stealc | 1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe
Size 6.7MB
Sample260511-edxl7set2q
SHA256 1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b
MD5 79187195d75a83469f94d84887157251
SHA1 defc99dbb6a36ddb8fa8d3ce218db4747feb980a
SHA512 32939181c8e12b8e018531b9e5f6892365abc28e57970bc9526551aab306691219b107452206352c948bfd7198ceb76f40f1e9fbedda4f850aad91cdacdd26cf
SSDEEP 98304:3CC8fgPW2TQguT4l41PRno+Cev2E9ucwLxrguIUx:3CC8fgPPTQh1PRolfsucWxT
TLSH
T15666DF0AB7A400F9E1A7C278C9624556EB72BC165770DBCF0390AE5A3F23BD15E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

06x05x2026 discovery downloader execution stealc svcstealer persistence spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

06x05x2026

http://196.251.107.130

Attributes

url_path
/16b022998f754137b60a.php

rc4.traffic_key

rc4.C2

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b0eb-12.dat	family_stealc_v2

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/files/0x0003000000025b95-56.dat	family_svcstealer

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	SvcHostAnalyzer.exe

Executes dropped EXE 19 IoCs

pid	Process
6140	p736u63l82.exe
5208	s0doi5gjkt.exe
1208	zzjt5a0fbr.exe
2132	wfl6mjg146.exe
5568	qucufuapuu.exe
4896	SvcHostAnalyzer.exe
2724	xgw1q88d2d.exe
5088	yzaglzz86i.exe
3972	WinUpdateHelper.exe
2928	BLTools v3.0.0[PRO].exe
1832	zzjt5a0fbr.exe
2892	winhost.exe
1788	EmbeddedDriverService.sys
5220	svchost.exe
1140	aaatql.exe
5320	covsf.exe
592	covsf.exe
5380	aaatql.exe
3168	aaatql.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security = "C:\\Users\\Admin\\AppData\\Roaming\\zzjt5a0fbr.exe"	zzjt5a0fbr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	wfl6mjg146.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security = "C:\\Users\\Admin\\AppData\\Roaming\\zzjt5a0fbr.exe"	zzjt5a0fbr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	aaatql.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\bfmux = "C:\\ProgramData\\covsf.exe"	qucufuapuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	aaatql.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	aaatql.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2928	BLTools v3.0.0[PRO].exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BLTools v3.0.0[PRO].exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	s0doi5gjkt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	s0doi5gjkt.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	qucufuapuu.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1208	zzjt5a0fbr.exe
1208	zzjt5a0fbr.exe
5208	s0doi5gjkt.exe
5208	s0doi5gjkt.exe
3972	WinUpdateHelper.exe
3972	WinUpdateHelper.exe
1832	zzjt5a0fbr.exe
1832	zzjt5a0fbr.exe
2724	xgw1q88d2d.exe
2724	xgw1q88d2d.exe
2724	xgw1q88d2d.exe
2724	xgw1q88d2d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3220	Explorer.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4896	SvcHostAnalyzer.exe
4896	SvcHostAnalyzer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	zzjt5a0fbr.exe
Token: SeLoadDriverPrivilege	4896	SvcHostAnalyzer.exe
Token: SeLoadDriverPrivilege	4896	SvcHostAnalyzer.exe
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeDebugPrivilege	1832	zzjt5a0fbr.exe
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 6140	5684	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	78
PID 5684 wrote to memory of 5208	5684	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	79
PID 5684 wrote to memory of 1208	5684	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	80
PID 1208 wrote to memory of 3220	1208	zzjt5a0fbr.exe	52
PID 5684 wrote to memory of 2132	5684	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	82
PID 5684 wrote to memory of 5568	5684	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	83
PID 5684 wrote to memory of 2724	5684	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	84
PID 5684 wrote to memory of 5088	5684	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	86
PID 5684 wrote to memory of 2928	5684	x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe	88
PID 3972 wrote to memory of 2728	3972	WinUpdateHelper.exe	49
PID 3972 wrote to memory of 3220	3972	WinUpdateHelper.exe	52
PID 3972 wrote to memory of 3852	3972	WinUpdateHelper.exe	57
PID 3972 wrote to memory of 3916	3972	WinUpdateHelper.exe	58
PID 3220 wrote to memory of 3012	3220	Explorer.EXE
PID 3220 wrote to memory of 5156	3220	Explorer.EXE
PID 3220 wrote to memory of 4368	3220	Explorer.EXE
PID 3220 wrote to memory of 3144	3220	Explorer.EXE
PID 5208 wrote to memory of 3384	5208	s0doi5gjkt.exe	93
PID 5208 wrote to memory of 3384	5208	s0doi5gjkt.exe	93
PID 1832 wrote to memory of 3220	1832	zzjt5a0fbr.exe	52
PID 5220 wrote to memory of 1912	5220	svchost.exe	101
PID 5220 wrote to memory of 4880	5220	svchost.exe	103
PID 3220 wrote to memory of 5432	3220	Explorer.EXE
PID 5568 wrote to memory of 5320	5568	qucufuapuu.exe	107
PID 3220 wrote to memory of 1732	3220	Explorer.EXE
PID 5208 wrote to memory of 2432	5208	s0doi5gjkt.exe	109
PID 5208 wrote to memory of 2432	5208	s0doi5gjkt.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2728

