darkvision | ee7029065bb46ab3e8eac459002386eff078de2f31aa51f21b3cb73d8b8ba446

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/03/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
Size 511KB
Sample260319-dvp31sf14x
SHA256 ee7029065bb46ab3e8eac459002386eff078de2f31aa51f21b3cb73d8b8ba446
MD5 8700ee98a03364747c1e63c54e2ffc17
SHA1 61343ffa09b49703d662ac99428541e89104978b
SHA512 a072e560f4eaa67df67074acb3e8828405a093ac37ca41cc238cb8381fd1f614597eb15331ff719f67e08ecc21bd1055c12e8212011f5efe79a43b3a700e30dd
SSDEEP 12288:jgRtI9FsQBmrCYmxuPY98Cmm1JwaIC3Wu:jiGmrVmxuPnCXztW
TLSH
T163B4AE11E660D233D47650B4CBF9C327A928BE716B0018E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darkvision rat

Malware Config

Extracted

Family

darkvision

45.144.212.53

Attributes

url
https://jefkad.com/nc_assets/fonts/Verify/PASSWORDRECOVERY32EXE.EXE

https://jefkad.com/nc_assets/fonts/Verify/PASSWORDRECOVERY64EXE.EXE

https://jefkad.com/nc_assets/fonts/Verify/upload.php
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 4 IoCs

resource	yara_rule
behavioral2/memory/4928-2-0x00000000029F0000-0x0000000002A62000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4928-11-0x00000000029F0000-0x0000000002A62000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4928-10-0x00000000029F0000-0x0000000002A62000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4928-9-0x00000000029F0000-0x0000000002A62000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 42 IoCs

resource	yara_rule
behavioral2/memory/4620-13-0x0000000002E00000-0x0000000002F0A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4620-19-0x0000000002E00000-0x0000000002F0A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4620-28-0x0000000002E00000-0x0000000002F0A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3732-32-0x0000000002610000-0x000000000271A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3732-38-0x0000000002610000-0x000000000271A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3732-46-0x0000000002610000-0x000000000271A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3324-49-0x00000000026B0000-0x00000000027BA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3324-55-0x00000000026B0000-0x00000000027BA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3324-63-0x00000000026B0000-0x00000000027BA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-66-0x0000000002C10000-0x0000000002D1A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-72-0x0000000002C10000-0x0000000002D1A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-80-0x0000000002C10000-0x0000000002D1A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3740-83-0x00000000029A0000-0x0000000002AAA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3740-89-0x00000000029A0000-0x0000000002AAA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3740-98-0x00000000029A0000-0x0000000002AAA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1868-101-0x0000000002270000-0x000000000237A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1868-107-0x0000000002270000-0x000000000237A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1868-116-0x0000000002270000-0x000000000237A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3148-119-0x0000000002160000-0x000000000226A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3148-125-0x0000000002160000-0x000000000226A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3148-133-0x0000000002160000-0x000000000226A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2180-136-0x00000000028A0000-0x00000000029AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2180-142-0x00000000028A0000-0x00000000029AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2180-150-0x00000000028A0000-0x00000000029AA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5536-153-0x0000000002770000-0x000000000287A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5536-159-0x0000000002770000-0x000000000287A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5536-167-0x0000000002770000-0x000000000287A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4144-170-0x0000000002DA0000-0x0000000002EAA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4144-176-0x0000000002DA0000-0x0000000002EAA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4144-184-0x0000000002DA0000-0x0000000002EAA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1972-187-0x0000000002430000-0x000000000253A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1972-193-0x0000000002430000-0x000000000253A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1972-201-0x0000000002430000-0x000000000253A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3016-204-0x0000000002540000-0x000000000264A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3016-210-0x0000000002540000-0x000000000264A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3016-218-0x0000000002540000-0x000000000264A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3848-221-0x0000000002BF0000-0x0000000002CFA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3848-227-0x0000000002BF0000-0x0000000002CFA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3848-235-0x0000000002BF0000-0x0000000002CFA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5856-238-0x0000000000FC0000-0x00000000010CA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5856-244-0x0000000000FC0000-0x00000000010CA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5856-252-0x0000000000FC0000-0x00000000010CA000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	4928	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4620	EXPLORER.EXE
4620	EXPLORER.EXE
3732	EXPLORER.EXE
3732	EXPLORER.EXE
3324	EXPLORER.EXE
3324	EXPLORER.EXE
1512	EXPLORER.EXE
1512	EXPLORER.EXE
3740	EXPLORER.EXE
3740	EXPLORER.EXE
1868	EXPLORER.EXE
1868	EXPLORER.EXE
3148	EXPLORER.EXE
3148	EXPLORER.EXE
2180	EXPLORER.EXE
2180	EXPLORER.EXE
5536	EXPLORER.EXE
5536	EXPLORER.EXE
4144	EXPLORER.EXE
4144	EXPLORER.EXE
1972	EXPLORER.EXE
1972	EXPLORER.EXE
3016	EXPLORER.EXE
3016	EXPLORER.EXE
3848	EXPLORER.EXE
3848	EXPLORER.EXE
5856	EXPLORER.EXE
5856	EXPLORER.EXE

