darkvision | 567a7368b1da5e3c887a0e2610f505835f2e6861a2276fc674e68db38e6cb671

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/03/2026, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
Size 515KB
Sample260309-graqpsdt4x
SHA256 567a7368b1da5e3c887a0e2610f505835f2e6861a2276fc674e68db38e6cb671
MD5 6f79845f18e3ee694cfca390daa06263
SHA1 fe87cb2b3a42f0897bdcd076d201b96afc1c1a42
SHA512 06392e6b9c3990d16f79a22a15a678de7bb1c2e43ab16a78a7be8719ad5232aa4b2fa9efc4affc5c0c68fafb9ea50ac796cabe312f4deaeb1346aeb826158245
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3WEc:eiGmrVmxuPnCXztWJ
TLSH
T19EB49E11E660D233D47650B4CBF9C323A928BE716B0058E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution darkvision persistence rat

Malware Config

Extracted

Family

darkvision

94.154.32.81

Attributes

url
https://abdyb.cc/PASSWORDRECOVERY32EXE.EXE

https://abdyb.cc/PASSWORDRECOVERY64EXE.EXE

https://abdyb.cc/upload.php
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 4 IoCs

resource	yara_rule
behavioral2/files/0x001b00000002b280-2.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1816-31-0x0000000001FC0000-0x0000000002032000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1816-41-0x0000000001FC0000-0x0000000002032000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1816-42-0x0000000001FC0000-0x0000000002032000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 34 IoCs

resource	yara_rule
behavioral2/memory/220-63-0x00000000029C0000-0x0000000002ACA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/220-69-0x00000000029C0000-0x0000000002ACA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/220-83-0x00000000029C0000-0x0000000002ACA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4704-96-0x0000000002A50000-0x0000000002B5A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4704-90-0x0000000002A50000-0x0000000002B5A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4704-105-0x0000000002A50000-0x0000000002B5A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4512-110-0x0000000002860000-0x000000000296A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4512-116-0x0000000002860000-0x000000000296A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4512-124-0x0000000002860000-0x000000000296A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1052-130-0x00000000024A0000-0x00000000025AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1052-136-0x00000000024A0000-0x00000000025AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1052-145-0x00000000024A0000-0x00000000025AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3248-150-0x0000000002390000-0x000000000249A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3248-156-0x0000000002390000-0x000000000249A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3248-166-0x0000000002390000-0x000000000249A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1432-177-0x0000000002390000-0x000000000249A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1432-186-0x0000000002390000-0x000000000249A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/752-198-0x0000000002EC0000-0x0000000002FCA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/752-192-0x0000000002EC0000-0x0000000002FCA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/752-207-0x0000000002EC0000-0x0000000002FCA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4284-212-0x00000000025D0000-0x00000000026DA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4284-218-0x00000000025D0000-0x00000000026DA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4284-226-0x00000000025D0000-0x00000000026DA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1924-232-0x00000000022E0000-0x00000000023EA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1924-238-0x00000000022E0000-0x00000000023EA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1924-247-0x00000000022E0000-0x00000000023EA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3896-258-0x0000000002EB0000-0x0000000002FBA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3896-252-0x0000000002EB0000-0x0000000002FBA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3896-267-0x0000000002EB0000-0x0000000002FBA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4756-272-0x00000000021B0000-0x00000000022BA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4756-278-0x00000000021B0000-0x00000000022BA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4756-287-0x00000000021B0000-0x00000000022BA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1044-292-0x00000000010D0000-0x00000000011DA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1044-298-0x00000000010D0000-0x00000000011DA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3040	powershell.exe
3204	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	1816	explorer.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{00D5CB0E-0626-451B-B3C7-085FE2415095}.lnk	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
4436	checker.exe
628	checker.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4836	cmd.exe
4256	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartValue = "C:\\ProgramData\\unlock\\checker.exe {BA47A81B-D0BA-4BE5-9B43-08840D30056C}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\StartValue = "C:\\ProgramData\\unlock\\checker.exe {BA47A81B-D0BA-4BE5-9B43-08840D30056C}"	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	checker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	checker.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3204	powershell.exe
3204	powershell.exe
3040	powershell.exe
3040	powershell.exe
220	EXPLORER.EXE
220	EXPLORER.EXE
4704	EXPLORER.EXE
4704	EXPLORER.EXE
4512	EXPLORER.EXE
4512	EXPLORER.EXE
1052	EXPLORER.EXE
1052	EXPLORER.EXE
3248	EXPLORER.EXE
3248	EXPLORER.EXE
1432	EXPLORER.EXE
1432	EXPLORER.EXE
752	EXPLORER.EXE
752	EXPLORER.EXE
4284	EXPLORER.EXE
4284	EXPLORER.EXE
1924	EXPLORER.EXE
1924	EXPLORER.EXE
3896	EXPLORER.EXE
3896	EXPLORER.EXE
4756	EXPLORER.EXE
4756	EXPLORER.EXE
1044	EXPLORER.EXE
1044	EXPLORER.EXE
4496	EXPLORER.EXE
4496	EXPLORER.EXE
4596	EXPLORER.EXE
4596	EXPLORER.EXE
2796	EXPLORER.EXE
2796	EXPLORER.EXE

