stealc | 98a0787160f52c10636796eb65d09747903c1d005a540b4e65e85d70ed793fef

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/03/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.2MB
Sample260320-kwpbfads2q
SHA256 98a0787160f52c10636796eb65d09747903c1d005a540b4e65e85d70ed793fef
MD5 4ef2b95427f8e1948fbe4941cd81e9e2
SHA1 d57d442c587541b9b96d527fb8af14cd47a9087f
SHA512 1f61a17a811a7a1f5b3b9fc9667ab0df22aca6a24a0708ed6fe289ad90b5cd2e8f27286050e29e8d6a6d86de1c7725466405bff93efec3fbfdab9ed1ba56e51a
SSDEEP 24576:Lp7sLAJG8/R+0gSve+j/g4BeAk61WXg+LcwKei/ardZUcHwdwwOGiWzAOhz4y:LpILAJxHgSvC4gAkrXZLcwKH/a3I1l0y
TLSH
T1E0B59E97ACC15175C466633689A262927B75F8488F3323D32F92AB382F77BC09E75704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

new defense_evasion discovery stealc spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

http://138.124.88.111

Attributes

url_path
/e73ec3d3cca2490cb90e.php

rc4.traffic_key

rc4.C2

Signatures

Detects Stealc stealer Version 2 16 IoCs

resource	yara_rule
behavioral1/memory/4740-5-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-11-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-13-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-12-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-10-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-9-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-8-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-6-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-4-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-3-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-2-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-1-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-0-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-16-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-54-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral1/memory/4740-55-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	4740	file.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
2356	PHXq2dwi2JJu.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2356 set thread context of 2412	2356	PHXq2dwi2JJu.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	file.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	file.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PHXq2dwi2JJu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	file.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\EE44782835D8FB31394DA5CEB840DC93849BCF5A	file.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\EE44782835D8FB31394DA5CEB840DC93849BCF5A\Blob = 030000000100000014000000ee44782835d8fb31394da5ceb840dc93849bcf5a14000000010000001400000000b529f22d8e6f31e89b4cad783efadce90cd1d2040000000100000010000000a3c02566a13ec3ea54cd797a4de7d26b0f0000000100000020000000d61d96ebfb3fa19096e2c002e3603bf7fdaaefb22704da8668062bbe86ed4b9319000000010000001000000069107b286189234a73889eb63614071f5c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000000a05000030820506308202eea003020102021100c212324b70a9b49171dc40f7e285263c300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3234303331333030303030305a170d3237303331323233353935395a3033310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310c300a0603550403130352313230820122300d06092a864886f70d01010105000382010f003082010a0282010100da982874adbe94fe3be01ee2e54b75ab2c127feda703327e3697ece8318fa5138d0b992e1ecd01513d4ce5286e095531aaa5225d72f42d07c24d403cdf0123b97837f51a653234e686719d04ef84085bbd021a99eba601009a73906d8fa207a0d097d3da456181353d14f9c4c05f6adc0b961ab09fe32aeabd2ad698c79b71ab3b740f3cdbb260be5a4b4e18e9db2a735c8961659efeed3ca6cb4e6fe49ef90046b3ff194d2a63b38e66c6188570c750656f3b74e548830f08585d2d239d5ea3fee8db00a1d2f4e3194df2ee7af6279ee5cd9c2da2f27f9c17adef133739d1b4c82c41d686c0e9ec21f8591b7fb93a7c9f5c019d6204c228bd0aad3cca10ec1b0203010001a381f83081f5300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e0416041400b529f22d8e6f31e89b4cad783efadce90cd1d2301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30130603551d20040c300a3008060667810c01020130270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f300d06092a864886f70d01010b050003820201008f75d009cf6a7648653292deb544c88576f415848c02bf76ebb3f1e2f96e84a85691e1924bf7e1ea0078488f7592e3e4467b1b602b20afa0ce14e5450d6ae05286a4f3da1414a9a95ff16d46f952501740e9e41e7de61558fea98bfceff59e63e066e2c3773b1f01872694ed4010dcb799ecdd57d35c7141ee30200004dc954b5028879992feaa8094b6060814f81c837e7440c5085a0c4f5cd1849dc4fddb59deee796e234d95f292d498296a5ceb02c142f0f8f54e64207ba8e331c4c06809478bd8b978a0ca4e4abe69242a4b377b51036b3a3f528bb3d4d2ad584e93eecb5f6f0d314948bac43f9f12c9203d11840785b4f8f23823ac710040e77f8d4634826a4ecfe00e635fba699a47091022fe4b48b7917554cb931ee416eb53cf7bde364dbff6b1ebe64ae9333c8d69a298bea87fa3ab5fb654e84d96a9acf3b05acb1b7a3693249bce5852809f350a5e2dbf749b6226179c9131290bf37fcdc3628b68c777f47f0bfbc659f503664ba6509bd0efa5fc02b4604d034b614fc520078b48b031f5b69cd1c9ad7718dcb2c70fbee04608dee04bdeb9b8b6c716be36693f86684b7481138950c56a7a02acc548a50e7d5d61e4cdd166a075c7055ee889b5631923bb50b490ecc275373e75a61b83252800214ec0d33acb9ceac08ff75fae51164610af0206eec0b657d40dac8cd8d7a0f3876ec3e2cbe94ed4a17cfd763b	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	file.exe
4740	file.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	AppLaunch.exe
Token: SeDebugPrivilege	2412	AppLaunch.exe
Token: SeDebugPrivilege	2412	AppLaunch.exe
Token: SeDebugPrivilege	2412	AppLaunch.exe
Token: SeDebugPrivilege	2412	AppLaunch.exe
Token: SeDebugPrivilege	2412	AppLaunch.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4836	4740	file.exe	84
PID 4740 wrote to memory of 4836	4740	file.exe	84
PID 4740 wrote to memory of 5116	4740	file.exe	89
PID 4740 wrote to memory of 5116	4740	file.exe	89
PID 4740 wrote to memory of 2356	4740	file.exe	94
PID 2356 wrote to memory of 2412	2356	PHXq2dwi2JJu.exe	96
PID 2356 wrote to memory of 2412	2356	PHXq2dwi2JJu.exe	96
PID 2356 wrote to memory of 2412	2356	PHXq2dwi2JJu.exe	96
PID 2356 wrote to memory of 2412	2356	PHXq2dwi2JJu.exe	96
PID 2356 wrote to memory of 2412	2356	PHXq2dwi2JJu.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5116
- C:\Users\Admin\AppData\Local\PHXq2dwi2JJu.exe
  "C:\Users\Admin\AppData\Local\PHXq2dwi2JJu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

