stealc | 1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe
Size 6.7MB
Sample260623-lezlhsbw8k
SHA256 1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b
MD5 79187195d75a83469f94d84887157251
SHA1 defc99dbb6a36ddb8fa8d3ce218db4747feb980a
SHA512 32939181c8e12b8e018531b9e5f6892365abc28e57970bc9526551aab306691219b107452206352c948bfd7198ceb76f40f1e9fbedda4f850aad91cdacdd26cf
SSDEEP 98304:3CC8fgPW2TQguT4l41PRno+Cev2E9ucwLxrguIUx:3CC8fgPPTQh1PRolfsucWxT
TLSH
T15666DF0AB7A400F9E1A7C278C9624556EB72BC165770DBCF0390AE5A3F23BD15E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

06x05x2026 discovery downloader execution stealc svcstealer xtinyloader loader persistence spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

06x05x2026

http://196.251.107.130

Attributes

url_path
/16b022998f754137b60a.php

rc4.traffic_key

rc4.C2

Extracted

Family

xtinyloader

62.60.226.159/xvzpjyddlu/getdata.php
196.251.107.104/xvzpjyddlu/getdata.php

Wallets

1DhhnhjE2uM48SkwTb7BfiPsg8wSrBPnYq
0x2b884927f2ee5941051043280f1a7231bfd22885
LN6CTAQpV4H7EdcwaNLp9p5bywefX6XeaY
TWNcDn9DNiutGzxpyt24gQZ8wsLgSTPdgw

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer
Family: XTinyLoader
XTinyLoader is a modular loader and stealer.
loader stealer xtinyloader

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f6-12.dat	family_stealc_v2

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/files/0x000c00000001c605-80.dat	family_svcstealer

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	SvcHostAnalyzer.exe

Executes dropped EXE 20 IoCs

pid	Process
2576	3cwmk4ew2x.exe
5672	7x6c72ru6o.exe
2584	izienrp31q.exe
4828	o2r5j8wrb2.exe
1376	SvcHostAnalyzer.exe
1148	WinUpdateHelper.exe
2392	kiy5qi0k5a.exe
3420	5ps1s3h2e8.exe
1724	v33pr045mv.exe
248	EmbeddedDriverService.sys
3740	izienrp31q.exe
2012	winhost.exe
2308	BLTools v3.0.0[PRO].exe
5704	svchost.exe
2436	zgicfl.exe
5028	ajjwv.exe
1236	ajjwv.exe
1108	zgicfl.exe
1132	zgicfl.exe
4768	zgicfl.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\drocf = "C:\\ProgramData\\ajjwv.exe"	kiy5qi0k5a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	zgicfl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	zgicfl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	zgicfl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security = "C:\\Users\\Admin\\AppData\\Roaming\\izienrp31q.exe"	izienrp31q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	o2r5j8wrb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security = "C:\\Users\\Admin\\AppData\\Roaming\\izienrp31q.exe"	izienrp31q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	zgicfl.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2308	BLTools v3.0.0[PRO].exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BLTools v3.0.0[PRO].exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7x6c72ru6o.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7x6c72ru6o.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2584	izienrp31q.exe
2584	izienrp31q.exe
1148	WinUpdateHelper.exe
1148	WinUpdateHelper.exe
5672	7x6c72ru6o.exe
5672	7x6c72ru6o.exe
3740	izienrp31q.exe
3740	izienrp31q.exe
3420	5ps1s3h2e8.exe
3420	5ps1s3h2e8.exe
3420	5ps1s3h2e8.exe
3420	5ps1s3h2e8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3468	Explorer.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1376	SvcHostAnalyzer.exe
1376	SvcHostAnalyzer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	izienrp31q.exe
Token: SeLoadDriverPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	1376	SvcHostAnalyzer.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 2576	1156	1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe	89
PID 1156 wrote to memory of 5672	1156	1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe	90
PID 1156 wrote to memory of 2584	1156	1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe	91
PID 2584 wrote to memory of 3468	2584	izienrp31q.exe	51
PID 1156 wrote to memory of 4828	1156	1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe	93
PID 1148 wrote to memory of 1476	1148	WinUpdateHelper.exe	45
PID 1148 wrote to memory of 3468	1148	WinUpdateHelper.exe	51
PID 1148 wrote to memory of 4376	1148	WinUpdateHelper.exe	63
PID 1148 wrote to memory of 4428	1148	WinUpdateHelper.exe	64
PID 1148 wrote to memory of 4992	1148	WinUpdateHelper.exe	68
PID 1148 wrote to memory of 2684	1148	WinUpdateHelper.exe	84
PID 1156 wrote to memory of 2392	1156	1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe	96
PID 1156 wrote to memory of 3420	1156	1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe	97
PID 3468 wrote to memory of 2900	3468	Explorer.EXE
PID 3468 wrote to memory of 4220	3468	Explorer.EXE
PID 3468 wrote to memory of 1204	3468	Explorer.EXE
PID 3468 wrote to memory of 3208	3468	Explorer.EXE
PID 5672 wrote to memory of 5540	5672	7x6c72ru6o.exe	103
PID 5672 wrote to memory of 5540	5672	7x6c72ru6o.exe	103
PID 1156 wrote to memory of 1724	1156	1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe	102
PID 3740 wrote to memory of 3468	3740	izienrp31q.exe	51
PID 1156 wrote to memory of 2308	1156	1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe	110
PID 5704 wrote to memory of 1144	5704	svchost.exe	111
PID 5704 wrote to memory of 2552	5704	svchost.exe	113
PID 3468 wrote to memory of 3448	3468	Explorer.EXE
PID 5672 wrote to memory of 5664	5672	7x6c72ru6o.exe	117
PID 5672 wrote to memory of 5664	5672	7x6c72ru6o.exe	117
PID 3468 wrote to memory of 2556	3468	Explorer.EXE
PID 2392 wrote to memory of 5028	2392	kiy5qi0k5a.exe	121
PID 5672 wrote to memory of 932	5672	7x6c72ru6o.exe	123
PID 5672 wrote to memory of 932	5672	7x6c72ru6o.exe	123
PID 5672 wrote to memory of 2168	5672	7x6c72ru6o.exe	128
PID 5672 wrote to memory of 2168	5672	7x6c72ru6o.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1476

