salatstealer | 05bb9b64dbd3c91383d768c699662c1fbbebd52b2cb64d64b6a06992d7fa57bf

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 24.0MB
Sample260703-e234wsbt81
SHA256 05bb9b64dbd3c91383d768c699662c1fbbebd52b2cb64d64b6a06992d7fa57bf
MD5 4cb108c05caed94af5cc3d396e45b898
SHA1 1099579bf9a85e77c0a9b02e979ee2e8626b1b62
SHA512 7a5257e44f68a94cd5fe8b91fc25186d9834f949a3c73653a9e21ce4e55bad04acb04029870b358211c335db849dd96cee639af5d2ed87d63cd3d594e199cb8a
SSDEEP 393216:aHtkW+tHjAQ4Mp/byVDJdfGukZ+0DQkSzbrx5AxYx+5xVgPI5a4se0i1509GHN:okW+Njbdp/WxfGukZZPirtx+xgd4se0w
TLSH
T16D47336CE3E102FCF41B053D49B1C934B63AB99A1751D93B0A794E827EA3AE45537B30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery salatstealer spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 15 IoCs

resource	yara_rule
behavioral2/memory/4220-101-0x0000000000DD0000-0x000000000195E000-memory.dmp	family_salatstealer
behavioral2/memory/4220-102-0x0000000000DD0000-0x000000000195E000-memory.dmp	family_salatstealer
behavioral2/memory/4220-103-0x0000000000DD0000-0x000000000195E000-memory.dmp	family_salatstealer
behavioral2/memory/4220-104-0x0000000000DD0000-0x000000000195E000-memory.dmp	family_salatstealer
behavioral2/memory/4220-112-0x0000000000DD0000-0x000000000195E000-memory.dmp	family_salatstealer
behavioral2/memory/4776-113-0x0000000000D80000-0x000000000190E000-memory.dmp	family_salatstealer
behavioral2/memory/4776-114-0x0000000000D80000-0x000000000190E000-memory.dmp	family_salatstealer
behavioral2/memory/4776-115-0x0000000000D80000-0x000000000190E000-memory.dmp	family_salatstealer
behavioral2/memory/5408-122-0x00000000002D0000-0x0000000000E5E000-memory.dmp	family_salatstealer
behavioral2/memory/4776-123-0x0000000000D80000-0x000000000190E000-memory.dmp	family_salatstealer
behavioral2/memory/4776-124-0x0000000000D80000-0x000000000190E000-memory.dmp	family_salatstealer
behavioral2/memory/4776-125-0x0000000000D80000-0x000000000190E000-memory.dmp	family_salatstealer
behavioral2/memory/4776-126-0x0000000000D80000-0x000000000190E000-memory.dmp	family_salatstealer
behavioral2/memory/4776-128-0x0000000000D80000-0x000000000190E000-memory.dmp	family_salatstealer
behavioral2/memory/4776-129-0x0000000000D80000-0x000000000190E000-memory.dmp	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 15 IoCs

resource	yara_rule
behavioral2/memory/4220-101-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4220-102-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4220-103-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4220-104-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4220-112-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4776-113-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4776-114-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4776-115-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5408-122-0x00000000002D0000-0x0000000000E5E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4776-123-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4776-124-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4776-125-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4776-126-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4776-128-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4776-129-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 15 IoCs

resource	yara_rule
behavioral2/memory/4220-101-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4220-102-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4220-103-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4220-104-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4220-112-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4776-113-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4776-114-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4776-115-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5408-122-0x00000000002D0000-0x0000000000E5E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4776-123-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4776-124-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4776-125-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4776-126-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4776-128-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4776-129-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 15 IoCs

