stealc | 1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe
Size 6.7MB
Sample260511-edxl7set2q
SHA256 1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b
MD5 79187195d75a83469f94d84887157251
SHA1 defc99dbb6a36ddb8fa8d3ce218db4747feb980a
SHA512 32939181c8e12b8e018531b9e5f6892365abc28e57970bc9526551aab306691219b107452206352c948bfd7198ceb76f40f1e9fbedda4f850aad91cdacdd26cf
SSDEEP 98304:3CC8fgPW2TQguT4l41PRno+Cev2E9ucwLxrguIUx:3CC8fgPPTQh1PRolfsucWxT
TLSH
T15666DF0AB7A400F9E1A7C278C9624556EB72BC165770DBCF0390AE5A3F23BD15E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

06x05x2026 discovery downloader execution stealc svcstealer persistence spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

06x05x2026

http://196.251.107.130

Attributes

url_path
/16b022998f754137b60a.php

rc4.traffic_key

rc4.C2

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242a3-12.dat	family_stealc_v2

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral1/files/0x00070000000242b7-81.dat	family_svcstealer

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	SvcHostAnalyzer.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\Control Panel\International\Geo\Nation	ac19o92w1t.exe

Executes dropped EXE 19 IoCs

pid	Process
5684	xvpyn29av8.exe
4092	697saysc8c.exe
5232	a1h9y45ac3.exe
4148	b2kc2lxmia.exe
2352	SvcHostAnalyzer.exe
3700	WinUpdateHelper.exe
4552	ac19o92w1t.exe
4644	d4bzc7fu4l.exe
4680	k3p47dzqvi.exe
4800	BLTools v3.0.0[PRO].exe
2284	a1h9y45ac3.exe
5256	EmbeddedDriverService.sys
536	svchost.exe
3212	winhost.exe
5936	xqyoxl.exe
3372	vdnix.exe
1964	vdnix.exe
1728	xqyoxl.exe
4496	xqyoxl.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	xqyoxl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security = "C:\\Users\\Admin\\AppData\\Roaming\\a1h9y45ac3.exe"	a1h9y45ac3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	b2kc2lxmia.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security = "C:\\Users\\Admin\\AppData\\Roaming\\a1h9y45ac3.exe"	a1h9y45ac3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	xqyoxl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xgzlj = "C:\\ProgramData\\vdnix.exe"	ac19o92w1t.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	xqyoxl.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4800	BLTools v3.0.0[PRO].exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BLTools v3.0.0[PRO].exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	697saysc8c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	697saysc8c.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ac19o92w1t.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5232	a1h9y45ac3.exe
5232	a1h9y45ac3.exe
4092	697saysc8c.exe
4092	697saysc8c.exe
3700	WinUpdateHelper.exe
3700	WinUpdateHelper.exe
2284	a1h9y45ac3.exe
2284	a1h9y45ac3.exe
4644	d4bzc7fu4l.exe
4644	d4bzc7fu4l.exe
4644	d4bzc7fu4l.exe
4644	d4bzc7fu4l.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3416	Explorer.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
2352	SvcHostAnalyzer.exe
2352	SvcHostAnalyzer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5232	a1h9y45ac3.exe
Token: SeLoadDriverPrivilege	2352	SvcHostAnalyzer.exe
Token: SeLoadDriverPrivilege	2352	SvcHostAnalyzer.exe
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeDebugPrivilege	2284	a1h9y45ac3.exe
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 5684	3204	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	84
PID 3204 wrote to memory of 4092	3204	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	85
PID 3204 wrote to memory of 5232	3204	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	86
PID 5232 wrote to memory of 3416	5232	a1h9y45ac3.exe	56
PID 3204 wrote to memory of 4148	3204	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	88
PID 3700 wrote to memory of 2624	3700	WinUpdateHelper.exe	44
PID 3700 wrote to memory of 2968	3700	WinUpdateHelper.exe	51
PID 3700 wrote to memory of 3416	3700	WinUpdateHelper.exe	56
PID 3700 wrote to memory of 3956	3700	WinUpdateHelper.exe	60
PID 3700 wrote to memory of 3516	3700	WinUpdateHelper.exe	62
PID 3700 wrote to memory of 5644	3700	WinUpdateHelper.exe	65
PID 3204 wrote to memory of 4552	3204	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	92
PID 3204 wrote to memory of 4644	3204	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	93
PID 3204 wrote to memory of 4680	3204	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	94
PID 3204 wrote to memory of 4800	3204	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	95
PID 4092 wrote to memory of 4620	4092	697saysc8c.exe	96
PID 4092 wrote to memory of 4620	4092	697saysc8c.exe	96
PID 3416 wrote to memory of 3684	3416	Explorer.EXE
PID 3416 wrote to memory of 5376	3416	Explorer.EXE
PID 3416 wrote to memory of 620	3416	Explorer.EXE
PID 3416 wrote to memory of 1992	3416	Explorer.EXE
PID 2284 wrote to memory of 3416	2284	a1h9y45ac3.exe	56
PID 536 wrote to memory of 5944	536	svchost.exe	108
PID 536 wrote to memory of 4004	536	svchost.exe	110
PID 4092 wrote to memory of 2196	4092	697saysc8c.exe	112
PID 4092 wrote to memory of 2196	4092	697saysc8c.exe	112
PID 3416 wrote to memory of 5700	3416	Explorer.EXE
PID 4552 wrote to memory of 3372	4552	ac19o92w1t.exe	117
PID 3416 wrote to memory of 796	3416	Explorer.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2624