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\1188d1f47cfc3797e1eb004e531b11b7a191a21475d97226dfa607db380b650b.bin.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Users\Admin\AppData\Roaming\3cwmk4ew2x.exe
    "C:\Users\Admin\AppData\Roaming\3cwmk4ew2x.exe"
    3⤵
    - Executes dropped EXE
    PID:2576
- - C:\Users\Admin\AppData\Roaming\7x6c72ru6o.exe
    "C:\Users\Admin\AppData\Roaming\7x6c72ru6o.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2168
- - C:\Users\Admin\AppData\Roaming\izienrp31q.exe
    "C:\Users\Admin\AppData\Roaming\izienrp31q.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2584
- - C:\Users\Admin\AppData\Roaming\o2r5j8wrb2.exe
    "C:\Users\Admin\AppData\Roaming\o2r5j8wrb2.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4828
- - C:\Users\Admin\AppData\Roaming\kiy5qi0k5a.exe
    "C:\Users\Admin\AppData\Roaming\kiy5qi0k5a.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\ProgramData\ajjwv.exe
      "C:\ProgramData\ajjwv.exe"
      4⤵
      Executes dropped EXE
      PID:5028
- - C:\Users\Admin\AppData\Roaming\5ps1s3h2e8.exe
    "C:\Users\Admin\AppData\Roaming\5ps1s3h2e8.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3420
- - C:\Users\Admin\AppData\Roaming\v33pr045mv.exe
    "C:\Users\Admin\AppData\Roaming\v33pr045mv.exe"
    3⤵
    - Executes dropped EXE
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\BLTools v3.0.0[PRO].exe
    "C:\Users\Admin\AppData\Local\Temp\BLTools v3.0.0[PRO].exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2308

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4428

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000270;0000000000000274;
1⤵
PID:4992

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:2684

C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
"C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
"C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1148

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
- Executes dropped EXE
PID:248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4788

C:\Users\Admin\AppData\Roaming\izienrp31q.exe
C:\Users\Admin\AppData\Roaming\izienrp31q.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1400

