snappyclient | 9b83791bba1a2384a3f49d4c3abd96debfc2bced8a1fd7456810befd48b1dbfe

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/04/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.8MB
Sample260404-trkbcsey2s
SHA256 9b83791bba1a2384a3f49d4c3abd96debfc2bced8a1fd7456810befd48b1dbfe
MD5 81e21774e6765d18444d02b58e68e598
SHA1 0ed5162adf4d59fe105ecc0122ab14912bd35ffc
SHA512 6bb7aa56f2fc3b357b633767cb3e9f40a647121bd60389dae02bd96f1347233667231a7575614b9df14c888dd3643ac7ffe964f00790bd370c3f89bf7c1264ea
SSDEEP 24576:rM/1oK5WuY4z61U9tNfTAW1MGucUyXwmGiWPrWKf9:rMdR5Tz61ItNMeMGa5xS6
TLSH
T194168D5B7CD004BAD0AAA33288B261917B76F8191B3233D72F44B6783F767E06979714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 01ce16587cdedffe1810091f6cbbfbec collection discovery snappyclient vidar persistence spyware stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

01ce16587cdedffe1810091f6cbbfbec

https://telegram.me/nwwfh8
https://steamcommunity.com/profiles/76561198719385745

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Extracted

Family

snappyclient

Attributes

additional_fields
false
buildID
main
cache_directory
eiio
default_directory
%ALLUSERSPROFILE%\Dodic
directory
Tagigumo
events_db
Leliluku
keylogger_file
Hayova
shared_memory
true
software_db
Sujafo
tag
LDC

Signatures

Detects Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/4892-1-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15
behavioral2/memory/4892-28-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15
behavioral2/memory/4892-174-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15
behavioral2/memory/4892-240-0x0000000140000000-0x0000000140105000-memory.dmp	family_vidar_v15

SnappyClient
SnappyClient is a C2 framework with information stealing capabilities, written in C++.
backdoor stealer snappyclient
Snappyclient family
snappyclient

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4856 created 3104	4856	71OpJr0zA6.exe	53

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Downloads MZ/PE file 1 IoCs

flow	pid	Process
89	4892	file.exe

Executes dropped EXE 2 IoCs

pid	Process
4856	71OpJr0zA6.exe
4296	svchost.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\svcdrv0871 = "powershell \"start \\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\71OpJr0zA6.exe\\\" -WindowStyle Hidden\""	71OpJr0zA6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 4296	4856	71OpJr0zA6.exe	104

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71OpJr0zA6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5420	chrome.exe
4692	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4296	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
2788	chrome.exe
2788	chrome.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4892	file.exe
4856	71OpJr0zA6.exe
4856	71OpJr0zA6.exe
4296	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2160	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2788	4892	file.exe	79
PID 2788 wrote to memory of 5228	2788	chrome.exe	80
PID 4892 wrote to memory of 2788	4892	file.exe	79
PID 2788 wrote to memory of 6036	2788	chrome.exe	81
PID 2788 wrote to memory of 6036	2788	chrome.exe	81
PID 2788 wrote to memory of 5420	2788	chrome.exe	82
PID 2788 wrote to memory of 3252	2788	chrome.exe	84
PID 2788 wrote to memory of 3252	2788	chrome.exe	84
PID 2788 wrote to memory of 5460	2788	chrome.exe	83
PID 2788 wrote to memory of 5460	2788	chrome.exe	83
PID 2788 wrote to memory of 4504	2788	chrome.exe	85
PID 2788 wrote to memory of 4504	2788	chrome.exe	85
PID 2788 wrote to memory of 648	2788	chrome.exe	87
PID 2788 wrote to memory of 648	2788	chrome.exe	87
PID 2788 wrote to memory of 5852	2788	chrome.exe	89
PID 2788 wrote to memory of 5852	2788	chrome.exe	89
PID 4892 wrote to memory of 2160	4892	file.exe	91
PID 2160 wrote to memory of 4032	2160	msedge.exe	92
PID 4892 wrote to memory of 2160	4892	file.exe	91
PID 2160 wrote to memory of 4692	2160	msedge.exe	95
PID 2160 wrote to memory of 1096	2160	msedge.exe	96
PID 2160 wrote to memory of 1096	2160	msedge.exe	96
PID 2160 wrote to memory of 1096	2160	msedge.exe	96
PID 2160 wrote to memory of 544	2160	msedge.exe	97
PID 2160 wrote to memory of 544	2160	msedge.exe	97
PID 2160 wrote to memory of 4568	2160	msedge.exe	98
PID 2160 wrote to memory of 4340	2160	msedge.exe	99
PID 2160 wrote to memory of 4568	2160	msedge.exe	98
PID 2160 wrote to memory of 4568	2160	msedge.exe	98
PID 2160 wrote to memory of 4340	2160	msedge.exe	99
PID 2160 wrote to memory of 4340	2160	msedge.exe	99
PID 4892 wrote to memory of 3768	4892	file.exe	101
PID 3768 wrote to memory of 4856	3768	cmd.exe	103
PID 4856 wrote to memory of 4296	4856	71OpJr0zA6.exe	104
PID 4856 wrote to memory of 4296	4856	71OpJr0zA6.exe	104
PID 4856 wrote to memory of 4296	4856	71OpJr0zA6.exe	104
PID 4856 wrote to memory of 4296	4856	71OpJr0zA6.exe	104
PID 4856 wrote to memory of 4296	4856	71OpJr0zA6.exe	104
PID 4856 wrote to memory of 4296	4856	71OpJr0zA6.exe	104
PID 4856 wrote to memory of 4296	4856	71OpJr0zA6.exe	104