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Users\Admin\AppData\Local\Temp\x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe
  "C:\Users\Admin\AppData\Local\Temp\x1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Users\Admin\AppData\Roaming\p736u63l82.exe
    "C:\Users\Admin\AppData\Roaming\p736u63l82.exe"
    3⤵
    - Executes dropped EXE
    PID:6140
- - C:\Users\Admin\AppData\Roaming\s0doi5gjkt.exe
    "C:\Users\Admin\AppData\Roaming\s0doi5gjkt.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2432
- - C:\Users\Admin\AppData\Roaming\zzjt5a0fbr.exe
    "C:\Users\Admin\AppData\Roaming\zzjt5a0fbr.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1208
- - C:\Users\Admin\AppData\Roaming\wfl6mjg146.exe
    "C:\Users\Admin\AppData\Roaming\wfl6mjg146.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2132
- - C:\Users\Admin\AppData\Roaming\qucufuapuu.exe
    "C:\Users\Admin\AppData\Roaming\qucufuapuu.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\ProgramData\covsf.exe
      "C:\ProgramData\covsf.exe"
      4⤵
      Executes dropped EXE
      PID:5320
- - C:\Users\Admin\AppData\Roaming\xgw1q88d2d.exe
    "C:\Users\Admin\AppData\Roaming\xgw1q88d2d.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2724
- - C:\Users\Admin\AppData\Roaming\yzaglzz86i.exe
    "C:\Users\Admin\AppData\Roaming\yzaglzz86i.exe"
    3⤵
    - Executes dropped EXE
    PID:5088
- - C:\Users\Admin\AppData\Local\Temp\BLTools v3.0.0[PRO].exe
    "C:\Users\Admin\AppData\Local\Temp\BLTools v3.0.0[PRO].exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2928

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3916

C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
"C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
"C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3972

C:\Users\Admin\AppData\Roaming\zzjt5a0fbr.exe
C:\Users\Admin\AppData\Roaming\zzjt5a0fbr.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3932

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:2892

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1040

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
- Executes dropped EXE
PID:1788

C:\Users\Admin\Pictures\svchost.exe
C:\Users\Admin\Pictures\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /query /tn "Google Updater Task"
  2⤵
  PID:1912
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Google Updater Task" /tr "C:\Users\Admin\AppData\Roaming\aaatql.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4880

C:\Users\Admin\AppData\Roaming\aaatql.exe
C:\Users\Admin\AppData\Roaming\aaatql.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1140

C:\ProgramData\covsf.exe
C:\ProgramData\covsf.exe
1⤵
- Executes dropped EXE
PID:592

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2844

C:\Users\Admin\AppData\Roaming\aaatql.exe
C:\Users\Admin\AppData\Roaming\aaatql.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5380

C:\Users\Admin\AppData\Roaming\aaatql.exe
C:\Users\Admin\AppData\Roaming\aaatql.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D8E11888-3087-957C-03D0-9F845B98370C.txt

Path C:\ProgramData\D8E11888-3087-957C-03D0-9F845B98370C.txt
Size 64B
SHA256 70c3dc004ddf5bfffd7a21f5833bf3c26f9bc042893cf086828a84908c83514e
MD5 35efce8dc027a2cb8bb04869c8dcbca5
SHA1 bb2c3f811164e85a5699235d02cb284f6a0b272f
SHA512 f44e70c5227699e2e2b6fee6dc0023867d84a39f5efdd909eb28d8d3ee601afad49b555ea5968761e1cffcc332d4d81a0dba4cc3d2063db60f494b58ec9561fa
TLSH
T118A002D0F552B82D05E9488B12F448DB39553825520789825B345498535A102481A360
MD5 SHA1 SHA512 TLSH