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:2012

C:\Users\Admin\Pictures\svchost.exe
C:\Users\Admin\Pictures\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /query /tn "Google Updater Task"
  2⤵
  PID:1144
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Google Updater Task" /tr "C:\Users\Admin\AppData\Roaming\zgicfl.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2552

C:\Users\Admin\AppData\Roaming\zgicfl.exe
C:\Users\Admin\AppData\Roaming\zgicfl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1532

C:\ProgramData\ajjwv.exe
C:\ProgramData\ajjwv.exe
1⤵
- Executes dropped EXE
PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1152

C:\Users\Admin\AppData\Roaming\zgicfl.exe
"C:\Users\Admin\AppData\Roaming\zgicfl.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:720

C:\Users\Admin\AppData\Roaming\zgicfl.exe
"C:\Users\Admin\AppData\Roaming\zgicfl.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1132

C:\Users\Admin\AppData\Roaming\zgicfl.exe
"C:\Users\Admin\AppData\Roaming\zgicfl.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

71003C79-2EE2-7465-06F1-0A1DEEE9B255.txt

Path C:\ProgramData\71003C79-2EE2-7465-06F1-0A1DEEE9B255.txt
Size 64B
SHA256 9beb44879256fb69c7aedd1a77a01416277e29c0fbd945a756305ae4b828a40e
MD5 2d2a84fda15ea3c84d17d439e0157f2e
SHA1 9007718163ec6bfbe32f8b4676a3ba4a89930566
SHA512 92c84c287f86fe356e875dab08ea782d6ccd0a7a9f39424003e3f10cfcf0c1aff27637ea7854a0d6ba2dfb8c56db0791599f2d976c257e3622ecdd69bcf4c049
TLSH
T12EA002DC45584268512F6527B6F5CB3E6C040120954CA0F5B9C5134112168541417B82
MD5 SHA1 SHA512 TLSH

Submit Download

BLTools v3.0.0[PRO].exe

Path C:\Users\Admin\AppData\Local\Temp\BLTools v3.0.0[PRO].exe
Size 3.2MB
SHA256 6f1af955e04776e5b592f5a820a99c343e3b02444cf823503311d87a71173f07
MD5 df57f4de4f92511aa86da16c323c181f
SHA1 dd45800913d998753252b81164979a90620b8d10
SHA512 41ae4e46c5e0fc75442ed6bec0ac2d8bad7c67005b76d3dcbf4de7f5c35b774b4366f20a2d1849582e46ecf36661005051dceecb418db6b0d3ccfe0e209d2b48
SSDEEP 49152:v182v7xeiZLx/He9pTXIl41zrRay7o+CeYs2EHyiZufp2zbfsqqLaqTrg:C2TQguT4l41PRno+Cev2E9ucwLxrg
TLSH
T163F502157EE69927F2F20BBAE47640F04A33BC11AD06DB5F2450BE5F3972A92DC20716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SvcHostAnalyzer.exe

Path C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
Size 147KB
SHA256 5847e5335818953dfb13c349a7f1b530c5a75a0ff671b471b5e6d8f9b55b23e8
MD5 a641a6184845dfbbb5f0fff2e3a059f2
SHA1 01d66a8288c5c7078c0f8b75aae610a40ac5585a
SHA512 b22568b179f3be8e9149c3960ca151383ad64f50c0a6f519dc2574e81d4f0711dbf972e961f4aec32b0941257e4f085992582bb62fa7de62de956eea5173818d
SSDEEP 3072:nkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:gyrWpAKhhvORHJ
TLSH
T157E35A4363E920E9F1778678C9A58A46E771B83207209BEF07E0465A4F237D1ED3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinUpdateHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
Size 38KB
SHA256 14960f501cf2ab10639dfb062822a67d57be84c39907238922c484da9cf8857b
MD5 bc327d54c54b2eb6853edf82a8566cbc
SHA1 c60343637e93a67830977658f7063934ba2baf3c
SHA512 7d100a63da9a6b83c924590645a46f9c60939c0631af75441967ae0793dcfc87b9fe4145ce192413db0abb0e9f786f9046910d3597f1c28d608fd9c13845a0b7
SSDEEP 768:zfBM20cIyxOjLjze7PkiYtVeXnvJBzOP16OSIBsNk5iZ1h2:zO20cIyxOjkcieovJ1e8Omk5I2
TLSH
T142033A27ABD642CBD8A19EB0F5F04E37E2E1F465A498DE4F4330E82C5F9A052D518B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cwmk4ew2x.exe