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3104
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Downloads MZ/PE file
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3b38c728,0x7ffd3b38c734,0x7ffd3b38c740
      4⤵
      PID:5228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,7323843581187114789,6008051198926640977,262144 --field-trial-handle=1980,i,3905424786172295816,5731874374768657441,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1964 /prefetch:2
      4⤵
      PID:6036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,108609420678422951,1861298571211615904,524288 --field-trial-handle=1980,i,3905424786172295816,5731874374768657441,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2260 /prefetch:11
      4⤵
      System Time Discovery
      PID:5420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,908803045376364125,7511980410223783531,524288 --field-trial-handle=1980,i,3905424786172295816,5731874374768657441,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2824 /prefetch:13
      4⤵
      PID:5460
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,11005533786269017979,1400009831335248180,2097152 --field-trial-handle=1980,i,3905424786172295816,5731874374768657441,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      PID:3252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,16728955193061371508,15326132182995063036,2097152 --field-trial-handle=1980,i,3905424786172295816,5731874374768657441,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:4504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,500856223527305602,12046137456235610235,2097152 --field-trial-handle=1980,i,3905424786172295816,5731874374768657441,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4296 /prefetch:9
      4⤵
      PID:648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,10562265930214348175,5270844597642645495,2097152 --field-trial-handle=1980,i,3905424786172295816,5731874374768657441,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4696 /prefetch:1
      4⤵
      PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7ffd3b36c188,0x7ffd3b36c194,0x7ffd3b36c1a0
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,12112954110847934748,3998005239918710702,524288 --field-trial-handle=2352,i,1308602286138765418,13237272949771750101,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
      4⤵
      System Time Discovery
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,5327484963689621772,16063780206939303117,262144 --field-trial-handle=2352,i,1308602286138765418,13237272949771750101,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,8936279538273360907,11959581379389347982,524288 --field-trial-handle=2352,i,1308602286138765418,13237272949771750101,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
      4⤵
      PID:544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,1536249018344955228,5145673682519555961,2097152 --field-trial-handle=2352,i,1308602286138765418,13237272949771750101,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,5790975123960207247,903592259546519325,2097152 --field-trial-handle=2352,i,1308602286138765418,13237272949771750101,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:4340
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\71OpJr0zA6.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\71OpJr0zA6.exe
      "C:\Users\Admin\AppData\Local\Temp\71OpJr0zA6.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4856
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\71OpJr0zA6.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  PID:4296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 4750c0f3bcff4ebe719049b38ab75f36529d6cfb43419167addb12cc85828a5f
MD5 e8d1780d561db270513e3ab8f8048732
SHA1 ba5b9e5cb32a88c1c13cb1d01283b4edecc40bc7
SHA512 6607888357cf714496c9ed929d5550d734e7adb870617b70b1d8f8ab5f2f80c01350e79720b502053a06cbcc5bedd9fb317a390f914dec15c2ecd4a4d5052c5a
SSDEEP 1536:eG7OwP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:u2++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T14C9312B9991E7D75636AC6D690079CAC88E3DCCE1514117C30C7AB1E28BE393E30B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7336fd0f-60a4-4d60-a2c8-b8f9bb652ec0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7336fd0f-60a4-4d60-a2c8-b8f9bb652ec0.tmp
Size 26KB
SHA256 4a8f195dbf974e60eac0a9ae253adc5719496ec31bc71906e72d93f26bc6cf21
MD5 d517290cf1ebb2bd4b2834c32d98a0d9
SHA1 81a8f7eb0693f4fc47b8ac16856fa125278330a2
SHA512 743b39080eab70d32e62ceac2d2110401be9ea77dd5f96418df229d257d0a33eee528bbd09e01b32dca7396f4f628ec7466862be50c8a6b5d7ff09cf4664c759
SSDEEP 384:n1iFavqMg38Ny8TUNTUlIxBvHTBYGBrfDKJfP3gjoS9SkeIdnS4mtmLUrNlk+5vS:8Fayv3FwgFY4KJH3hujdS4smLMi
TLSH
T18BC25C75EC98DAABE9E74F89E7097607EEF041A7D58C4AC4CAD80D0E10D719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fadda47c85dae6ec65b404fcdfa73e47e0f27c8cd57e8c0f81b774002442f241
MD5 b1547b06e8bfe634bbb9858c56dc729f
SHA1 b4f563bb2962920d65c0ab0f26a0a01da442aa47
SHA512 7628eb5759080bc9abab73ca18389ef3a92950b5e3b67a2b6d8c1f646ce7ea19ffb2d66150d22b489fe3ab2f1267bbbc5033ebcebcb6de27decb1072e532244a
SSDEEP 384:n/iFavqMg38ND8TUNTUlIxBvHgxhzBrfDKJfP3gjoS9Sr8RbhldnS4mtmLUrNlkT:KFayv3Mwg+hRKJH3hZCbhldS4smLMi
TLSH
T169C24B76E898DAABADE78FD9E7097607EEF04167E58C4AC4C5C81D0E10DB19E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71OpJr0zA6.exe