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2968

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Users\Admin\AppData\Local\Temp\x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe
  "C:\Users\Admin\AppData\Local\Temp\x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Users\Admin\AppData\Roaming\xvpyn29av8.exe
    "C:\Users\Admin\AppData\Roaming\xvpyn29av8.exe"
    3⤵
    - Executes dropped EXE
    PID:5684
- - C:\Users\Admin\AppData\Roaming\697saysc8c.exe
    "C:\Users\Admin\AppData\Roaming\697saysc8c.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2196
- - C:\Users\Admin\AppData\Roaming\a1h9y45ac3.exe
    "C:\Users\Admin\AppData\Roaming\a1h9y45ac3.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5232
- - C:\Users\Admin\AppData\Roaming\b2kc2lxmia.exe
    "C:\Users\Admin\AppData\Roaming\b2kc2lxmia.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4148
- - C:\Users\Admin\AppData\Roaming\ac19o92w1t.exe
    "C:\Users\Admin\AppData\Roaming\ac19o92w1t.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\ProgramData\vdnix.exe
      "C:\ProgramData\vdnix.exe"
      4⤵
      Executes dropped EXE
      PID:3372
- - C:\Users\Admin\AppData\Roaming\d4bzc7fu4l.exe
    "C:\Users\Admin\AppData\Roaming\d4bzc7fu4l.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4644
- - C:\Users\Admin\AppData\Roaming\k3p47dzqvi.exe
    "C:\Users\Admin\AppData\Roaming\k3p47dzqvi.exe"
    3⤵
    - Executes dropped EXE
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\BLTools v3.0.0[PRO].exe
    "C:\Users\Admin\AppData\Local\Temp\BLTools v3.0.0[PRO].exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:4800

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3516

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5644

C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
"C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
"C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3700

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4808

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:624

C:\Users\Admin\AppData\Roaming\a1h9y45ac3.exe
C:\Users\Admin\AppData\Roaming\a1h9y45ac3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
- Executes dropped EXE
PID:5256

C:\Users\Admin\Pictures\svchost.exe
C:\Users\Admin\Pictures\svchost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /query /tn "Google Updater Task"
  2⤵
  PID:5944
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Google Updater Task" /tr "C:\Users\Admin\AppData\Roaming\xqyoxl.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4004

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1700

C:\Users\Admin\AppData\Roaming\xqyoxl.exe
C:\Users\Admin\AppData\Roaming\xqyoxl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5936

C:\ProgramData\vdnix.exe
C:\ProgramData\vdnix.exe
1⤵
- Executes dropped EXE
PID:1964

C:\Users\Admin\AppData\Roaming\xqyoxl.exe
C:\Users\Admin\AppData\Roaming\xqyoxl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1728