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3612	2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
3612	2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
3612	2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4620	EXPLORER.EXE
4620	EXPLORER.EXE
4620	EXPLORER.EXE
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
3732	EXPLORER.EXE
3732	EXPLORER.EXE
3732	EXPLORER.EXE
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
3324	EXPLORER.EXE
3324	EXPLORER.EXE
3324	EXPLORER.EXE
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
1512	EXPLORER.EXE
1512	EXPLORER.EXE
1512	EXPLORER.EXE
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
3740	EXPLORER.EXE
3740	EXPLORER.EXE
3740	EXPLORER.EXE
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
1868	EXPLORER.EXE
1868	EXPLORER.EXE
1868	EXPLORER.EXE
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
3148	EXPLORER.EXE
3148	EXPLORER.EXE
3148	EXPLORER.EXE
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
2180	EXPLORER.EXE
2180	EXPLORER.EXE
2180	EXPLORER.EXE
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
5536	EXPLORER.EXE
5536	EXPLORER.EXE
5536	EXPLORER.EXE
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4144	EXPLORER.EXE
4144	EXPLORER.EXE
4144	EXPLORER.EXE
4928	explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 4928	3612	2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe	78
PID 4928 wrote to memory of 4620	4928	explorer.exe	79
PID 4928 wrote to memory of 3732	4928	explorer.exe	83
PID 4928 wrote to memory of 3324	4928	explorer.exe	86
PID 4928 wrote to memory of 1512	4928	explorer.exe	89
PID 4928 wrote to memory of 3740	4928	explorer.exe	92
PID 4928 wrote to memory of 1868	4928	explorer.exe	95
PID 4928 wrote to memory of 3148	4928	explorer.exe	98
PID 4928 wrote to memory of 2180	4928	explorer.exe	101
PID 4928 wrote to memory of 5536	4928	explorer.exe	104
PID 4928 wrote to memory of 4144	4928	explorer.exe	107
PID 4928 wrote to memory of 1972	4928	explorer.exe	110
PID 4928 wrote to memory of 3016	4928	explorer.exe	113
PID 4928 wrote to memory of 3848	4928	explorer.exe	116
PID 4928 wrote to memory of 5856	4928	explorer.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-19_8700ee98a03364747c1e63c54e2ffc17_amadey_darkgate_elex_redline-stealer_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:6012
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5624
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1696
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1652
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4976
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3240
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4156
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4480
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:5536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2852
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2012
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4332
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2232
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2880
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {2ADDEF51-9057-41C2-AFFF-0EB6741E1E2C}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DATABASE

Path C:\Users\Admin\AppData\Local\Temp\DATABASE
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gsoiydZSro

Path C:\Users\Admin\AppData\Local\Temp\gsoiydZSro
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oQvgcywYdX

Path C:\Users\Admin\AppData\Local\Temp\oQvgcywYdX
Size 32B
SHA256 b636f2d86b60b14af9c0e6411265ec894a44bf9c6dae1872653253b6b4ce87bc
MD5 7f8fb92bce96a4c0844713fe86107cfd
SHA1 97e64df352a309a03285df1793d41dccab459d43
SHA512 825504a91d7d9124244276c6db7248a6de3da7a61e282218340abc6b1fe28fc8907a48b72151c178b8542dc869ae5004c045d88479653f31d20e0624e4da705f
MD5 SHA1 SHA512