resource	yara_rule
behavioral2/memory/4220-101-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4220-102-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4220-103-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4220-104-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4220-112-0x0000000000DD0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4776-113-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4776-114-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4776-115-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5408-122-0x00000000002D0000-0x0000000000E5E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4776-123-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4776-124-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4776-125-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4776-126-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4776-128-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4776-129-0x0000000000D80000-0x000000000190E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 19 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001b586-98.dat	UPX
behavioral2/memory/4220-100-0x0000000000DD0000-0x000000000195E000-memory.dmp	UPX
behavioral2/memory/4220-101-0x0000000000DD0000-0x000000000195E000-memory.dmp	UPX
behavioral2/memory/4220-102-0x0000000000DD0000-0x000000000195E000-memory.dmp	UPX
behavioral2/memory/4220-103-0x0000000000DD0000-0x000000000195E000-memory.dmp	UPX
behavioral2/memory/4220-104-0x0000000000DD0000-0x000000000195E000-memory.dmp	UPX
behavioral2/memory/4776-111-0x0000000000D80000-0x000000000190E000-memory.dmp	UPX
behavioral2/memory/4220-112-0x0000000000DD0000-0x000000000195E000-memory.dmp	UPX
behavioral2/memory/4776-113-0x0000000000D80000-0x000000000190E000-memory.dmp	UPX
behavioral2/memory/4776-114-0x0000000000D80000-0x000000000190E000-memory.dmp	UPX
behavioral2/memory/4776-115-0x0000000000D80000-0x000000000190E000-memory.dmp	UPX
behavioral2/memory/5408-121-0x00000000002D0000-0x0000000000E5E000-memory.dmp	UPX
behavioral2/memory/5408-122-0x00000000002D0000-0x0000000000E5E000-memory.dmp	UPX
behavioral2/memory/4776-123-0x0000000000D80000-0x000000000190E000-memory.dmp	UPX
behavioral2/memory/4776-124-0x0000000000D80000-0x000000000190E000-memory.dmp	UPX
behavioral2/memory/4776-125-0x0000000000D80000-0x000000000190E000-memory.dmp	UPX
behavioral2/memory/4776-126-0x0000000000D80000-0x000000000190E000-memory.dmp	UPX
behavioral2/memory/4776-128-0x0000000000D80000-0x000000000190E000-memory.dmp	UPX
behavioral2/memory/4776-129-0x0000000000D80000-0x000000000190E000-memory.dmp	UPX

Executes dropped EXE 7 IoCs

pid	Process
3048	main.exe
1180	main.exe
5088	tgceccfxtuqz.exe
2664	tgceccfxtuqz.exe
4220	ixqjfruotmqa.exe
4776	WmiPrvSE.exe
5408	WmiPrvSE.exe

Loads dropped DLL 20 IoCs

pid	Process
5796	2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5796	2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5796	2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5796	2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1180	main.exe
1180	main.exe
1180	main.exe
1180	main.exe
1180	main.exe
1180	main.exe
1180	main.exe
1180	main.exe
2664	tgceccfxtuqz.exe
2664	tgceccfxtuqz.exe
2664	tgceccfxtuqz.exe
2664	tgceccfxtuqz.exe
2664	tgceccfxtuqz.exe
2664	tgceccfxtuqz.exe
2664	tgceccfxtuqz.exe
2664	tgceccfxtuqz.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001b586-98.dat	upx
behavioral2/memory/4220-100-0x0000000000DD0000-0x000000000195E000-memory.dmp	upx
behavioral2/memory/4220-101-0x0000000000DD0000-0x000000000195E000-memory.dmp	upx
behavioral2/memory/4220-102-0x0000000000DD0000-0x000000000195E000-memory.dmp	upx
behavioral2/memory/4220-103-0x0000000000DD0000-0x000000000195E000-memory.dmp	upx
behavioral2/memory/4220-104-0x0000000000DD0000-0x000000000195E000-memory.dmp	upx
behavioral2/memory/4776-111-0x0000000000D80000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/4220-112-0x0000000000DD0000-0x000000000195E000-memory.dmp	upx
behavioral2/memory/4776-113-0x0000000000D80000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/4776-114-0x0000000000D80000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/4776-115-0x0000000000D80000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/5408-121-0x00000000002D0000-0x0000000000E5E000-memory.dmp	upx
behavioral2/memory/5408-122-0x00000000002D0000-0x0000000000E5E000-memory.dmp	upx
behavioral2/memory/4776-123-0x0000000000D80000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/4776-124-0x0000000000D80000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/4776-125-0x0000000000D80000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/4776-126-0x0000000000D80000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/4776-128-0x0000000000D80000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/4776-129-0x0000000000D80000-0x000000000190E000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\e90b00cf-21aa-c1f8-bbb2-345ff539cf21	ixqjfruotmqa.exe
File created	C:\Program Files (x86)\Reference Assemblies\fontdrvhost.exe	ixqjfruotmqa.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\e90b00cf-21aa-c1f8-bbb2-345ff539cf21	ixqjfruotmqa.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe	ixqjfruotmqa.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe	WmiPrvSE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ixqjfruotmqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiPrvSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiPrvSE.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4852	timeout.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4220	ixqjfruotmqa.exe
4220	ixqjfruotmqa.exe
4220	ixqjfruotmqa.exe
4220	ixqjfruotmqa.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe
4776	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 5796	4700	2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 5796 wrote to memory of 3048	5796	2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 5796 wrote to memory of 5300	5796	2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 3048 wrote to memory of 1180	3048	main.exe	91
PID 5300 wrote to memory of 6112	5300	cmd.exe	93
PID 5300 wrote to memory of 6140	5300	cmd.exe	94
PID 5300 wrote to memory of 4852	5300	cmd.exe	95
PID 1180 wrote to memory of 5088	1180	main.exe	96
PID 5088 wrote to memory of 2664	5088	tgceccfxtuqz.exe	97
PID 2664 wrote to memory of 4220	2664	tgceccfxtuqz.exe	98
PID 4220 wrote to memory of 4776	4220	ixqjfruotmqa.exe	100
PID 4776 wrote to memory of 5408	4776	WmiPrvSE.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-03_4cb108c05caed94af5cc3d396e45b898_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Users\Admin\AppData\Local\Temp\merged_app_ntvrpfoz\main.exe
    C:\Users\Admin\AppData\Local\Temp\merged_app_ntvrpfoz\main.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\merged_app_ntvrpfoz\main.exe
      C:\Users\Admin\AppData\Local\Temp\merged_app_ntvrpfoz\main.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\tgceccfxtuqz.exe
        
