darkvision | 567a7368b1da5e3c887a0e2610f505835f2e6861a2276fc674e68db38e6cb671

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/03/2026, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
Size 515KB
Sample260309-graqpsdt4x
SHA256 567a7368b1da5e3c887a0e2610f505835f2e6861a2276fc674e68db38e6cb671
MD5 6f79845f18e3ee694cfca390daa06263
SHA1 fe87cb2b3a42f0897bdcd076d201b96afc1c1a42
SHA512 06392e6b9c3990d16f79a22a15a678de7bb1c2e43ab16a78a7be8719ad5232aa4b2fa9efc4affc5c0c68fafb9ea50ac796cabe312f4deaeb1346aeb826158245
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3WEc:eiGmrVmxuPnCXztWJ
TLSH
T19EB49E11E660D233D47650B4CBF9C323A928BE716B0058E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution darkvision persistence rat

Malware Config

Extracted

Family

darkvision

94.154.32.81

Attributes

url
https://abdyb.cc/PASSWORDRECOVERY32EXE.EXE

https://abdyb.cc/PASSWORDRECOVERY64EXE.EXE

https://abdyb.cc/upload.php
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 4 IoCs

resource	yara_rule
behavioral1/files/0x0003000000023145-2.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4416-20-0x0000000001340000-0x00000000013B2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4416-31-0x0000000001340000-0x00000000013B2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4416-30-0x0000000001340000-0x00000000013B2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 30 IoCs

resource	yara_rule
behavioral1/memory/3264-45-0x0000000002860000-0x000000000296A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3264-51-0x0000000002860000-0x000000000296A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3264-61-0x0000000002860000-0x000000000296A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5024-68-0x00000000032C0000-0x00000000033CA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5024-74-0x00000000032C0000-0x00000000033CA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5024-82-0x00000000032C0000-0x00000000033CA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/224-90-0x0000000003700000-0x000000000380A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/224-96-0x0000000003700000-0x000000000380A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/224-104-0x0000000003700000-0x000000000380A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1340-112-0x00000000032A0000-0x00000000033AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1340-118-0x00000000032A0000-0x00000000033AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1340-126-0x00000000032A0000-0x00000000033AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5416-140-0x0000000002F80000-0x000000000308A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5416-134-0x0000000002F80000-0x000000000308A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5416-148-0x0000000002F80000-0x000000000308A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1244-156-0x0000000003470000-0x000000000357A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1244-162-0x0000000003470000-0x000000000357A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1244-171-0x0000000003470000-0x000000000357A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4236-179-0x00000000031E0000-0x00000000032EA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4236-185-0x00000000031E0000-0x00000000032EA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4236-193-0x00000000031E0000-0x00000000032EA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4848-201-0x0000000002880000-0x000000000298A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4848-207-0x0000000002880000-0x000000000298A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4848-215-0x0000000002880000-0x000000000298A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1284-223-0x0000000002900000-0x0000000002A0A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1284-229-0x0000000002900000-0x0000000002A0A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1284-237-0x0000000002900000-0x0000000002A0A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1616-245-0x0000000002BC0000-0x0000000002CCA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1616-251-0x0000000002BC0000-0x0000000002CCA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1616-259-0x0000000002BC0000-0x0000000002CCA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4956	powershell.exe
3016	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	4416	explorer.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{00D5CB0E-0626-451B-B3C7-085FE2415095}.lnk	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
3956	checker.exe
1992	checker.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4008	cmd.exe
1928	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartValue = "C:\\ProgramData\\unlock\\checker.exe {BA47A81B-D0BA-4BE5-9B43-08840D30056C}"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartValue = "C:\\ProgramData\\unlock\\checker.exe {BA47A81B-D0BA-4BE5-9B43-08840D30056C}"	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	checker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	checker.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4956	powershell.exe
4956	powershell.exe
3016	powershell.exe
3016	powershell.exe
3264	EXPLORER.EXE
3264	EXPLORER.EXE
5024	EXPLORER.EXE
5024	EXPLORER.EXE
224	EXPLORER.EXE
224	EXPLORER.EXE
1340	EXPLORER.EXE
1340	EXPLORER.EXE
5416	EXPLORER.EXE
5416	EXPLORER.EXE
1244	EXPLORER.EXE
1244	EXPLORER.EXE
4236	EXPLORER.EXE
4236	EXPLORER.EXE
4848	EXPLORER.EXE
4848	EXPLORER.EXE
1284	EXPLORER.EXE
1284	EXPLORER.EXE
1616	EXPLORER.EXE
1616	EXPLORER.EXE
4860	EXPLORER.EXE
4860	EXPLORER.EXE
3968	EXPLORER.EXE
3968	EXPLORER.EXE
2608	EXPLORER.EXE
2608	EXPLORER.EXE
2916	EXPLORER.EXE
2916	EXPLORER.EXE
2264	EXPLORER.EXE
2264	EXPLORER.EXE