Submit Download

memory/1512-80-0x0000000002C10000-0x0000000002D1A000-memory.dmp

Download

memory/1512-72-0x0000000002C10000-0x0000000002D1A000-memory.dmp

Download

memory/1512-66-0x0000000002C10000-0x0000000002D1A000-memory.dmp

Download

memory/1868-116-0x0000000002270000-0x000000000237A000-memory.dmp

Download

memory/1868-107-0x0000000002270000-0x000000000237A000-memory.dmp

Download

memory/1868-101-0x0000000002270000-0x000000000237A000-memory.dmp

Download

memory/1972-193-0x0000000002430000-0x000000000253A000-memory.dmp

Download

memory/1972-187-0x0000000002430000-0x000000000253A000-memory.dmp

Download

memory/1972-201-0x0000000002430000-0x000000000253A000-memory.dmp

Download

memory/2180-142-0x00000000028A0000-0x00000000029AA000-memory.dmp

Download

memory/2180-136-0x00000000028A0000-0x00000000029AA000-memory.dmp

Download

memory/2180-150-0x00000000028A0000-0x00000000029AA000-memory.dmp

Download

memory/3016-218-0x0000000002540000-0x000000000264A000-memory.dmp

Download

memory/3016-204-0x0000000002540000-0x000000000264A000-memory.dmp

Download

memory/3016-210-0x0000000002540000-0x000000000264A000-memory.dmp

Download

memory/3148-125-0x0000000002160000-0x000000000226A000-memory.dmp

Download

memory/3148-133-0x0000000002160000-0x000000000226A000-memory.dmp

Download

memory/3148-119-0x0000000002160000-0x000000000226A000-memory.dmp

Download

memory/3324-49-0x00000000026B0000-0x00000000027BA000-memory.dmp

Download

memory/3324-55-0x00000000026B0000-0x00000000027BA000-memory.dmp

Download

memory/3324-63-0x00000000026B0000-0x00000000027BA000-memory.dmp

Download

memory/3612-0-0x0000000000D74000-0x0000000000D75000-memory.dmp

Download

memory/3732-38-0x0000000002610000-0x000000000271A000-memory.dmp

Download

memory/3732-46-0x0000000002610000-0x000000000271A000-memory.dmp

Download

memory/3732-32-0x0000000002610000-0x000000000271A000-memory.dmp

Download

memory/3740-83-0x00000000029A0000-0x0000000002AAA000-memory.dmp

Download

memory/3740-89-0x00000000029A0000-0x0000000002AAA000-memory.dmp

Download

memory/3740-98-0x00000000029A0000-0x0000000002AAA000-memory.dmp

Download

memory/3848-221-0x0000000002BF0000-0x0000000002CFA000-memory.dmp

Download

memory/3848-227-0x0000000002BF0000-0x0000000002CFA000-memory.dmp

Download

memory/3848-235-0x0000000002BF0000-0x0000000002CFA000-memory.dmp

Download

memory/4144-176-0x0000000002DA0000-0x0000000002EAA000-memory.dmp

Download

memory/4144-170-0x0000000002DA0000-0x0000000002EAA000-memory.dmp

Download

memory/4144-184-0x0000000002DA0000-0x0000000002EAA000-memory.dmp

Download

memory/4620-19-0x0000000002E00000-0x0000000002F0A000-memory.dmp

Download

memory/4620-29-0x00000000035B0000-0x00000000035C2000-memory.dmp

Download

memory/4620-28-0x0000000002E00000-0x0000000002F0A000-memory.dmp

Download

memory/4620-12-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/4620-13-0x0000000002E00000-0x0000000002F0A000-memory.dmp

Download

memory/4620-20-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/4620-27-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/4928-11-0x00000000029F0000-0x0000000002A62000-memory.dmp

Download

memory/4928-9-0x00000000029F0000-0x0000000002A62000-memory.dmp

Download

memory/4928-10-0x00000000029F0000-0x0000000002A62000-memory.dmp

Download

memory/4928-30-0x0000000003130000-0x0000000003142000-memory.dmp

Download

memory/4928-2-0x00000000029F0000-0x0000000002A62000-memory.dmp

Download

memory/4928-1-0x0000000000B40000-0x0000000000B42000-memory.dmp

Download

memory/5536-167-0x0000000002770000-0x000000000287A000-memory.dmp

Download

memory/5536-159-0x0000000002770000-0x000000000287A000-memory.dmp

Download

memory/5536-153-0x0000000002770000-0x000000000287A000-memory.dmp

Download

memory/5856-238-0x0000000000FC0000-0x00000000010CA000-memory.dmp

Download

memory/5856-244-0x0000000000FC0000-0x00000000010CA000-memory.dmp

Download

memory/5856-252-0x0000000000FC0000-0x00000000010CA000-memory.dmp

Download