        C:\Users\Admin\AppData\Local\Temp\tgceccfxtuqz.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\tgceccfxtuqz.exe
        
        C:\Users\Admin\AppData\Local\Temp\tgceccfxtuqz.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\ixqjfruotmqa.exe
        
        C:\Users\Admin\AppData\Local\Temp\ixqjfruotmqa.exe
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe"
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe" -
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\merged_app_ntvrpfoz\additional.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5300
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:6112
  - - C:\Windows\system32\mode.com
      mode con cols=120 lines=40
      4⤵
      PID:6140
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30482\_bz2.pyd
Size 84KB
SHA256 64d9fbb516e08a6780dca160e40d8c6723d2a659b5ca3020de7a041305b3a3d4
MD5 7098611e0258f8bd1ed5ecb971c88763
SHA1 009b95baaeb3cd8b1012a8af487d52c091381cb3
SHA512 ad44afc2962e746c9720d33b490445c05e0dbd6a70acf568d5e0bd1138d092d2e49f89c51aab6a2a6b5e6ac4bacc771816b76963bae15553e8ee630af70ccaff
SSDEEP 1536:udsvXm8z7+Cnqncm4WlTtdKSzBdzM8yOBs8iMtIeLV8yG5TT/9vfIZRzz:qsvXm8zaYqRptX7zvyOC8htIeLVmpSZl
TLSH
T1B7836D86F36552B6F99BD1B886800793F730BB950B50A36FF148C2993F13B916E5C319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30482\_ctypes.pyd
Size 131KB
SHA256 b9c9e713f11e111daa55e4a62a135d7e385fa7aa0986d30b286d000e122b13aa
MD5 1606ace764f2b3ca8ab20cada221cf56
SHA1 ff63d15ea0b6b0c52deceab3f54c671a44e5e8f2
SHA512 658df5ed480cebc92685aa617c2ec5a5ff0c8613d420bcc3dbea0af0e1f7274c6963605f6284a69d3df40d075b02310fa35c361a176f5a2d80c2510db5290fc0
SSDEEP 3072:gaSQJ/VrFMXqvN2Ptf/Fm02R0JrsgvGzhIeyPxp5:oQJ/V1Ef/Fm082rsgAe
TLSH
T12DD37D0B776800AADAA39174C173AF47EBB1B453171047CF02A4C69A2F63792AE7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30482\_hashlib.pyd
Size 67KB
SHA256 1e079c6b44488e273bc62d9bcb27cec519e9916b47b8c2878ebade0772e0f484
MD5 82c0261589ab1c473c765d3ff36f9f8b
SHA1 293d34cd3108861976373c4972e634fb83f70a4a
SHA512 3db1062db85fe5e6fb37b3e769c6d9fe459714761b27f597d7f693296522411912e2730f2d613c66601fa0dec97c3ad9563166775d9107bc59a36f5282e79822
SSDEEP 1536:xqXn1xAu1lEAXfXtfcV5TaPutFCAFIevIWyG5TT/9VfIW44Dkr2u:C1l1uA1fcyPutFCAFIevIcpYW4Ik2u
TLSH
T1D8637B95AA884092E96382B5C4A34F83FD75F35257119BCFA2A8C0CD2F233C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30482\_lzma.pyd
Size 155KB
SHA256 999ba26fe0b0376b7898d50ddb2f5012e7a64228e31fcdca99a4d7079df669e3
MD5 b7100b8fb3c579c848d8960b927d322f