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3956	checker.exe
3956	checker.exe
3956	checker.exe
4416	explorer.exe
4416	explorer.exe
4416	explorer.exe
3264	EXPLORER.EXE
3264	EXPLORER.EXE
3264	EXPLORER.EXE
4416	explorer.exe
4416	explorer.exe
4416	explorer.exe
5024	EXPLORER.EXE
5024	EXPLORER.EXE
5024	EXPLORER.EXE
4416	explorer.exe
4416	explorer.exe
4416	explorer.exe
224	EXPLORER.EXE
224	EXPLORER.EXE
224	EXPLORER.EXE
4416	explorer.exe
4416	explorer.exe
4416	explorer.exe
1340	EXPLORER.EXE
1340	EXPLORER.EXE
1340	EXPLORER.EXE
4416	explorer.exe
4416	explorer.exe
4416	explorer.exe
5416	EXPLORER.EXE
5416	EXPLORER.EXE
5416	EXPLORER.EXE
4416	explorer.exe
4416	explorer.exe
4416	explorer.exe
1244	EXPLORER.EXE
1244	EXPLORER.EXE
1244	EXPLORER.EXE
4416	explorer.exe
4416	explorer.exe
4416	explorer.exe
4236	EXPLORER.EXE
4236	EXPLORER.EXE
4236	EXPLORER.EXE
4416	explorer.exe
4416	explorer.exe
4416	explorer.exe
4848	EXPLORER.EXE
4848	EXPLORER.EXE
4848	EXPLORER.EXE
4416	explorer.exe
4416	explorer.exe
4416	explorer.exe
1284	EXPLORER.EXE
1284	EXPLORER.EXE
1284	EXPLORER.EXE
4416	explorer.exe
4416	explorer.exe
4416	explorer.exe
1616	EXPLORER.EXE
1616	EXPLORER.EXE
1616	EXPLORER.EXE
4416	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 4008	3992	2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe	86
PID 3992 wrote to memory of 3956	3992	2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe	88
PID 4008 wrote to memory of 4956	4008	cmd.exe	90
PID 3956 wrote to memory of 1928	3956	checker.exe	92
PID 3956 wrote to memory of 4416	3956	checker.exe	94
PID 1928 wrote to memory of 3016	1928	cmd.exe	95
PID 4416 wrote to memory of 3264	4416	explorer.exe	96
PID 516 wrote to memory of 1992	516	cmd.exe	103
PID 4416 wrote to memory of 5024	4416	explorer.exe	111
PID 4416 wrote to memory of 224	4416	explorer.exe	114
PID 4416 wrote to memory of 1340	4416	explorer.exe	119
PID 4416 wrote to memory of 5416	4416	explorer.exe	122
PID 4416 wrote to memory of 1244	4416	explorer.exe	125
PID 4416 wrote to memory of 4236	4416	explorer.exe	128
PID 4416 wrote to memory of 4848	4416	explorer.exe	131
PID 4416 wrote to memory of 1284	4416	explorer.exe	134
PID 4416 wrote to memory of 1616	4416	explorer.exe	137
PID 4416 wrote to memory of 4860	4416	explorer.exe	140
PID 4416 wrote to memory of 3968	4416	explorer.exe	143
PID 4416 wrote to memory of 2608	4416	explorer.exe	146
PID 4416 wrote to memory of 2916	4416	explorer.exe	149
PID 4416 wrote to memory of 2264	4416	explorer.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\unlock'
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\unlock'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\ProgramData\unlock\checker.exe
  "C:\ProgramData\unlock\checker.exe" {0E67860C-91DD-4F66-BF08-7D9AE29E6D49}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\unlock'
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\unlock'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3016
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Downloads MZ/PE file
    - Drops startup file
    - Adds Run key to start application
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1716
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:5024
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3328
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:224
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2424
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1340
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5960
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:5416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5276
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5092
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4912
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3824
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1108
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1616
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:6024
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4468
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3968
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4568
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2424
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5296
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3816