87C99EE8-16A7-D8DC-2330-BFE47BF8576C.txt

Path C:\ProgramData\87C99EE8-16A7-D8DC-2330-BFE47BF8576C.txt
Size 64B
SHA256 dafef9c00e091697eca3722677dda5f90272351132072bee4890810fd1658806
MD5 af0aa1775e414fc067a06543d5db37c3
SHA1 b8024c256f59f8e53d2187da75bc3fed8f40992e
SHA512 0d8780064b9a55273a4cda780c40df50f1b5c58cb002d93201153d6b59fa85ccf2570b417a1286cb45362ca94fb1ef081b9558074c133c0b3667b531a3087490
TLSH
T125A022BB38EB0280B083003800C83CA2A0C20020283BC00220300ACECC332002000088
MD5 SHA1 SHA512 TLSH

Submit Download

87C99EE8-16A7-D8DC-2330-BFE47BF8576C.txt

Path C:\ProgramData\87C99EE8-16A7-D8DC-2330-BFE47BF8576C.txt
Size 64B
SHA256 ae8ab3e57d427a8588502712366fb052e57e3f01f5bb92887e646c20335a8079
MD5 4f945e826431507d1ba8cd580e145f3f
SHA1 03ccc667e0a8dba617b217b8e6e92b5349091059
SHA512 867368fd97ece85e489b3354c1e4764262f2361b38de6eabe224c90ac5091f27a663ce20b14d02a040bc091293328905562935c090da30f6dd1c617c402151dc
TLSH
T19FA002630D8B214E0CDFF41A5A53652B95255711EF62011C55C59797F4556345708A21
MD5 SHA1 SHA512 TLSH

Submit Download

PHXq2dwi2JJu.exe

Path C:\Users\Admin\AppData\Local\PHXq2dwi2JJu.exe
Size 1.5MB
SHA256 04a40d87d287ccd0cc5de7776d6651fbd312c221835403efc58286eca3691b96
MD5 bdbf69bd6b1de32387b5dd88c9f3b0dc
SHA1 4ad9c07c8f735b0e56a0e509e910eb0cd1dc5853
SHA512 d9ca5533e87994dc80810f77f1df3d30e24de29cabb40e7b3e70bfc74542da25080933b5fa460d7700d0bf72258c4d55f4f8cb4a81594a43148ecdcffd38f0ba
SSDEEP 24576:ZOCD6KkTklQvLOhbfi1NaQboVEGckoveD0SEKYS3QZNFhdAgBGrQCcTHJCDrth6P:ZjVpK/7WgZNFhdraQC+p+aP
TLSH
T117652940FDC754F6E402173659B762BF6734A9090B36AB87EB847B7DF976291083230A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2412-57-0x0000000002A40000-0x0000000002A4A000-memory.dmp

Download

memory/2412-56-0x00000000058F0000-0x0000000005956000-memory.dmp

Download

memory/2412-50-0x0000000000790000-0x00000000007C0000-memory.dmp

Download

memory/4740-9-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-8-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-4-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-3-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-2-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-1-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-0-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-6-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-16-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-5-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-10-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-12-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-54-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-55-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-13-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4740-11-0x0000000140000000-0x00000001400D3000-memory.dmp

Download