Submit Download

D8E11888-3087-957C-03D0-9F845B98370C.txt

Path C:\ProgramData\D8E11888-3087-957C-03D0-9F845B98370C.txt
Size 64B
SHA256 33b24d44484b703ae57cf2f6ddff84d9715f549fd318b125ef965e3d94a54ebd
MD5 ef688dfffb7a661b4ce9ade575a926a7
SHA1 e6a6ca2eb6ee34e1a04cc55ca00a118e735dcc18
SHA512 a98562cd796f97c547c19d74914d4934dba1e69cc4139f97c607ac9444e57fe35463343f0da25d04285bb0545d464ccec92eeb6d21f8f739701de283c00dd039
TLSH
T15BA0220B0200303220CF3223B088A83C0C20BE302C020A8E00E000000882330AC0C882
MD5 SHA1 SHA512 TLSH

Submit Download

BLTools v3.0.0[PRO].exe

Path C:\Users\Admin\AppData\Local\Temp\BLTools v3.0.0[PRO].exe
Size 3.2MB
SHA256 6f1af955e04776e5b592f5a820a99c343e3b02444cf823503311d87a71173f07
MD5 df57f4de4f92511aa86da16c323c181f
SHA1 dd45800913d998753252b81164979a90620b8d10
SHA512 41ae4e46c5e0fc75442ed6bec0ac2d8bad7c67005b76d3dcbf4de7f5c35b774b4366f20a2d1849582e46ecf36661005051dceecb418db6b0d3ccfe0e209d2b48
SSDEEP 49152:v182v7xeiZLx/He9pTXIl41zrRay7o+CeYs2EHyiZufp2zbfsqqLaqTrg:C2TQguT4l41PRno+Cev2E9ucwLxrg
TLSH
T163F502157EE69927F2F20BBAE47640F04A33BC11AD06DB5F2450BE5F3972A92DC20716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SvcHostAnalyzer.exe

Path C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
Size 147KB
SHA256 5847e5335818953dfb13c349a7f1b530c5a75a0ff671b471b5e6d8f9b55b23e8
MD5 a641a6184845dfbbb5f0fff2e3a059f2
SHA1 01d66a8288c5c7078c0f8b75aae610a40ac5585a
SHA512 b22568b179f3be8e9149c3960ca151383ad64f50c0a6f519dc2574e81d4f0711dbf972e961f4aec32b0941257e4f085992582bb62fa7de62de956eea5173818d
SSDEEP 3072:nkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:gyrWpAKhhvORHJ
TLSH
T157E35A4363E920E9F1778678C9A58A46E771B83207209BEF07E0465A4F237D1ED3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinUpdateHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
Size 38KB
SHA256 14960f501cf2ab10639dfb062822a67d57be84c39907238922c484da9cf8857b
MD5 bc327d54c54b2eb6853edf82a8566cbc
SHA1 c60343637e93a67830977658f7063934ba2baf3c
SHA512 7d100a63da9a6b83c924590645a46f9c60939c0631af75441967ae0793dcfc87b9fe4145ce192413db0abb0e9f786f9046910d3597f1c28d608fd9c13845a0b7
SSDEEP 768:zfBM20cIyxOjLjze7PkiYtVeXnvJBzOP16OSIBsNk5iZ1h2:zO20cIyxOjkcieovJ1e8Omk5I2
TLSH
T142033A27ABD642CBD8A19EB0F5F04E37E2E1F465A498DE4F4330E82C5F9A052D518B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p736u63l82.exe

Path C:\Users\Admin\AppData\Roaming\p736u63l82.exe
Size 192KB
SHA256 3845afe4fe188c2691a4a3fd13e589de77deb5f550455e56f5e5e182181644da
MD5 c140bc2d4e5a4340128e21a5fb3e3347
SHA1 57e4c97ae681243af8091eadb0d9bfb922d362e4
SHA512 27d68fb51afa5534b09fda0428fd956cf883ee1cb9621cfe54e24bb2e5e9b03dbea1cdbed4fcd0316b5eda7214b8736dc432eeabfaface27a4db364a0c03422d
SSDEEP 3072:q10cYkCove5nI2EkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:q101joonIYyrWpAKhhvORHJ
TLSH
T1D4146B4763E921EAE0B68A74C9E54A46E7B1B4321310DFEF07A086194F237D1ED3CB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qucufuapuu.exe