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4436	checker.exe
4436	checker.exe
4436	checker.exe
1816	explorer.exe
1816	explorer.exe
1816	explorer.exe
220	EXPLORER.EXE
220	EXPLORER.EXE
220	EXPLORER.EXE
1816	explorer.exe
1816	explorer.exe
1816	explorer.exe
4704	EXPLORER.EXE
4704	EXPLORER.EXE
4704	EXPLORER.EXE
1816	explorer.exe
1816	explorer.exe
1816	explorer.exe
4512	EXPLORER.EXE
4512	EXPLORER.EXE
4512	EXPLORER.EXE
1816	explorer.exe
1816	explorer.exe
1816	explorer.exe
1052	EXPLORER.EXE
1052	EXPLORER.EXE
1052	EXPLORER.EXE
1816	explorer.exe
1816	explorer.exe
1816	explorer.exe
3248	EXPLORER.EXE
3248	EXPLORER.EXE
3248	EXPLORER.EXE
1816	explorer.exe
1816	explorer.exe
1816	explorer.exe
1432	EXPLORER.EXE
1432	EXPLORER.EXE
1432	EXPLORER.EXE
1816	explorer.exe
1816	explorer.exe
1816	explorer.exe
752	EXPLORER.EXE
752	EXPLORER.EXE
752	EXPLORER.EXE
1816	explorer.exe
1816	explorer.exe
1816	explorer.exe
4284	EXPLORER.EXE
4284	EXPLORER.EXE
4284	EXPLORER.EXE
1816	explorer.exe
1816	explorer.exe
1816	explorer.exe
1924	EXPLORER.EXE
1924	EXPLORER.EXE
1924	EXPLORER.EXE
1816	explorer.exe
1816	explorer.exe
1816	explorer.exe
3896	EXPLORER.EXE
3896	EXPLORER.EXE
3896	EXPLORER.EXE
1816	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4836	2808	2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe	81
PID 2808 wrote to memory of 4436	2808	2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe	83
PID 4836 wrote to memory of 3204	4836	cmd.exe	84
PID 4436 wrote to memory of 4256	4436	checker.exe	86
PID 4436 wrote to memory of 1816	4436	checker.exe	87
PID 4256 wrote to memory of 3040	4256	cmd.exe	89
PID 4536 wrote to memory of 628	4536	cmd.exe	93
PID 1816 wrote to memory of 220	1816	explorer.exe	94
PID 1816 wrote to memory of 4704	1816	explorer.exe	98
PID 1816 wrote to memory of 4512	1816	explorer.exe	101
PID 1816 wrote to memory of 1052	1816	explorer.exe	104
PID 1816 wrote to memory of 3248	1816	explorer.exe	107
PID 1816 wrote to memory of 1432	1816	explorer.exe	110
PID 1816 wrote to memory of 752	1816	explorer.exe	113
PID 1816 wrote to memory of 4284	1816	explorer.exe	116
PID 1816 wrote to memory of 1924	1816	explorer.exe	119
PID 1816 wrote to memory of 3896	1816	explorer.exe	122
PID 1816 wrote to memory of 4756	1816	explorer.exe	125
PID 1816 wrote to memory of 1044	1816	explorer.exe	128
PID 1816 wrote to memory of 4496	1816	explorer.exe	131
PID 1816 wrote to memory of 4596	1816	explorer.exe	134
PID 1816 wrote to memory of 2796	1816	explorer.exe	137

C:\Users\Admin\AppData\Local\Temp\2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-09_6f79845f18e3ee694cfca390daa06263_amadey_darkgate_elex_redline-stealer_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\unlock'
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\unlock'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- C:\ProgramData\unlock\checker.exe
  "C:\ProgramData\unlock\checker.exe" {0E67860C-91DD-4F66-BF08-7D9AE29E6D49}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\unlock'
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\unlock'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3040
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Downloads MZ/PE file
    - Drops startup file
    - Adds Run key to start application
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:220
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1764
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5116
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3000
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1052
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4976
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3248
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2356
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1432
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3760
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:752
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:356
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3892
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1700
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4044
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4756
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4280
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1268
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1360
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4620
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {67B2D93C-73CA-45FD-84AC-243189D78382}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5064