C:\Windows\system32\cmd.exe
cmd /c start "" "C:\ProgramData\unlock\checker.exe" {BA47A81B-D0BA-4BE5-9B43-08840D30056C}
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\ProgramData\unlock\checker.exe
  "C:\ProgramData\unlock\checker.exe" {BA47A81B-D0BA-4BE5-9B43-08840D30056C}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

checker.exe

Path C:\ProgramData\unlock\checker.exe
Size 515KB
SHA256 567a7368b1da5e3c887a0e2610f505835f2e6861a2276fc674e68db38e6cb671
MD5 6f79845f18e3ee694cfca390daa06263
SHA1 fe87cb2b3a42f0897bdcd076d201b96afc1c1a42
SHA512 06392e6b9c3990d16f79a22a15a678de7bb1c2e43ab16a78a7be8719ad5232aa4b2fa9efc4affc5c0c68fafb9ea50ac796cabe312f4deaeb1346aeb826158245
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3WEc:eiGmrVmxuPnCXztWJ
TLSH
T19EB49E11E660D233D47650B4CBF9C323A928BE716B0058E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 063bb7675f043bb4c1d78d5dc04801560331b0e430e7579d3a535740c539590f
MD5 a7e7cfd43d30bcc61251a5a230d79a7c
SHA1 0d5c054cc7a8a11b102ba68635e306799897ce28
SHA512 1fd8d7924a249fb3200dad3d5d9eda04b33f01bbb25579e71d541d6be97b0467338a28b0a8948223e357d6bf6b851f9fd9a2c38026002307ccf7a973f7ecbe83
TLSH
T1F251EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 a7c47af5ab1d8aaf4adbc4e094cb57607dbbb5fb77ba6d5d8259e408a73c427d
MD5 4b819e2f73fe48a28b643654fdf54b4d
SHA1 eaee0d9fd9f18c6d9abfe80c2c90890b810fc0f5
SHA512 2cf674d31a79397ae9d569f77a3bcfd39bec9598f92184369e610dabed9c7df93d20cc9f914eb542957a64c54acd2a31f6d3acec422d803d475b95e88889a777
TLSH
T1AC112227F38C8920CC96163A509DAC5172B596CB81EEDF9F7BC0C210E5BF984CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

DATABASE

Path C:\Users\Admin\AppData\Local\Temp\DATABASE
Size 56KB
SHA256 4f81904a9b06c58572a0e5769b3b4ffb99e7bd4be88ee8c2b64a804f483d9dc6
MD5 09a22b1bcd9725df5b3591ebbd2cebd6
SHA1 9ac352c38bb6a94ab949aced3d8ef6c302cf5cd3
SHA512 c3a4f219bb9a692512f649fdd4b73a031aea6409572497a35acc03fe259db1739d5ab534d56cb0b1208f9b4e767d22f523e1c0ad333a6c420ada122de3e225fb
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

DATABASE

Path C:\Users\Admin\AppData\Local\Temp\DATABASE
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_t5zrmfay.2qt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t5zrmfay.2qt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

iTCNbppgzM

Path C:\Users\Admin\AppData\Local\Temp\iTCNbppgzM
Size 32B
SHA256 7484fd293656ec66c4eebb05f9d8c2809eba395401994d728094dc221b61579c
MD5 2415c7682dc838016094fbd12f096fe1
SHA1 df281bd950d14d7d55e32121f8db119452ae0b58
SHA512 bf657a151ba6aa22b478b01cc81775a8dfde1ef8c80cd6c72bc98bb9cc99506f33f77b9f399141520dc551698ce54b3712ebadce19b1312fafc4c69e1ee7f872
MD5 SHA1 SHA512

Submit Download

pXralKDifY

Path C:\Users\Admin\AppData\Local\Temp\pXralKDifY
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-104-0x0000000003700000-0x000000000380A000-memory.dmp