SHA1 f6303fd3e27b93b7f0ff8251ca85636d01dc19d9
SHA512 9e778f62e28dc105d54211a9b708fd51cff9e7b53e79b78e73461fdd495c78b9091dd11e2a6522a82088a76cb356fc7176706afe519f8bfab1287285aeb27f6f
SSDEEP 3072:IqZ/boPLmhrKifqGDRJUsTznfB9mNo9vm28fgS+tIe01Lfp2/Ih:IeTgLhyvUsv5YO9Cfd+Qfk
TLSH
T10BF35C86B794F0D5F7728C38D2624F57E6F5781A0320929A01CC976D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI30482\base_library.zip
Size 1.3MB
SHA256 c1b4d09a92cc685d224f969b8ff5d34a2dea81a822a59f6127b030b3793714ca
MD5 4133904ce8bf876474c12d97e3b7b335
SHA1 39395570c166fe55924ae094ccf1998ae7f11edf
SHA512 9d57fc28f23a173988bbf6ab8bd2870f0000afe9d8311a2066bbafd4fb07d04d1b7517bee51c41851dde4fe24fc5514451f0b353fc21f42c80b974e608b45dde
SSDEEP 12288:XFUDqfdL+DhP67ifdjdTji2cPPdxhYEF8qhT75dCW7Wp85dwtOtYzGNcT1uuIva7:sdZj5cPPdxhYdqR7Wp8LsSeT1ul+D
TLSH
T139551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30482\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30482\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30482\python313.dll
Size 5.8MB
SHA256 c9f98606d0d06f4e8ae75ae385021e58b57c90d4fd325c0313c8c42abe1ebf63
MD5 48edb6a0be2bfee5b83e2c31675511e5
SHA1 43a1c8df434401901a5529cac03a664a5e64be71
SHA512 2b6ea04ef35085355bd9ee077ef533f80481d85a5b7d60c1756d06369313c4c39157018e76e30f4974eabdc6abba81bf6ec7cecc477cdee350acde7796567122
SSDEEP 98304:I8uWXsdqWZobQdaehM91cnivzHDMiENKULAd:puWmqeobQdaepiFULAd
TLSH
T1EA567C12729E51ACD9778078CA038A4BF7B27C413F60534B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_bz2.pyd
Size 84KB
SHA256 df21ec68d062eb375dba4ea8332aa859d0d4b91f9eddc45e1cebfd54742044e2
MD5 bcbc321b91892f43cabe8428e803d83b
SHA1 c7db6eedfa9b28d131c11a4d0513a2675dc5b286
SHA512 a64a0cb601109f2ce5bfe20635e53ac04b360e9732b844083c288711bd8b674a67b6cb2b0b56c66584e986c0c16ebbcdcb0e907cca16a7e035a71ff028ed520d
SSDEEP 1536:vwSHVz7omiqvcmgWkT8dtGCBqtbe8kEsRm75pIjLVEyvcvR9wfIk4vH:vRHVz0lqpm8vGVb5kXipIjLVol
TLSH
T194838E96E3A542F6F99B91B886840793F730BB960750A36FF144C2893F13BD06E9C359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_lzma.pyd
Size 155KB
SHA256 1ddce9934889905b482f8587656f28ae1988365a55ae86ca4438873fd0184340
MD5 ad90d5a76fb77b395450308a5a1d39a5
SHA1 4431fdc99b1400392f68e2d10a4b490e4d881c7e
SHA512 4f3f23d36a8397392e139ff7aee3cebe720ce400aa0e025f69575615eed024c4f871fe7bc372c42b253ecbfd55e84b319b437c2b536fdb8d88b67ea8683f913f
SSDEEP 3072:mqZ/boPLmhrKifqGDRJUsYznfB9mNoMvmiRnS+pIj01YVP:meTgLhyvUsu5YOMnS+Ut
TLSH
T106F34C86B794F0D6F3728C38D6624F57E6F5785A0320929A01CC936D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