Path C:\Users\Admin\AppData\Roaming\3cwmk4ew2x.exe
Size 192KB
SHA256 3845afe4fe188c2691a4a3fd13e589de77deb5f550455e56f5e5e182181644da
MD5 c140bc2d4e5a4340128e21a5fb3e3347
SHA1 57e4c97ae681243af8091eadb0d9bfb922d362e4
SHA512 27d68fb51afa5534b09fda0428fd956cf883ee1cb9621cfe54e24bb2e5e9b03dbea1cdbed4fcd0316b5eda7214b8736dc432eeabfaface27a4db364a0c03422d
SSDEEP 3072:q10cYkCove5nI2EkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:q101joonIYyrWpAKhhvORHJ
TLSH
T1D4146B4763E921EAE0B68A74C9E54A46E7B1B4321310DFEF07A086194F237D1ED3CB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ps1s3h2e8.exe

Path C:\Users\Admin\AppData\Roaming\5ps1s3h2e8.exe
Size 1.3MB
SHA256 722bd4df8cbfc74ec64bc8cb449856160251099bd416fd70e26161917034ae2d
MD5 5645c1c3a6390aeec9b0ac9372517bb0
SHA1 1732840ad569c056fa9aa8c4fa310e7dd8787df9
SHA512 d8bdbeba45eda99b6b17116f1b393c4d8e2e8b312a5a7482164ffbfc28091bcb7b0b696703be571aeb2f2e64c35bc8896fe03ed2b8d98915c391ccaa2b60fdf9
SSDEEP 24576:qF2+fPeS080OrBjWACMs9qpL5KImt0y+S5G0GgDy:ZSKO9KACMsjhtIC
TLSH
T18F559E4AB2B400FCD557C178C5165A0FEBB278061374ABDF5298CA5A6F13FE11A7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7x6c72ru6o.exe

Path C:\Users\Admin\AppData\Roaming\7x6c72ru6o.exe
Size 767KB
SHA256 efe7eb517cc449cc7721c5c0acfb8cf454f28fdf2f37c08854aad4deefd7edc9
MD5 f87fd8891c767f0695e85728f238d33b
SHA1 84ca77ca0b27789b8236978ef3fb8cf774597555
SHA512 fa553eb7d793ca820b46131a354a35840f7bbc4050a7b2ef2cd1e182f21f305c3607e40042e3eb47529e1ca74ee724d0732dc3c50212dccb3c3065077401695a
SSDEEP 12288:TrHqQr5XgvVozsROaYzPIP17vMKrrhYyxBlDetAqxSv:nPgvVqsI0d70eVYyb
TLSH
T195F48D1EF7A612F8D0B7C274CA428952E77278465370978F03E15AAA5F372905F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

izienrp31q.exe

Path C:\Users\Admin\AppData\Roaming\izienrp31q.exe
Size 333KB
SHA256 e1743a2f00c39034f99bafd44d023005982e245bb7d435e456b6dfb4de87be6b
MD5 f816559cdc8d720d0ecd7a1727e41434
SHA1 8e16073f45df4cbf42672c69f281d7ed71023c25
SHA512 71069239d3d70ae9ada9bf634c68ee8b532a92a1c7d00e6d88166488092ec01b1ddf43b54619ed9d639d8a02475b758da00fef9ba8644d1ed38a7f3792f8feb7
SSDEEP 6144:Q6YaTDvpL7IF/Kz8plA4omkla3VbwXDhAYSzf5U:QCIvplsvla3VENABzfG
TLSH
T134745B45B6A40CFDE967827CC9A34A06D7B2B8560770EBCF03A046965F277D09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kiy5qi0k5a.exe