Download

memory/224-90-0x0000000003700000-0x000000000380A000-memory.dmp

Download

memory/224-96-0x0000000003700000-0x000000000380A000-memory.dmp

Download

memory/224-107-0x0000000001210000-0x000000000121C000-memory.dmp

Download

memory/224-106-0x0000000001810000-0x0000000001F4F000-memory.dmp

Download

memory/1244-173-0x0000000000ED0000-0x0000000000EDC000-memory.dmp

Download

memory/1244-172-0x00000000014D0000-0x0000000001C0F000-memory.dmp

Download

memory/1244-156-0x0000000003470000-0x000000000357A000-memory.dmp

Download

memory/1244-162-0x0000000003470000-0x000000000357A000-memory.dmp

Download

memory/1244-171-0x0000000003470000-0x000000000357A000-memory.dmp

Download

memory/1284-239-0x0000000000870000-0x0000000000FAF000-memory.dmp

Download

memory/1284-240-0x0000000000170000-0x000000000017C000-memory.dmp

Download

memory/1284-223-0x0000000002900000-0x0000000002A0A000-memory.dmp

Download

memory/1284-229-0x0000000002900000-0x0000000002A0A000-memory.dmp

Download

memory/1284-237-0x0000000002900000-0x0000000002A0A000-memory.dmp

Download

memory/1340-128-0x0000000001360000-0x0000000001A9F000-memory.dmp

Download

memory/1340-112-0x00000000032A0000-0x00000000033AA000-memory.dmp

Download

memory/1340-118-0x00000000032A0000-0x00000000033AA000-memory.dmp

Download

memory/1340-129-0x0000000000E80000-0x0000000000E8C000-memory.dmp

Download

memory/1340-126-0x00000000032A0000-0x00000000033AA000-memory.dmp

Download

memory/1616-251-0x0000000002BC0000-0x0000000002CCA000-memory.dmp

Download

memory/1616-245-0x0000000002BC0000-0x0000000002CCA000-memory.dmp

Download

memory/1616-259-0x0000000002BC0000-0x0000000002CCA000-memory.dmp

Download

memory/1992-59-0x0000000000BC0000-0x0000000000C7F000-memory.dmp

Download

memory/3016-43-0x0000018923730000-0x0000018923E6F000-memory.dmp

Download

memory/3016-42-0x00000189098E0000-0x00000189098EC000-memory.dmp

Download

memory/3264-44-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/3264-45-0x0000000002860000-0x000000000296A000-memory.dmp

Download

memory/3264-51-0x0000000002860000-0x000000000296A000-memory.dmp

Download

memory/3264-62-0x0000000000800000-0x0000000000F3F000-memory.dmp

Download

memory/3264-63-0x0000000000110000-0x000000000011C000-memory.dmp

Download

memory/3264-61-0x0000000002860000-0x000000000296A000-memory.dmp

Download

memory/3264-60-0x0000000000120000-0x0000000000122000-memory.dmp

Download

memory/3956-64-0x0000000000B40000-0x0000000000BFF000-memory.dmp

Download

memory/3956-130-0x0000000000B40000-0x0000000000BFF000-memory.dmp

Download

memory/3992-4-0x0000000000AF0000-0x0000000000BAF000-memory.dmp

Download

memory/4236-196-0x0000000000B20000-0x0000000000B2C000-memory.dmp

Download

memory/4236-195-0x0000000001200000-0x000000000193F000-memory.dmp

Download

memory/4236-193-0x00000000031E0000-0x00000000032EA000-memory.dmp

Download

memory/4236-185-0x00000000031E0000-0x00000000032EA000-memory.dmp

Download

memory/4236-179-0x00000000031E0000-0x00000000032EA000-memory.dmp

Download

memory/4416-19-0x0000000000580000-0x0000000000582000-memory.dmp

Download

memory/4416-30-0x0000000001340000-0x00000000013B2000-memory.dmp

Download

memory/4416-66-0x00000000013C0000-0x00000000013CC000-memory.dmp

Download

memory/4416-65-0x0000000000B30000-0x000000000126F000-memory.dmp

Download

memory/4416-31-0x0000000001340000-0x00000000013B2000-memory.dmp

Download

memory/4416-20-0x0000000001340000-0x00000000013B2000-memory.dmp

Download

memory/4848-218-0x0000000000170000-0x000000000017C000-memory.dmp

Download

memory/4848-201-0x0000000002880000-0x000000000298A000-memory.dmp

Download

memory/4848-207-0x0000000002880000-0x000000000298A000-memory.dmp

Download

memory/4848-215-0x0000000002880000-0x000000000298A000-memory.dmp

Download

memory/4848-217-0x00000000008A0000-0x0000000000FDF000-memory.dmp

Download

memory/4956-17-0x0000025E9F540000-0x0000025E9F54C000-memory.dmp

Download

memory/4956-14-0x0000025EB9360000-0x0000025EB9382000-memory.dmp

Download

memory/4956-18-0x0000025EB9460000-0x0000025EB9B9F000-memory.dmp

Download

memory/4956-6-0x0000025EB9450000-0x0000025EB9460000-memory.dmp

Download

memory/4956-5-0x0000025EB9450000-0x0000025EB9460000-memory.dmp

Download

memory/5024-85-0x0000000000BC0000-0x0000000000BCC000-memory.dmp

Download

memory/5024-84-0x00000000012A0000-0x00000000019DF000-memory.dmp

Download

memory/5024-82-0x00000000032C0000-0x00000000033CA000-memory.dmp

Download

memory/5024-74-0x00000000032C0000-0x00000000033CA000-memory.dmp

Download

memory/5024-68-0x00000000032C0000-0x00000000033CA000-memory.dmp

Download

memory/5416-150-0x0000000001020000-0x000000000175F000-memory.dmp

Download

memory/5416-151-0x0000000000AF0000-0x0000000000AFC000-memory.dmp

Download

memory/5416-148-0x0000000002F80000-0x000000000308A000-memory.dmp

Download

memory/5416-134-0x0000000002F80000-0x000000000308A000-memory.dmp

Download

memory/5416-140-0x0000000002F80000-0x000000000308A000-memory.dmp

Download