additional.bat

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\additional.bat
Size 2KB
SHA256 57f3766d17e45ede2cdf8375a7b33b7804662ad3eda0777135049e56a18d2620
MD5 0f90ecd5483dbbfb594ffcdae5730478
SHA1 639220c883ad4115adacfba0b5c0fc808b8cec91
SHA512 49183b4e7c3b04b784efc2430f36e8d1a863a82eb8789f87def7baf0d75978d533dbf6326951a35eb2c9e0c9999bab40b42a943913400389cbdb79d7dba1b55a
TLSH
T19851693AA0856750466C0C2359B0FCAD7B646AC7CF375914F4EA81E49C76FB0AE586F0
MD5 SHA1 SHA512 TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\base_library.zip
Size 1.3MB
SHA256 b4dece4df90261a6f720be00dbf8bb0fb04f5f9e7666ea33bca5600b46fad159
MD5 6be0d32f27191e33ae814148c9b9a2b3
SHA1 60b01b687a4efab631ff2632e03d786750f31979
SHA512 7cf30c1b0401fe326c4401ed07e6893f86e2fa32d9c5967fc2965f5b9e45150baf1afd003af1d0bedc43b09c12c88baf1c7cab9f7830974209d3a41b8fb1f097
SSDEEP 12288:15si2cPPdxhYRdjdT3L+DzjjEAJW7Wp+y6GdFUDqf4Tjwt3uIva80201jwCVRDV8:w5cPPdxhYRdZyjg7WpSv0lbSuTxiNS
TLSH
T1E7551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\main.exe
Size 17.3MB
SHA256 6eabbadf96602e3fb6f3d3c8455c2d8798c83b8faddc1b9945cf43215c6fc313
MD5 31e4227ff8f6ab67dde816df68d03a64
SHA1 442fbdb6d57bcbf75e51f83098995f491e95b9ec
SHA512 bdd0b0a0b9555dfab80b083b0c0d5fe40db494cb7d532bfd0073c37e818dfe62cc95b23cba9dada546890cd5ddcf1b50d481349bb669725ed7360dae31b0a0ef
SSDEEP 393216:/2aW1bBgr3JZdeAmlyOdeqE5PrzBBsrW+tHjRp6fBkwLY:+P1bGjZeAmllvCrgW+NjQBkwLY
TLSH
T1D107331C97E202F9F81B453E4CA9C536F636F9451351C62B0BAD080A7E67AB9253BF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\python313.dll
Size 5.8MB
SHA256 265a27242ee97f81eeac6a556fd7de56baff2222f2334386d8f948e359a649d8
MD5 6aa80c7706a9f1638fe6076c9934db8e
SHA1 b922f6a19a6349607753bec54af07207a2788a81
SHA512 24df17179656feca73776a03a8907676ee1b408266cce9c6646c5106b2cb1c403b88a9697ee8b7d82c726eb2542587f2f91bfbe2950f3be2d501cffb7847f778
SSDEEP 49152:CW+zL84N/BRqK1Ww9errjThuTmsoVmlqxRKkMhXWNOzsf0I4TxHBPcYyK8Nh1U/w:Cx/Bs3jykmsxM7n+Nh1Lv5HDMiEJwb
TLSH
T161567C12729D41ACC9BB8078CA13864BFBB27C153F60434B61A6BB5D2F737624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50882\base_library.zip
Size 1.3MB
SHA256 be90a179629dbb0b634c1287218aec6d2e93ec85e4ad6a580df445111829ee8f
MD5 5891df52015d1235aba1e51e4dced296
SHA1 86cb5ed1f385bffdeaf11b39c7b2e00606643223
SHA512 f27b8ce126098f3e152a060215817fb74439959baa830f4a3b711f6e1ae5e707e6098b9333c1419fb9fcfc231a9e9cac94524bebfc0c190c10de0406b92e82b2
SSDEEP 12288:PYfiii2cPPdxhYc5/DW7WpiL+D5uIva80201jwCVRDVoioSYBpqhTsdjdTA236yY:65cPPdxhYr7WpzlpqudZA0sSeT1Df
TLSH
T1F1551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ixqjfruotmqa.exe