Path C:\Users\Admin\AppData\Roaming\kiy5qi0k5a.exe
Size 165KB
SHA256 0e12143a4b0dfc48f4bf791c90e5fd64fa6529c9a493755015aa210b13a804d6
MD5 11300ae5a0e3b41d5f8fddeab7cc77d3
SHA1 d71346dc872207727270bb08097f14e07e2dedd9
SHA512 f52c3bf2a7e45baa0d14af73a2d1516582eb208062667294ea87adeafb88a13135c6ce1a6c328ae285be71d29b4165fe95896ea7c114f33754871c5710a90197
SSDEEP 3072:6VWeDmfnP+SMIwTjAGrN3ooK26D76NbQ4SZOr+gUFk+ZqK5vYKe:imfnP+S9wT8GrWzH6+4S8+Obw
TLSH
T1AEF34D0A336460F4E5779278CDA25B46E7B2787A17B1634E437443BA5F332919E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o2r5j8wrb2.exe

Path C:\Users\Admin\AppData\Roaming\o2r5j8wrb2.exe
Size 253KB
SHA256 2e309c9c67e75edfcb019c91d8a5b12b0b7c0791ef440974bf49fabbc5ce05a9
MD5 a0b8ed5f2bca57d2b04f46f44168ac07
SHA1 6e748321823b8b8381336492be85f00138f6cf27
SHA512 1d565ea6485cac6e48bff60a116c00b5d970fccd2404acbc60b300007d84b00b827769caffa47c32e5d57eb70922a19dd8e6813def3e6064e1abda1aba6c1663
SSDEEP 6144:OqloHD2cTDiKB/Ap819VlD+mvmuXnxNVZKoI:Oql6nTDiKB/ApY5+m+uXX
TLSH
T1B6446C15B7A40CFDE97B813DC9524906EB727C560760EACF07A04A975F23AE09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v33pr045mv.exe

Path C:\Users\Admin\AppData\Roaming\v33pr045mv.exe
Size 281KB
SHA256 6537c644a1ce34f24826e67370eccf1cf91779fad3fd75031aa91b24d0e9214c
MD5 94d41b8d14809751b5518c85a7140d23
SHA1 eb8d67bfe6007b39244223e470a668701d82733d
SHA512 2105c1478ab03d8230ac967a0f9ce6f40a62b81717a80e577663c9e54b4eb88c40eb8b0684f7210e9417fd62ccc21ffd998cd12ef51d9e64f75693073dade7eb
SSDEEP 6144:jQEaoT5RIRJ0y4vAaXmn/hfLY4yISLzdc:jQDoTIRW9zXKhfUmSL5
TLSH
T121546B1AB7640CF9EE6BC23DC9524905DB72BC5657A1E7CF03A04A961F236E08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-48-0x00007FF945DE0000-0x00007FF946043000-memory.dmp

Download

memory/1476-49-0x000002434DFD0000-0x000002434DFD3000-memory.dmp

Download

memory/2012-115-0x00007FF945DE0000-0x00007FF946043000-memory.dmp

Download

memory/2308-121-0x00000000005E0000-0x0000000000D0E000-memory.dmp

Download

memory/2308-133-0x0000000003060000-0x0000000003061000-memory.dmp

Download

memory/3468-109-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-32-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-28-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-23-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-22-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-34-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-33-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-30-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-26-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-137-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/3468-78-0x0000000005B10000-0x0000000005B11000-memory.dmp

Download

memory/3468-77-0x0000000005B00000-0x0000000005B01000-memory.dmp

Download

memory/3468-76-0x0000000002F50000-0x0000000002F51000-memory.dmp

Download

memory/3468-75-0x0000000002F40000-0x0000000002F41000-memory.dmp

Download

memory/3468-29-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-31-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-108-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-27-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-24-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-110-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-21-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-37-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-19-0x0000000002E60000-0x0000000002EA0000-memory.dmp

Download

memory/3468-104-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-107-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-106-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-105-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-100-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-99-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-98-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-97-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-103-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-102-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-101-0x0000000006480000-0x00000000064C5000-memory.dmp

Download

memory/3468-25-0x0000000002EA0000-0x0000000002EE5000-memory.dmp

Download

memory/3468-134-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/4992-54-0x000001ABC7F10000-0x000001ABC7F17000-memory.dmp

Download