darkvision | ee7029065bb46ab3e8eac459002386eff078de2f31aa51f21b3cb73d8b8ba446

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/03/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
Size 511KB
Sample260319-dvp31sf14x
SHA256 ee7029065bb46ab3e8eac459002386eff078de2f31aa51f21b3cb73d8b8ba446
MD5 8700ee98a03364747c1e63c54e2ffc17
SHA1 61343ffa09b49703d662ac99428541e89104978b
SHA512 a072e560f4eaa67df67074acb3e8828405a093ac37ca41cc238cb8381fd1f614597eb15331ff719f67e08ecc21bd1055c12e8212011f5efe79a43b3a700e30dd
SSDEEP 12288:jgRtI9FsQBmrCYmxuPY98Cmm1JwaIC3Wu:jiGmrVmxuPnCXztW
TLSH
T163B4AE11E660D233D47650B4CBF9C327A928BE716B0018E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darkvision rat

Malware Config

Extracted

Family

darkvision

45.144.212.53

Attributes

url
https://jefkad.com/nc_assets/fonts/Verify/PASSWORDRECOVERY32EXE.EXE

https://jefkad.com/nc_assets/fonts/Verify/PASSWORDRECOVERY64EXE.EXE

https://jefkad.com/nc_assets/fonts/Verify/upload.php
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 4 IoCs

resource	yara_rule
behavioral1/memory/4248-11-0x0000000001610000-0x0000000001682000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4248-10-0x0000000001610000-0x0000000001682000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4248-9-0x0000000001610000-0x0000000001682000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4248-2-0x0000000001610000-0x0000000001682000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 41 IoCs

resource	yara_rule
behavioral1/memory/4080-15-0x0000000000F10000-0x000000000101A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4080-21-0x0000000000F10000-0x000000000101A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4080-31-0x0000000000F10000-0x000000000101A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4884-37-0x0000000002AD0000-0x0000000002BDA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4884-43-0x0000000002AD0000-0x0000000002BDA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4884-52-0x0000000002AD0000-0x0000000002BDA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1808-57-0x0000000002410000-0x000000000251A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1808-63-0x0000000002410000-0x000000000251A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1808-72-0x0000000002410000-0x000000000251A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4472-77-0x0000000002100000-0x000000000220A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4472-83-0x0000000002100000-0x000000000220A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4472-91-0x0000000002100000-0x000000000220A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3224-97-0x0000000002DC0000-0x0000000002ECA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3224-103-0x0000000002DC0000-0x0000000002ECA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3224-111-0x0000000002DC0000-0x0000000002ECA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1284-117-0x00000000022A0000-0x00000000023AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1284-123-0x00000000022A0000-0x00000000023AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1284-131-0x00000000022A0000-0x00000000023AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3368-138-0x0000000002460000-0x000000000256A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3368-143-0x0000000002460000-0x000000000256A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3368-152-0x0000000002460000-0x000000000256A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4704-157-0x00000000021E0000-0x00000000022EA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4704-163-0x00000000021E0000-0x00000000022EA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4704-171-0x00000000021E0000-0x00000000022EA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1908-183-0x0000000002EC0000-0x0000000002FCA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1908-177-0x0000000002EC0000-0x0000000002FCA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1908-191-0x0000000002EC0000-0x0000000002FCA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/212-198-0x00000000022B0000-0x00000000023BA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/212-203-0x00000000022B0000-0x00000000023BA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/212-211-0x00000000022B0000-0x00000000023BA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4368-218-0x0000000002F00000-0x000000000300A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4368-223-0x0000000002F00000-0x000000000300A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4368-231-0x0000000002F00000-0x000000000300A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/628-237-0x0000000002A40000-0x0000000002B4A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/628-243-0x0000000002A40000-0x0000000002B4A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/628-251-0x0000000002A40000-0x0000000002B4A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3264-257-0x0000000001440000-0x000000000154A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3264-263-0x0000000001440000-0x000000000154A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3264-271-0x0000000001440000-0x000000000154A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2856-278-0x0000000002D40000-0x0000000002E4A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2856-283-0x0000000002D40000-0x0000000002E4A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	4248	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4080	EXPLORER.EXE
4080	EXPLORER.EXE
4884	EXPLORER.EXE
4884	EXPLORER.EXE
1808	EXPLORER.EXE
1808	EXPLORER.EXE
4472	EXPLORER.EXE
4472	EXPLORER.EXE
3224	EXPLORER.EXE
3224	EXPLORER.EXE
1284	EXPLORER.EXE
1284	EXPLORER.EXE
3368	EXPLORER.EXE
3368	EXPLORER.EXE
4704	EXPLORER.EXE
4704	EXPLORER.EXE
1908	EXPLORER.EXE
1908	EXPLORER.EXE
212	EXPLORER.EXE
212	EXPLORER.EXE
4368	EXPLORER.EXE
4368	EXPLORER.EXE
628	EXPLORER.EXE
628	EXPLORER.EXE
3264	EXPLORER.EXE
3264	EXPLORER.EXE
2856	EXPLORER.EXE
2856	EXPLORER.EXE