Path C:\Users\Admin\AppData\Local\Temp\ixqjfruotmqa.exe
Size 3.1MB
SHA256 a6fb743a601c3c54e6e1ed23863c29374e94f172cb8aa77d63bed58a0b1c53ef
MD5 de530eb1b64394410eb05e5b309087b5
SHA1 7c392528a37fd98a17204144c94362348a786103
SHA512 33d6efba226c92170ddc94b902f920e3b6790b547e8d0058252e3b9186317353783da8e3d654dc82e511427cd0a922d73cecf59895a1e92b8db816e36dcb64af
SSDEEP 49152:UwtNQh0RnwrkrvHJPG9GKG0U/IuIrx9628AWOsYe9+md:b3cgnv7HJPGLU/ZIPnFWOsr+md
TLSH
T1B6E533F10897E472C69F92FE1F6078312163FF0ED7DDB1A85F9841EB25A185322991E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tgceccfxtuqz.exe

Path C:\Users\Admin\AppData\Local\Temp\tgceccfxtuqz.exe
Size 10.2MB
SHA256 a6a3eff5e475d87da90817b4c22ac8b9a13ad909d21debb1398a2f52af2b5462
MD5 6201d853295814c41c2ab31044079729
SHA1 8960415350563763bd59e01dc10b539ced7a1598
SHA512 e2fa75ec962ca44718d9cba742f485f4f03abc1ee115b91be9aa46272710bd077b8b570872b54df75d0266806b1d2080caf4d9bb20994898db96aaf7a946a77a
SSDEEP 196608:ERgP2FCK+nwKCpZGSG/3LEW+t2PKMmjP5g5Y6fBPM9q0ZmzR:ERzbIwZK/QW+tHjRp6fBkwLR
TLSH
T1A4B6335C93E006FAF067E43E4C54C12AA636BA29171190DB17B404692E3BBF6693FF35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4220-100-0x0000000000DD0000-0x000000000195E000-memory.dmp

Download

memory/4220-112-0x0000000000DD0000-0x000000000195E000-memory.dmp

Download

memory/4220-102-0x0000000000DD0000-0x000000000195E000-memory.dmp

Download

memory/4220-103-0x0000000000DD0000-0x000000000195E000-memory.dmp

Download

memory/4220-104-0x0000000000DD0000-0x000000000195E000-memory.dmp

Download

memory/4220-101-0x0000000000DD0000-0x000000000195E000-memory.dmp

Download

memory/4776-115-0x0000000000D80000-0x000000000190E000-memory.dmp

Download

memory/4776-113-0x0000000000D80000-0x000000000190E000-memory.dmp

Download

memory/4776-114-0x0000000000D80000-0x000000000190E000-memory.dmp

Download

memory/4776-111-0x0000000000D80000-0x000000000190E000-memory.dmp

Download

memory/4776-123-0x0000000000D80000-0x000000000190E000-memory.dmp

Download

memory/4776-124-0x0000000000D80000-0x000000000190E000-memory.dmp

Download

memory/4776-125-0x0000000000D80000-0x000000000190E000-memory.dmp

Download

memory/4776-126-0x0000000000D80000-0x000000000190E000-memory.dmp

Download

memory/4776-128-0x0000000000D80000-0x000000000190E000-memory.dmp

Download

memory/4776-129-0x0000000000D80000-0x000000000190E000-memory.dmp

Download

memory/5408-121-0x00000000002D0000-0x0000000000E5E000-memory.dmp

Download

memory/5408-122-0x00000000002D0000-0x0000000000E5E000-memory.dmp

Download