stealc | 98a0787160f52c10636796eb65d09747903c1d005a540b4e65e85d70ed793fef

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/03/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.2MB
Sample260320-kwpbfads2q
SHA256 98a0787160f52c10636796eb65d09747903c1d005a540b4e65e85d70ed793fef
MD5 4ef2b95427f8e1948fbe4941cd81e9e2
SHA1 d57d442c587541b9b96d527fb8af14cd47a9087f
SHA512 1f61a17a811a7a1f5b3b9fc9667ab0df22aca6a24a0708ed6fe289ad90b5cd2e8f27286050e29e8d6a6d86de1c7725466405bff93efec3fbfdab9ed1ba56e51a
SSDEEP 24576:Lp7sLAJG8/R+0gSve+j/g4BeAk61WXg+LcwKei/ardZUcHwdwwOGiWzAOhz4y:LpILAJxHgSvC4gAkrXZLcwKH/a3I1l0y
TLSH
T1E0B59E97ACC15175C466633689A262927B75F8488F3323D32F92AB382F77BC09E75704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

new defense_evasion discovery stealc spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

http://138.124.88.111

Attributes

url_path
/e73ec3d3cca2490cb90e.php

rc4.traffic_key

rc4.C2

Signatures

Detects Stealc stealer Version 2 17 IoCs

resource	yara_rule
behavioral2/memory/4700-6-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-12-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-13-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-10-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-11-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-9-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-8-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-7-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-5-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-4-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-2-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-1-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-0-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-18-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-26-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-62-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2
behavioral2/memory/4700-64-0x0000000140000000-0x00000001400D3000-memory.dmp	family_stealc_v2

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Executes dropped EXE 1 IoCs

pid	Process
2756	G11VJAFGAi8V.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 2184	2756	G11VJAFGAi8V.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	file.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	file.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2184	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G11VJAFGAi8V.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	file.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\SystemCertificates\CA\Certificates\EE44782835D8FB31394DA5CEB840DC93849BCF5A	file.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\SystemCertificates\CA\Certificates\EE44782835D8FB31394DA5CEB840DC93849BCF5A\Blob = 030000000100000014000000ee44782835d8fb31394da5ceb840dc93849bcf5a14000000010000001400000000b529f22d8e6f31e89b4cad783efadce90cd1d2040000000100000010000000a3c02566a13ec3ea54cd797a4de7d26b0f0000000100000020000000d61d96ebfb3fa19096e2c002e3603bf7fdaaefb22704da8668062bbe86ed4b9319000000010000001000000069107b286189234a73889eb63614071f5c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000000a05000030820506308202eea003020102021100c212324b70a9b49171dc40f7e285263c300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3234303331333030303030305a170d3237303331323233353935395a3033310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310c300a0603550403130352313230820122300d06092a864886f70d01010105000382010f003082010a0282010100da982874adbe94fe3be01ee2e54b75ab2c127feda703327e3697ece8318fa5138d0b992e1ecd01513d4ce5286e095531aaa5225d72f42d07c24d403cdf0123b97837f51a653234e686719d04ef84085bbd021a99eba601009a73906d8fa207a0d097d3da456181353d14f9c4c05f6adc0b961ab09fe32aeabd2ad698c79b71ab3b740f3cdbb260be5a4b4e18e9db2a735c8961659efeed3ca6cb4e6fe49ef90046b3ff194d2a63b38e66c6188570c750656f3b74e548830f08585d2d239d5ea3fee8db00a1d2f4e3194df2ee7af6279ee5cd9c2da2f27f9c17adef133739d1b4c82c41d686c0e9ec21f8591b7fb93a7c9f5c019d6204c228bd0aad3cca10ec1b0203010001a381f83081f5300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e0416041400b529f22d8e6f31e89b4cad783efadce90cd1d2301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30130603551d20040c300a3008060667810c01020130270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f300d06092a864886f70d01010b050003820201008f75d009cf6a7648653292deb544c88576f415848c02bf76ebb3f1e2f96e84a85691e1924bf7e1ea0078488f7592e3e4467b1b602b20afa0ce14e5450d6ae05286a4f3da1414a9a95ff16d46f952501740e9e41e7de61558fea98bfceff59e63e066e2c3773b1f01872694ed4010dcb799ecdd57d35c7141ee30200004dc954b5028879992feaa8094b6060814f81c837e7440c5085a0c4f5cd1849dc4fddb59deee796e234d95f292d498296a5ceb02c142f0f8f54e64207ba8e331c4c06809478bd8b978a0ca4e4abe69242a4b377b51036b3a3f528bb3d4d2ad584e93eecb5f6f0d314948bac43f9f12c9203d11840785b4f8f23823ac710040e77f8d4634826a4ecfe00e635fba699a47091022fe4b48b7917554cb931ee416eb53cf7bde364dbff6b1ebe64ae9333c8d69a298bea87fa3ab5fb654e84d96a9acf3b05acb1b7a3693249bce5852809f350a5e2dbf749b6226179c9131290bf37fcdc3628b68c777f47f0bfbc659f503664ba6509bd0efa5fc02b4604d034b614fc520078b48b031f5b69cd1c9ad7718dcb2c70fbee04608dee04bdeb9b8b6c716be36693f86684b7481138950c56a7a02acc548a50e7d5d61e4cdd166a075c7055ee889b5631923bb50b490ecc275373e75a61b83252800214ec0d33acb9ceac08ff75fae51164610af0206eec0b657d40dac8cd8d7a0f3876ec3e2cbe94ed4a17cfd763b	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4700	file.exe
4700	file.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4580	4700	file.exe	80
PID 4700 wrote to memory of 4580	4700	file.exe	80
PID 4700 wrote to memory of 3220	4700	file.exe	83
PID 4700 wrote to memory of 3220	4700	file.exe	83
PID 4700 wrote to memory of 1016	4700	file.exe	86
PID 4700 wrote to memory of 1016	4700	file.exe	86
PID 4700 wrote to memory of 4004	4700	file.exe	89
PID 4700 wrote to memory of 4004	4700	file.exe	89
PID 4700 wrote to memory of 2756	4700	file.exe	92
PID 2756 wrote to memory of 2184	2756	G11VJAFGAi8V.exe	93
PID 2756 wrote to memory of 2184	2756	G11VJAFGAi8V.exe	93
PID 2756 wrote to memory of 2184	2756	G11VJAFGAi8V.exe	93
PID 2756 wrote to memory of 2184	2756	G11VJAFGAi8V.exe	93
PID 2756 wrote to memory of 2184	2756	G11VJAFGAi8V.exe	93