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3336	2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
3336	2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
3336	2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4080	EXPLORER.EXE
4080	EXPLORER.EXE
4080	EXPLORER.EXE
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4884	EXPLORER.EXE
4884	EXPLORER.EXE
4884	EXPLORER.EXE
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
1808	EXPLORER.EXE
1808	EXPLORER.EXE
1808	EXPLORER.EXE
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4472	EXPLORER.EXE
4472	EXPLORER.EXE
4472	EXPLORER.EXE
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
3224	EXPLORER.EXE
3224	EXPLORER.EXE
3224	EXPLORER.EXE
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
1284	EXPLORER.EXE
1284	EXPLORER.EXE
1284	EXPLORER.EXE
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
3368	EXPLORER.EXE
3368	EXPLORER.EXE
3368	EXPLORER.EXE
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4704	EXPLORER.EXE
4704	EXPLORER.EXE
4704	EXPLORER.EXE
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
1908	EXPLORER.EXE
1908	EXPLORER.EXE
1908	EXPLORER.EXE
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
212	EXPLORER.EXE
212	EXPLORER.EXE
212	EXPLORER.EXE
4248	explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4248	3336	2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe	83
PID 4248 wrote to memory of 4080	4248	explorer.exe	88
PID 4248 wrote to memory of 4884	4248	explorer.exe	95
PID 4248 wrote to memory of 1808	4248	explorer.exe	99
PID 4248 wrote to memory of 4472	4248	explorer.exe	103
PID 4248 wrote to memory of 3224	4248	explorer.exe	106
PID 4248 wrote to memory of 1284	4248	explorer.exe	109
PID 4248 wrote to memory of 3368	4248	explorer.exe	112
PID 4248 wrote to memory of 4704	4248	explorer.exe	115
PID 4248 wrote to memory of 1908	4248	explorer.exe	118
PID 4248 wrote to memory of 212	4248	explorer.exe	121
PID 4248 wrote to memory of 4368	4248	explorer.exe	124
PID 4248 wrote to memory of 628	4248	explorer.exe	127
PID 4248 wrote to memory of 3264	4248	explorer.exe	130
PID 4248 wrote to memory of 2856	4248	explorer.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3440
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3248
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4276
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2616
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3500
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4640
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5084
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3992
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4812
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1656
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2528
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3732
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1724
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DATABASE

Path C:\Users\Admin\AppData\Local\Temp\DATABASE
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EJidALrmVc

Path C:\Users\Admin\AppData\Local\Temp\EJidALrmVc
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pMIWcrdcpA

Path C:\Users\Admin\AppData\Local\Temp\pMIWcrdcpA
Size 32B
SHA256 e221c7b9879593bf10b5c1b9460b3c2f70fa3a40c27d214f02f7c21a5c6f1267
MD5 71d0c06c9b5f75252525df6b7da5e2d9
SHA1 fcc4398cd5cf804eecbf8b94a38c0b7e5bfabd4b
SHA512 92bdc49d602d35ec0fdff73ee3408d528d4e4117fd5cd2092ea79afdae9710a05fe63fa9cccfd109624468115082284f54a261d707c982941d67c483b6f09071
MD5 SHA1 SHA512