Path C:\Users\Admin\AppData\Roaming\qucufuapuu.exe
Size 165KB
SHA256 0e12143a4b0dfc48f4bf791c90e5fd64fa6529c9a493755015aa210b13a804d6
MD5 11300ae5a0e3b41d5f8fddeab7cc77d3
SHA1 d71346dc872207727270bb08097f14e07e2dedd9
SHA512 f52c3bf2a7e45baa0d14af73a2d1516582eb208062667294ea87adeafb88a13135c6ce1a6c328ae285be71d29b4165fe95896ea7c114f33754871c5710a90197
SSDEEP 3072:6VWeDmfnP+SMIwTjAGrN3ooK26D76NbQ4SZOr+gUFk+ZqK5vYKe:imfnP+S9wT8GrWzH6+4S8+Obw
TLSH
T1AEF34D0A336460F4E5779278CDA25B46E7B2787A17B1634E437443BA5F332919E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s0doi5gjkt.exe

Path C:\Users\Admin\AppData\Roaming\s0doi5gjkt.exe
Size 767KB
SHA256 efe7eb517cc449cc7721c5c0acfb8cf454f28fdf2f37c08854aad4deefd7edc9
MD5 f87fd8891c767f0695e85728f238d33b
SHA1 84ca77ca0b27789b8236978ef3fb8cf774597555
SHA512 fa553eb7d793ca820b46131a354a35840f7bbc4050a7b2ef2cd1e182f21f305c3607e40042e3eb47529e1ca74ee724d0732dc3c50212dccb3c3065077401695a
SSDEEP 12288:TrHqQr5XgvVozsROaYzPIP17vMKrrhYyxBlDetAqxSv:nPgvVqsI0d70eVYyb
TLSH
T195F48D1EF7A612F8D0B7C274CA428952E77278465370978F03E15AAA5F372905F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wfl6mjg146.exe

Path C:\Users\Admin\AppData\Roaming\wfl6mjg146.exe
Size 253KB
SHA256 2e309c9c67e75edfcb019c91d8a5b12b0b7c0791ef440974bf49fabbc5ce05a9
MD5 a0b8ed5f2bca57d2b04f46f44168ac07
SHA1 6e748321823b8b8381336492be85f00138f6cf27
SHA512 1d565ea6485cac6e48bff60a116c00b5d970fccd2404acbc60b300007d84b00b827769caffa47c32e5d57eb70922a19dd8e6813def3e6064e1abda1aba6c1663
SSDEEP 6144:OqloHD2cTDiKB/Ap819VlD+mvmuXnxNVZKoI:Oql6nTDiKB/ApY5+m+uXX
TLSH
T1B6446C15B7A40CFDE97B813DC9524906EB727C560760EACF07A04A975F23AE09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xgw1q88d2d.exe

Path C:\Users\Admin\AppData\Roaming\xgw1q88d2d.exe
Size 1.3MB
SHA256 722bd4df8cbfc74ec64bc8cb449856160251099bd416fd70e26161917034ae2d
MD5 5645c1c3a6390aeec9b0ac9372517bb0
SHA1 1732840ad569c056fa9aa8c4fa310e7dd8787df9
SHA512 d8bdbeba45eda99b6b17116f1b393c4d8e2e8b312a5a7482164ffbfc28091bcb7b0b696703be571aeb2f2e64c35bc8896fe03ed2b8d98915c391ccaa2b60fdf9
SSDEEP 24576:qF2+fPeS080OrBjWACMs9qpL5KImt0y+S5G0GgDy:ZSKO9KACMsjhtIC
TLSH
T18F559E4AB2B400FCD557C178C5165A0FEBB278061374ABDF5298CA5A6F13FE11A7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yzaglzz86i.exe

Path C:\Users\Admin\AppData\Roaming\yzaglzz86i.exe
Size 281KB
SHA256 6537c644a1ce34f24826e67370eccf1cf91779fad3fd75031aa91b24d0e9214c
MD5 94d41b8d14809751b5518c85a7140d23
SHA1 eb8d67bfe6007b39244223e470a668701d82733d
SHA512 2105c1478ab03d8230ac967a0f9ce6f40a62b81717a80e577663c9e54b4eb88c40eb8b0684f7210e9417fd62ccc21ffd998cd12ef51d9e64f75693073dade7eb
SSDEEP 6144:jQEaoT5RIRJ0y4vAaXmn/hfLY4yISLzdc:jQDoTIRW9zXKhfUmSL5
TLSH
T121546B1AB7640CF9EE6BC23DC9524905DB72BC5657A1E7CF03A04A961F236E08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zzjt5a0fbr.exe