C:\Users\Admin\AppData\Roaming\xqyoxl.exe
C:\Users\Admin\AppData\Roaming\xqyoxl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1C3A1025-CB46-D8B1-4ADD-2EA9F2159621.txt

Path C:\ProgramData\1C3A1025-CB46-D8B1-4ADD-2EA9F2159621.txt
Size 64B
SHA256 1d5674ec71ffbc50f8f6126fa17e460c52acd438d6b0ee4ee4c4b17a4f40b2a6
MD5 3ab220122ab3414f9516df5f8f3f42ac
SHA1 9e356ccbd714e837817380e32be234e3576ce0e8
SHA512 e0732b6fa6bd13ab7715a7e8b43d7e90d99b315e10df4e8074673ab2dba1add5416479e6fc1f545a3c75cbc60b21d8246f5e3409de673625586ffd8c292d8251
TLSH
T14BA0220200CA8EC2203A30E03000000C8832082CCE0BC082CC02C2C0A0FCCE3A20C83C
MD5 SHA1 SHA512 TLSH

Submit Download

1C3A1025-CB46-D8B1-4ADD-2EA9F2159621.txt

Path C:\ProgramData\1C3A1025-CB46-D8B1-4ADD-2EA9F2159621.txt
Size 64B
SHA256 305c68cea1bf48126d9aef21144e6438be450f02ed24228653184b512036bbd0
MD5 568fc122a16a5b58ae58d5cdd5b5b738
SHA1 9d4479d7be2c77c23816ef25bf14ca158e691da2
SHA512 9b403b897383459f5d1305eab1fc8584d181850825f141f18baba6bf0e72edb56cc0a7bdcd97291b3641cca75fd8e0edd3ae826a01562cfe9948894df02567eb
TLSH
T172A02280B00030F0C03B28B323B0000C8F020E00C202880E0E00308032C80083A8023C
MD5 SHA1 SHA512 TLSH

Submit Download

BLTools v3.0.0[PRO].exe

Path C:\Users\Admin\AppData\Local\Temp\BLTools v3.0.0[PRO].exe
Size 3.2MB
SHA256 6f1af955e04776e5b592f5a820a99c343e3b02444cf823503311d87a71173f07
MD5 df57f4de4f92511aa86da16c323c181f
SHA1 dd45800913d998753252b81164979a90620b8d10
SHA512 41ae4e46c5e0fc75442ed6bec0ac2d8bad7c67005b76d3dcbf4de7f5c35b774b4366f20a2d1849582e46ecf36661005051dceecb418db6b0d3ccfe0e209d2b48
SSDEEP 49152:v182v7xeiZLx/He9pTXIl41zrRay7o+CeYs2EHyiZufp2zbfsqqLaqTrg:C2TQguT4l41PRno+Cev2E9ucwLxrg
TLSH
T163F502157EE69927F2F20BBAE47640F04A33BC11AD06DB5F2450BE5F3972A92DC20716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SvcHostAnalyzer.exe

Path C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
Size 147KB
SHA256 5847e5335818953dfb13c349a7f1b530c5a75a0ff671b471b5e6d8f9b55b23e8
MD5 a641a6184845dfbbb5f0fff2e3a059f2
SHA1 01d66a8288c5c7078c0f8b75aae610a40ac5585a
SHA512 b22568b179f3be8e9149c3960ca151383ad64f50c0a6f519dc2574e81d4f0711dbf972e961f4aec32b0941257e4f085992582bb62fa7de62de956eea5173818d
SSDEEP 3072:nkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:gyrWpAKhhvORHJ
TLSH
T157E35A4363E920E9F1778678C9A58A46E771B83207209BEF07E0465A4F237D1ED3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