Submit Download

memory/212-211-0x00000000022B0000-0x00000000023BA000-memory.dmp

Download

memory/212-213-0x0000000000320000-0x000000000032C000-memory.dmp

Download

memory/212-203-0x00000000022B0000-0x00000000023BA000-memory.dmp

Download

memory/212-198-0x00000000022B0000-0x00000000023BA000-memory.dmp

Download

memory/628-253-0x00000000009C0000-0x00000000009CC000-memory.dmp

Download

memory/628-251-0x0000000002A40000-0x0000000002B4A000-memory.dmp

Download

memory/628-243-0x0000000002A40000-0x0000000002B4A000-memory.dmp

Download

memory/628-237-0x0000000002A40000-0x0000000002B4A000-memory.dmp

Download

memory/1284-123-0x00000000022A0000-0x00000000023AA000-memory.dmp

Download

memory/1284-117-0x00000000022A0000-0x00000000023AA000-memory.dmp

Download

memory/1284-131-0x00000000022A0000-0x00000000023AA000-memory.dmp

Download

memory/1284-133-0x0000000000350000-0x000000000035C000-memory.dmp

Download

memory/1808-63-0x0000000002410000-0x000000000251A000-memory.dmp

Download

memory/1808-57-0x0000000002410000-0x000000000251A000-memory.dmp

Download

memory/1808-72-0x0000000002410000-0x000000000251A000-memory.dmp

Download

memory/1808-73-0x00000000003E0000-0x00000000003EC000-memory.dmp

Download

memory/1908-183-0x0000000002EC0000-0x0000000002FCA000-memory.dmp

Download

memory/1908-193-0x0000000000F60000-0x0000000000F6C000-memory.dmp

Download

memory/1908-177-0x0000000002EC0000-0x0000000002FCA000-memory.dmp

Download

memory/1908-191-0x0000000002EC0000-0x0000000002FCA000-memory.dmp

Download

memory/2856-283-0x0000000002D40000-0x0000000002E4A000-memory.dmp

Download

memory/2856-278-0x0000000002D40000-0x0000000002E4A000-memory.dmp

Download

memory/3224-113-0x0000000000D50000-0x0000000000D5C000-memory.dmp

Download

memory/3224-103-0x0000000002DC0000-0x0000000002ECA000-memory.dmp

Download

memory/3224-111-0x0000000002DC0000-0x0000000002ECA000-memory.dmp

Download

memory/3224-97-0x0000000002DC0000-0x0000000002ECA000-memory.dmp

Download

memory/3264-257-0x0000000001440000-0x000000000154A000-memory.dmp

Download

memory/3264-271-0x0000000001440000-0x000000000154A000-memory.dmp

Download

memory/3264-273-0x0000000000E30000-0x0000000000E3C000-memory.dmp

Download

memory/3264-263-0x0000000001440000-0x000000000154A000-memory.dmp

Download

memory/3336-13-0x0000000002A40000-0x0000000002AC7000-memory.dmp

Download

memory/3336-0-0x0000000000844000-0x0000000000845000-memory.dmp

Download

memory/3368-138-0x0000000002460000-0x000000000256A000-memory.dmp

Download

memory/3368-143-0x0000000002460000-0x000000000256A000-memory.dmp

Download

memory/3368-153-0x0000000000530000-0x000000000053C000-memory.dmp

Download

memory/3368-152-0x0000000002460000-0x000000000256A000-memory.dmp

Download

memory/4080-14-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/4080-15-0x0000000000F10000-0x000000000101A000-memory.dmp

Download

memory/4080-21-0x0000000000F10000-0x000000000101A000-memory.dmp

Download

memory/4080-32-0x00000000007F0000-0x00000000007F2000-memory.dmp

Download

memory/4080-33-0x00000000007E0000-0x00000000007EC000-memory.dmp

Download

memory/4080-31-0x0000000000F10000-0x000000000101A000-memory.dmp

Download

memory/4248-10-0x0000000001610000-0x0000000001682000-memory.dmp

Download

memory/4248-2-0x0000000001610000-0x0000000001682000-memory.dmp

Download

memory/4248-9-0x0000000001610000-0x0000000001682000-memory.dmp

Download

memory/4248-11-0x0000000001610000-0x0000000001682000-memory.dmp

Download

memory/4248-30-0x0000000003460000-0x0000000003575000-memory.dmp

Download

memory/4248-29-0x0000000001690000-0x000000000169C000-memory.dmp

Download

memory/4248-28-0x0000000000F90000-0x0000000000F92000-memory.dmp

Download

memory/4248-1-0x0000000000F90000-0x0000000000F92000-memory.dmp

Download

memory/4248-12-0x0000000000F90000-0x0000000000F92000-memory.dmp

Download

memory/4368-231-0x0000000002F00000-0x000000000300A000-memory.dmp

Download

memory/4368-218-0x0000000002F00000-0x000000000300A000-memory.dmp

Download

memory/4368-223-0x0000000002F00000-0x000000000300A000-memory.dmp

Download

memory/4368-233-0x0000000001200000-0x000000000120C000-memory.dmp

Download

memory/4472-93-0x00000000001C0000-0x00000000001CC000-memory.dmp

Download

memory/4472-77-0x0000000002100000-0x000000000220A000-memory.dmp

Download

memory/4472-83-0x0000000002100000-0x000000000220A000-memory.dmp

Download

memory/4472-91-0x0000000002100000-0x000000000220A000-memory.dmp

Download

memory/4704-163-0x00000000021E0000-0x00000000022EA000-memory.dmp

Download

memory/4704-157-0x00000000021E0000-0x00000000022EA000-memory.dmp

Download

memory/4704-173-0x0000000000430000-0x000000000043C000-memory.dmp

Download

memory/4704-171-0x00000000021E0000-0x00000000022EA000-memory.dmp

Download

memory/4884-37-0x0000000002AD0000-0x0000000002BDA000-memory.dmp

Download

memory/4884-43-0x0000000002AD0000-0x0000000002BDA000-memory.dmp

Download

memory/4884-52-0x0000000002AD0000-0x0000000002BDA000-memory.dmp

Download

memory/4884-53-0x0000000000B40000-0x0000000000B4C000-memory.dmp

Download