C:\Windows\system32\cmd.exe
cmd /c start "" "C:\ProgramData\unlock\checker.exe" {BA47A81B-D0BA-4BE5-9B43-08840D30056C}
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\ProgramData\unlock\checker.exe
  "C:\ProgramData\unlock\checker.exe" {BA47A81B-D0BA-4BE5-9B43-08840D30056C}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

checker.exe

Path C:\ProgramData\unlock\checker.exe
Size 515KB
SHA256 567a7368b1da5e3c887a0e2610f505835f2e6861a2276fc674e68db38e6cb671
MD5 6f79845f18e3ee694cfca390daa06263
SHA1 fe87cb2b3a42f0897bdcd076d201b96afc1c1a42
SHA512 06392e6b9c3990d16f79a22a15a678de7bb1c2e43ab16a78a7be8719ad5232aa4b2fa9efc4affc5c0c68fafb9ea50ac796cabe312f4deaeb1346aeb826158245
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3WEc:eiGmrVmxuPnCXztWJ
TLSH
T19EB49E11E660D233D47650B4CBF9C323A928BE716B0058E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

DATABASE

Path C:\Users\Admin\AppData\Local\Temp\DATABASE
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RhQRpPcVda

Path C:\Users\Admin\AppData\Local\Temp\RhQRpPcVda
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TIKNBuSSjr

Path C:\Users\Admin\AppData\Local\Temp\TIKNBuSSjr
Size 32B
SHA256 8b08d7ff30a2e3966f0232c6dca431dadf8b9984fe3c7c3fb5dbf77774947e0e
MD5 6a41653c1ed1f54d6bed65b6cf92bb78
SHA1 0e3f6d6a08054432a657d7466cb1bd7bb9667d2a
SHA512 fdb65edb1adfedc2d40149072cbebcf76282c36f32c2715cdd1448bef87565367e5ad64ffedae79db9a9ad4ab8dc49d397acc09a66b7d2617d5999a310538860
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_washh1rb.l42.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_washh1rb.l42.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/220-84-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/220-83-0x00000000029C0000-0x0000000002ACA000-memory.dmp

Download

memory/220-63-0x00000000029C0000-0x0000000002ACA000-memory.dmp

Download

memory/220-69-0x00000000029C0000-0x0000000002ACA000-memory.dmp

Download

memory/220-61-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/220-85-0x0000000002C90000-0x0000000002CA2000-memory.dmp