Path C:\Users\Admin\AppData\Local\Temp\71OpJr0zA6.exe
Size 5.8MB
SHA256 9980462da93da1eac2f57119df0e7b94bc0552179c2353748886ba43dc37467d
MD5 ba8b389cf372a06188ab92ac1a0c9f6b
SHA1 dd836e0ca047ed22f04f483791cf6bac0da8cd27
SHA512 4e9e08f141195145302c2f50de4badcff22e5f0b1212e1f66bcd2412e8f2e9c60f0aeddb0d68731c52c99fc2e1fde06cd94c7c5cda8ee3e94158bff7a796574c
SSDEEP 98304:fkzmxVBvu5w2mPXCGpoBt5RUvQvizpRBgXkemtd9mhygSCB8mI:80Bvui2rGpa5Ruq0/j4ySB8m
TLSH
T18956F12391285E3FDBB94AB2FA2E7576A814B8043CE424CB5F9CDDF0A9F8601D735506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 46KB
SHA256 49fab89d62923d68d5f9627c68110ef522a668730598c3b09cd74fbe8f3f3e62
MD5 b96d1c078a724e31b6f98cdb999e47f6
SHA1 115878cfb730b1f2cb084cdc51fdd92e9b36f9a8
SHA512 9e9fabadd90ae33b6aa8473ae3bfdcd1843a765c0fb5e1cc5fe693aff95f1e8b36c17bde8b5850e2f3a9b47fc565876f0bf94c633cb240ceb6cb30ef964d5173
SSDEEP 768:ULNm/hN4d4Zzc9SHZUZS+0qw9Q7wSZpD6fRHfw3il5Q1PI5Yj/9zzu:VpN4d4Zzc9710LAwSZh6fRH4OiPzZzq
TLSH
T166236C02EF88C012FDA211F056AEF3632E3DEE65070183E3579056D919667C5EE392AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4296-211-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-204-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-244-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-243-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-193-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-202-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-218-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-241-0x0000000000590000-0x00000000005DA000-memory.dmp

Download

memory/4296-222-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-224-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-226-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-225-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-219-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-227-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-215-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-213-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-210-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-212-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-238-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-209-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-208-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-207-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-205-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-237-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-203-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-200-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-199-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-198-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-197-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-190-0x0000000000380000-0x0000000000381000-memory.dmp

Download

memory/4296-217-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-216-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-214-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-206-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-201-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-191-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-192-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4296-194-0x0000000000800000-0x0000000000BB5000-memory.dmp

Download

memory/4856-187-0x0000000003A80000-0x0000000003E2C000-memory.dmp

Download

memory/4856-223-0x0000000000400000-0x00000000009E0000-memory.dmp

Download

memory/4856-186-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/4892-1-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4892-174-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4892-28-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4892-0-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4892-239-0x0000019F577B0000-0x0000019F577BC000-memory.dmp

Download

memory/4892-240-0x0000000140000000-0x0000000140105000-memory.dmp

Download

memory/4892-27-0x0000019F577B0000-0x0000019F577BC000-memory.dmp

Download