697saysc8c.exe

Path C:\Users\Admin\AppData\Roaming\697saysc8c.exe
Size 767KB
SHA256 efe7eb517cc449cc7721c5c0acfb8cf454f28fdf2f37c08854aad4deefd7edc9
MD5 f87fd8891c767f0695e85728f238d33b
SHA1 84ca77ca0b27789b8236978ef3fb8cf774597555
SHA512 fa553eb7d793ca820b46131a354a35840f7bbc4050a7b2ef2cd1e182f21f305c3607e40042e3eb47529e1ca74ee724d0732dc3c50212dccb3c3065077401695a
SSDEEP 12288:TrHqQr5XgvVozsROaYzPIP17vMKrrhYyxBlDetAqxSv:nPgvVqsI0d70eVYyb
TLSH
T195F48D1EF7A612F8D0B7C274CA428952E77278465370978F03E15AAA5F372905F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winhost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
Size 38KB
SHA256 14960f501cf2ab10639dfb062822a67d57be84c39907238922c484da9cf8857b
MD5 bc327d54c54b2eb6853edf82a8566cbc
SHA1 c60343637e93a67830977658f7063934ba2baf3c
SHA512 7d100a63da9a6b83c924590645a46f9c60939c0631af75441967ae0793dcfc87b9fe4145ce192413db0abb0e9f786f9046910d3597f1c28d608fd9c13845a0b7
SSDEEP 768:zfBM20cIyxOjLjze7PkiYtVeXnvJBzOP16OSIBsNk5iZ1h2:zO20cIyxOjkcieovJ1e8Omk5I2
TLSH
T142033A27ABD642CBD8A19EB0F5F04E37E2E1F465A498DE4F4330E82C5F9A052D518B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1h9y45ac3.exe

Path C:\Users\Admin\AppData\Roaming\a1h9y45ac3.exe
Size 333KB
SHA256 e1743a2f00c39034f99bafd44d023005982e245bb7d435e456b6dfb4de87be6b
MD5 f816559cdc8d720d0ecd7a1727e41434
SHA1 8e16073f45df4cbf42672c69f281d7ed71023c25
SHA512 71069239d3d70ae9ada9bf634c68ee8b532a92a1c7d00e6d88166488092ec01b1ddf43b54619ed9d639d8a02475b758da00fef9ba8644d1ed38a7f3792f8feb7
SSDEEP 6144:Q6YaTDvpL7IF/Kz8plA4omkla3VbwXDhAYSzf5U:QCIvplsvla3VENABzfG
TLSH
T134745B45B6A40CFDE967827CC9A34A06D7B2B8560770EBCF03A046965F277D09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac19o92w1t.exe

Path C:\Users\Admin\AppData\Roaming\ac19o92w1t.exe
Size 165KB
SHA256 0e12143a4b0dfc48f4bf791c90e5fd64fa6529c9a493755015aa210b13a804d6
MD5 11300ae5a0e3b41d5f8fddeab7cc77d3
SHA1 d71346dc872207727270bb08097f14e07e2dedd9
SHA512 f52c3bf2a7e45baa0d14af73a2d1516582eb208062667294ea87adeafb88a13135c6ce1a6c328ae285be71d29b4165fe95896ea7c114f33754871c5710a90197
SSDEEP 3072:6VWeDmfnP+SMIwTjAGrN3ooK26D76NbQ4SZOr+gUFk+ZqK5vYKe:imfnP+S9wT8GrWzH6+4S8+Obw
TLSH
T1AEF34D0A336460F4E5779278CDA25B46E7B2787A17B1634E437443BA5F332919E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4bzc7fu4l.exe

Path C:\Users\Admin\AppData\Roaming\d4bzc7fu4l.exe
Size 1.3MB
SHA256 722bd4df8cbfc74ec64bc8cb449856160251099bd416fd70e26161917034ae2d
MD5 5645c1c3a6390aeec9b0ac9372517bb0
SHA1 1732840ad569c056fa9aa8c4fa310e7dd8787df9
SHA512 d8bdbeba45eda99b6b17116f1b393c4d8e2e8b312a5a7482164ffbfc28091bcb7b0b696703be571aeb2f2e64c35bc8896fe03ed2b8d98915c391ccaa2b60fdf9
SSDEEP 24576:qF2+fPeS080OrBjWACMs9qpL5KImt0y+S5G0GgDy:ZSKO9KACMsjhtIC
TLSH
T18F559E4AB2B400FCD557C178C5165A0FEBB278061374ABDF5298CA5A6F13FE11A7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k3p47dzqvi.exe