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4004
- C:\Users\Admin\AppData\Local\G11VJAFGAi8V.exe
  "C:\Users\Admin\AppData\Local\G11VJAFGAi8V.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
    3⤵
    PID:2184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 16
      4⤵
      Program crash
      PID:2656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2184 -ip 2184
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3AEAB1A8-24E7-359C-63F0-FFA4BBB8972C.txt

Path C:\ProgramData\3AEAB1A8-24E7-359C-63F0-FFA4BBB8972C.txt
Size 64B
SHA256 75361bc8628f2dcd23501725042d78b3703889069ca78142ff8694dae723146c
MD5 bb0a2973c8dc5b515e736e0b9260c185
SHA1 66db4ccd66d85991f50873d70aabf10889a9f667
SHA512 cae85e358ed998d361f1705522d1c1ed421e8eba5d01d3a55f53b057fcf8a7c6828e9d7ad3d1c8154f20668898c853fd5b8630eab845f34cea43affe9a93d506
TLSH
T136A022C0B0800B2A28320F08E00B00080200C000003F8E02C83028800EF80088AB0008
MD5 SHA1 SHA512 TLSH

Submit Download

G11VJAFGAi8V.exe

Path C:\Users\Admin\AppData\Local\G11VJAFGAi8V.exe
Size 1.5MB
SHA256 04a40d87d287ccd0cc5de7776d6651fbd312c221835403efc58286eca3691b96
MD5 bdbf69bd6b1de32387b5dd88c9f3b0dc
SHA1 4ad9c07c8f735b0e56a0e509e910eb0cd1dc5853
SHA512 d9ca5533e87994dc80810f77f1df3d30e24de29cabb40e7b3e70bfc74542da25080933b5fa460d7700d0bf72258c4d55f4f8cb4a81594a43148ecdcffd38f0ba
SSDEEP 24576:ZOCD6KkTklQvLOhbfi1NaQboVEGckoveD0SEKYS3QZNFhdAgBGrQCcTHJCDrth6P:ZjVpK/7WgZNFhdraQC+p+aP
TLSH
T117652940FDC754F6E402173659B762BF6734A9090B36AB87EB847B7DF976291083230A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2184-58-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3388-15-0x000001F852430000-0x000001F85248D000-memory.dmp

Download

memory/3816-14-0x00000241700A0000-0x00000241700FD000-memory.dmp

Download

memory/4700-0-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-11-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-7-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-5-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-4-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-2-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-1-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-6-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-9-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-8-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-10-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-18-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-26-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-25-0x00000216F6150000-0x00000216F68FE000-memory.dmp

Download

memory/4700-13-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-12-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-62-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-64-0x0000000140000000-0x00000001400D3000-memory.dmp

Download

memory/4700-63-0x00000216F6150000-0x00000216F68FE000-memory.dmp

Download