b7c920d8c2b327ad5723c5f6ba61ef
MD5 014a7df27456bb0d7b19064afbf800de
SHA1 8e8712889db8b4bd31d0f93afaf58db2bd4ed49d
SHA512 3fee27fa24e6a377a353c1b0d0cf24703daaf75f0bb80af64f86c5a14a964472563bbf36113775daa368d75d6ca261c236b53cd9883188ea2a8875e709db3d1a
SSDEEP 3072:ckXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT9:hWMExki2KL64sbWRtHqldg+G/M9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 4f9f6fde3ee50c4d252d1fd3ac0df8d513b596fa756320b12aa4e6335f9d9e99
MD5 80d62ef6a6fcdb7f6249e94a47c6bccb
SHA1 d494207b48218f81799e3eb7be8f665d4665dd6f
SHA512 784a6dfee8207feff007bcb98a28846fefb7eafd1684934d9261d33debd65e84a7d1a64c9c512aa7bb45225e47c9e3c8a46105d2f257fe439bcb3c967efc8ec4
SSDEEP 3072:vTXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cTU:7WMExki2KL64sbWRtHqldg+G/MU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 477dfa2e75fcca85789873fed41678d4ded18d323b9d61b631963a190845012c
MD5 909739b1aa29528ccaba7c8ec17db685
SHA1 f754229e7e1465e9de901a95e6d012359f692106
SHA512 58ce67a6f79227f03e367e2ea97030703133342a0b936513724e6f86bde7b2746e575028fde2d2dbe38ac255127af25ec22dac8b3c1e164bd37c0ceaf955e136
SSDEEP 3072:xkXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT9:+WMExki2KL64sbWRtHqldg+G/M9
MD5 SHA1 SHA512 SSDEEP

Submit Download

app_240615875.exe

Path C:\Users\Admin\AppData\Local\Temp\app_240615875.exe
Size 268KB
SHA256 f38854dcb60eed2e5c34e229094758125c0a950718c7320b227bdbab58a0fd2d
MD5 11c19c9f309ccb56db0890eb4a3f014f
SHA1 401e1451f9890cb0cd5aed28eca7342989d4f5c4
SHA512 418f8c94d469fd1844186382dc8d8c62465d90f9630707ee31e2d3705d1e4b9079beb932155743697f43e45dc7d526ab42999249cf2a6ef35438955a3151aa18
SSDEEP 1536:V9FcUjvc6I78iqErjMiqU/lkZ/iQeUfmjVANRTJ72gvbJJb0Uli5zT+3VOMvW0B7:V9FcUiUfmCbJJbBiysb0p8
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinSvc1.exe

Path C:\Users\Admin\AppData\Roaming\WinSvc1.exe
Size 131KB
SHA256 4d5dbc0dd7993b860b5a565d05b5aab48d5de9d0838a0acb6d5da412771d2a06
MD5 ab9ff80dc418670d09ad778148b162e6
SHA1 f3221f0ec558e47d410dbfba690b1621a8274423
SHA512 d1accfcafb717c063075dbb1f2ba94c6293044475bb6dd6d85b3b9a747fca9e29961a368d730f93fc784593e604597aa461828c74ce94b9bb18878d592edbfe8
SSDEEP 3072:Eqk1HGXWPCQk5EGzzq2vLf7TlW3s0FZeUqe6o7Z:Ex1HZUmG62DDi1qmV
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinSvc2.exe

Path C:\Users\Admin\AppData\Roaming\WinSvc2.exe
Size 109KB
SHA256 a6c180ddf56ef343e6aafd7c6b3f0ea4ca89ef54d7659c014d8105587f42cd3a
MD5 752700909643a3544efee57e628b90e8
SHA1 a1a9822ced997036993fee204195a1eadaa8922a
SHA512 b3caa78902e8678d5d982348530cd2f7a3a26125acc783ca8215fd8078120d0c494eec12f280c8f8efb3625eb4427aa7c1c14bb5e792692bc181848d0930094f
SSDEEP 3072:Mlws81Cpcm1rBjp/9L6YKh9zp0Y56D268XEPKD25:Mt81Cxx9ZKzp0lx1yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3524-4-0x00000000003D0000-0x000000000041A000-memory.dmp

Download