Path C:\Users\Admin\AppData\Roaming\k3p47dzqvi.exe
Size 281KB
SHA256 6537c644a1ce34f24826e67370eccf1cf91779fad3fd75031aa91b24d0e9214c
MD5 94d41b8d14809751b5518c85a7140d23
SHA1 eb8d67bfe6007b39244223e470a668701d82733d
SHA512 2105c1478ab03d8230ac967a0f9ce6f40a62b81717a80e577663c9e54b4eb88c40eb8b0684f7210e9417fd62ccc21ffd998cd12ef51d9e64f75693073dade7eb
SSDEEP 6144:jQEaoT5RIRJ0y4vAaXmn/hfLY4yISLzdc:jQDoTIRW9zXKhfUmSL5
TLSH
T121546B1AB7640CF9EE6BC23DC9524905DB72BC5657A1E7CF03A04A961F236E08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpyn29av8.exe

Path C:\Users\Admin\AppData\Roaming\xvpyn29av8.exe
Size 192KB
SHA256 3845afe4fe188c2691a4a3fd13e589de77deb5f550455e56f5e5e182181644da
MD5 c140bc2d4e5a4340128e21a5fb3e3347
SHA1 57e4c97ae681243af8091eadb0d9bfb922d362e4
SHA512 27d68fb51afa5534b09fda0428fd956cf883ee1cb9621cfe54e24bb2e5e9b03dbea1cdbed4fcd0316b5eda7214b8736dc432eeabfaface27a4db364a0c03422d
SSDEEP 3072:q10cYkCove5nI2EkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:q101joonIYyrWpAKhhvORHJ
TLSH
T1D4146B4763E921EAE0B68A74C9E54A46E7B1B4321310DFEF07A086194F237D1ED3CB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\Pictures\svchost.exe
Size 253KB
SHA256 2e309c9c67e75edfcb019c91d8a5b12b0b7c0791ef440974bf49fabbc5ce05a9
MD5 a0b8ed5f2bca57d2b04f46f44168ac07
SHA1 6e748321823b8b8381336492be85f00138f6cf27
SHA512 1d565ea6485cac6e48bff60a116c00b5d970fccd2404acbc60b300007d84b00b827769caffa47c32e5d57eb70922a19dd8e6813def3e6064e1abda1aba6c1663
SSDEEP 6144:OqloHD2cTDiKB/Ap819VlD+mvmuXnxNVZKoI:Oql6nTDiKB/ApY5+m+uXX
TLSH
T1B6446C15B7A40CFDE97B813DC9524906EB727C560760EACF07A04A975F23AE09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-55-0x0000023F7C390000-0x0000023F7C393000-memory.dmp

Download

memory/3212-131-0x00007FFA6E790000-0x00007FFA6E985000-memory.dmp

Download

memory/3416-32-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-119-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-27-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-28-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-26-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-24-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-25-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-30-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-22-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-21-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-19-0x0000000003550000-0x0000000003590000-memory.dmp

Download

memory/3416-23-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-31-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-33-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-95-0x00000000033F0000-0x00000000033F1000-memory.dmp

Download

memory/3416-98-0x0000000003640000-0x0000000003641000-memory.dmp

Download

memory/3416-97-0x0000000003630000-0x0000000003631000-memory.dmp

Download

memory/3416-96-0x0000000003620000-0x0000000003621000-memory.dmp

Download

memory/3416-34-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-118-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-117-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-201-0x0000000008CB0000-0x0000000008CB1000-memory.dmp

Download

memory/3416-58-0x00000000033D0000-0x00000000033D7000-memory.dmp

Download

memory/3416-39-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-116-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-114-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-113-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-112-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-111-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-109-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-106-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-29-0x0000000003590000-0x00000000035D5000-memory.dmp

Download

memory/3416-115-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-110-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-108-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-107-0x0000000009760000-0x00000000097A5000-memory.dmp

Download

memory/3416-150-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/3700-50-0x00007FFA6E790000-0x00007FFA6E985000-memory.dmp

Download

memory/4552-200-0x0000000000420000-0x000000000042C000-memory.dmp

Download

memory/4800-166-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Download

memory/4800-205-0x00000000010A0000-0x00000000010C5000-memory.dmp

Download

memory/4800-100-0x0000000000400000-0x0000000000B2E000-memory.dmp

Download

memory/5684-51-0x0000020BD4CD0000-0x0000020BD4CDC000-memory.dmp

Download