Path C:\Users\Admin\AppData\Roaming\zzjt5a0fbr.exe
Size 333KB
SHA256 e1743a2f00c39034f99bafd44d023005982e245bb7d435e456b6dfb4de87be6b
MD5 f816559cdc8d720d0ecd7a1727e41434
SHA1 8e16073f45df4cbf42672c69f281d7ed71023c25
SHA512 71069239d3d70ae9ada9bf634c68ee8b532a92a1c7d00e6d88166488092ec01b1ddf43b54619ed9d639d8a02475b758da00fef9ba8644d1ed38a7f3792f8feb7
SSDEEP 6144:Q6YaTDvpL7IF/Kz8plA4omkla3VbwXDhAYSzf5U:QCIvplsvla3VENABzfG
TLSH
T134745B45B6A40CFDE967827CC9A34A06D7B2B8560770EBCF03A046965F277D09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-135-0x000001E932550000-0x000001E9325FF000-memory.dmp

Download

memory/2620-192-0x0000024137AD0000-0x0000024137B7F000-memory.dmp

Download

memory/2724-209-0x0000010F3CD80000-0x0000010F3CE2F000-memory.dmp

Download

memory/2724-217-0x0000010F3CD80000-0x0000010F3CE2F000-memory.dmp

Download

memory/2728-76-0x000001ACD1BF0000-0x000001ACD1BF3000-memory.dmp

Download

memory/2844-194-0x0000020157DA0000-0x0000020157E4F000-memory.dmp

Download

memory/2892-119-0x00007FFCC5720000-0x00007FFCC5929000-memory.dmp

Download

memory/2928-94-0x0000000000F60000-0x000000000168E000-memory.dmp

Download

memory/2928-207-0x00000000060D0000-0x000000000621D000-memory.dmp

Download

memory/2928-134-0x0000000003A60000-0x0000000003A61000-memory.dmp

Download

memory/2928-208-0x0000000006220000-0x00000000062E1000-memory.dmp

Download

memory/3220-80-0x0000000003370000-0x0000000003377000-memory.dmp

Download

memory/3220-102-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-25-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-24-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-23-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-21-0x0000000002F60000-0x0000000002FA0000-memory.dmp

Download

memory/3220-90-0x0000000004180000-0x0000000004181000-memory.dmp

Download

memory/3220-93-0x0000000004230000-0x0000000004231000-memory.dmp

Download

memory/3220-92-0x0000000004220000-0x0000000004221000-memory.dmp

Download

memory/3220-91-0x0000000004210000-0x0000000004211000-memory.dmp

Download

memory/3220-26-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-113-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-112-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-111-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-110-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-27-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-36-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-28-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-108-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-107-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-106-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-105-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-104-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-40-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-114-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-109-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-103-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-101-0x00000000045B0000-0x00000000045F5000-memory.dmp

Download

memory/3220-29-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-30-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-31-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-32-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-149-0x0000000002F30000-0x0000000002F31000-memory.dmp

Download

memory/3220-35-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-34-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3220-190-0x0000000002F40000-0x0000000002F41000-memory.dmp

Download

memory/3220-33-0x00000000043B0000-0x00000000043F5000-memory.dmp

Download

memory/3932-120-0x0000023BD59B0000-0x0000023BD5A5F000-memory.dmp

Download

memory/3972-65-0x00007FFCC5720000-0x00007FFCC5929000-memory.dmp

Download

memory/3972-211-0x0000016998970000-0x0000016998A1F000-memory.dmp

Download

memory/3972-210-0x0000016998AE0000-0x0000016998CE9000-memory.dmp

Download

memory/5208-205-0x0000026816370000-0x000002681641F000-memory.dmp

Download

memory/5220-145-0x000001FE5B6E0000-0x000001FE5B78F000-memory.dmp

Download

memory/5320-212-0x0000000002770000-0x000000000281F000-memory.dmp

Download

memory/5568-188-0x0000000002360000-0x000000000236C000-memory.dmp

Download

memory/5568-189-0x0000000002380000-0x000000000242F000-memory.dmp

Download

memory/6140-69-0x000001C355900000-0x000001C3559AF000-memory.dmp

Download

memory/6140-71-0x000001C3559C0000-0x000001C3559CC000-memory.dmp

Download