Download

memory/628-62-0x0000000002800000-0x0000000002864000-memory.dmp

Download

memory/752-198-0x0000000002EC0000-0x0000000002FCA000-memory.dmp

Download

memory/752-192-0x0000000002EC0000-0x0000000002FCA000-memory.dmp

Download

memory/752-207-0x0000000002EC0000-0x0000000002FCA000-memory.dmp

Download

memory/1044-292-0x00000000010D0000-0x00000000011DA000-memory.dmp

Download

memory/1044-298-0x00000000010D0000-0x00000000011DA000-memory.dmp

Download

memory/1052-136-0x00000000024A0000-0x00000000025AA000-memory.dmp

Download

memory/1052-145-0x00000000024A0000-0x00000000025AA000-memory.dmp

Download

memory/1052-130-0x00000000024A0000-0x00000000025AA000-memory.dmp

Download

memory/1340-104-0x000001F8BC990000-0x000001F8BCA3F000-memory.dmp

Download

memory/1432-186-0x0000000002390000-0x000000000249A000-memory.dmp

Download

memory/1432-177-0x0000000002390000-0x000000000249A000-memory.dmp

Download

memory/1816-88-0x0000000002200000-0x0000000002212000-memory.dmp

Download

memory/1816-42-0x0000000001FC0000-0x0000000002032000-memory.dmp

Download

memory/1816-41-0x0000000001FC0000-0x0000000002032000-memory.dmp

Download

memory/1816-31-0x0000000001FC0000-0x0000000002032000-memory.dmp

Download

memory/1816-87-0x00000000020D0000-0x000000000217F000-memory.dmp

Download

memory/1816-30-0x0000000000170000-0x0000000000172000-memory.dmp

Download

memory/1924-247-0x00000000022E0000-0x00000000023EA000-memory.dmp

Download

memory/1924-238-0x00000000022E0000-0x00000000023EA000-memory.dmp

Download

memory/1924-232-0x00000000022E0000-0x00000000023EA000-memory.dmp

Download

memory/2028-246-0x000001E63F2B0000-0x000001E63F35F000-memory.dmp

Download

memory/2488-76-0x000001F54FAB0000-0x000001F54FB5F000-memory.dmp

Download

memory/2688-144-0x00000264D4F30000-0x00000264D4FDF000-memory.dmp

Download

memory/2808-4-0x0000000002B80000-0x0000000002BE4000-memory.dmp

Download

memory/2836-125-0x000001763DB80000-0x000001763DC2F000-memory.dmp

Download

memory/3000-281-0x0000021C867A0000-0x0000021C8684F000-memory.dmp

Download

memory/3040-80-0x0000017C26D50000-0x0000017C26D5C000-memory.dmp

Download

memory/3040-81-0x0000017C285D0000-0x0000017C2867F000-memory.dmp

Download

memory/3040-82-0x0000017C28710000-0x0000017C28722000-memory.dmp

Download

memory/3144-180-0x0000028F336B0000-0x0000028F3375F000-memory.dmp

Download

memory/3204-21-0x0000023C6A5B0000-0x0000023C6A5CC000-memory.dmp

Download

memory/3204-28-0x0000023C6A6E0000-0x0000023C6A6E6000-memory.dmp

Download

memory/3204-53-0x0000023C69F20000-0x0000023C69F32000-memory.dmp

Download

memory/3204-24-0x0000023C6A6C0000-0x0000023C6A6DC000-memory.dmp

Download

memory/3204-5-0x0000023C6A320000-0x0000023C6A330000-memory.dmp

Download

memory/3204-51-0x0000023C69D60000-0x0000023C69D6C000-memory.dmp

Download

memory/3204-23-0x0000023C6A690000-0x0000023C6A69A000-memory.dmp

Download

memory/3204-22-0x0000023C6A5D0000-0x0000023C6A683000-memory.dmp

Download

memory/3204-25-0x0000023C6A6A0000-0x0000023C6A6AA000-memory.dmp

Download

memory/3204-52-0x0000023C6A330000-0x0000023C6A3DF000-memory.dmp

Download

memory/3204-29-0x0000023C6A6F0000-0x0000023C6A6FA000-memory.dmp

Download

memory/3204-27-0x0000023C6A6B0000-0x0000023C6A6B8000-memory.dmp

Download

memory/3204-6-0x0000023C6A320000-0x0000023C6A330000-memory.dmp

Download

memory/3204-12-0x0000023C6A510000-0x0000023C6A532000-memory.dmp

Download

memory/3204-14-0x0000023C6A320000-0x0000023C6A330000-memory.dmp

Download

memory/3204-26-0x0000023C6A700000-0x0000023C6A71A000-memory.dmp

Download

memory/3248-150-0x0000000002390000-0x000000000249A000-memory.dmp

Download

memory/3248-156-0x0000000002390000-0x000000000249A000-memory.dmp

Download

memory/3248-165-0x0000000000310000-0x0000000000311000-memory.dmp

Download

memory/3248-166-0x0000000002390000-0x000000000249A000-memory.dmp

Download

memory/3688-200-0x00000299F66C0000-0x00000299F676F000-memory.dmp

Download

memory/3692-159-0x000001B583D70000-0x000001B583E1F000-memory.dmp

Download

memory/3896-252-0x0000000002EB0000-0x0000000002FBA000-memory.dmp

Download

memory/3896-267-0x0000000002EB0000-0x0000000002FBA000-memory.dmp

Download

memory/3896-258-0x0000000002EB0000-0x0000000002FBA000-memory.dmp

Download

memory/4284-218-0x00000000025D0000-0x00000000026DA000-memory.dmp

Download

memory/4284-226-0x00000000025D0000-0x00000000026DA000-memory.dmp

Download

memory/4284-212-0x00000000025D0000-0x00000000026DA000-memory.dmp

Download

memory/4436-86-0x0000000002300000-0x0000000002364000-memory.dmp

Download

memory/4512-110-0x0000000002860000-0x000000000296A000-memory.dmp

Download

memory/4512-124-0x0000000002860000-0x000000000296A000-memory.dmp

Download

memory/4512-116-0x0000000002860000-0x000000000296A000-memory.dmp

Download

memory/4628-261-0x00000253739E0000-0x0000025373A8F000-memory.dmp

Download

memory/4704-90-0x0000000002A50000-0x0000000002B5A000-memory.dmp

Download

memory/4704-96-0x0000000002A50000-0x0000000002B5A000-memory.dmp

Download

memory/4704-105-0x0000000002A50000-0x0000000002B5A000-memory.dmp

Download

memory/4756-272-0x00000000021B0000-0x00000000022BA000-memory.dmp

Download

memory/4756-278-0x00000000021B0000-0x00000000022BA000-memory.dmp

Download

memory/4756-287-0x00000000021B0000-0x00000000022BA000-memory.dmp

Download

memory/4856-227-0x000001F5F6F50000-0x000001F5F6FFF000-memory.dmp

Download