salatstealer | f240cffc7c0cda47a87d88a698de6135e9233f7ab257a3383e6059d62c18fffa

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 43.0MB
Sample260710-e6t2sac14p
SHA256 f240cffc7c0cda47a87d88a698de6135e9233f7ab257a3383e6059d62c18fffa
MD5 1c03e72fac5312a1c790063fb0267992
SHA1 24d06172e0ea8e67ebf652d101952b666c60d977
SHA512 49767857a2d717a683037f3145274264d74a83e2f5786f71a4e85d65e9964a9cc484d083a16047cf0bd6a1c6bc8c4a6fb14ff6ddac82cd5f2a4826b6b1ea8dfd
SSDEEP 6144:vVa1cwKDxu/5YlSJjLbpGAVHVJ8qus9Dx1za6xDkjZvsDGIm+W:Uqnx5OjpG0J8q/Ha4kFPItW
TLSH
T1D2A7AE19FA6404FDE167C178C9624906FA727C8A4370AACF13901AA75F376E49E7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 12 IoCs

resource	yara_rule
behavioral2/memory/5760-175-0x0000000000050000-0x0000000000C9F000-memory.dmp	family_salatstealer
behavioral2/memory/5760-196-0x0000000000050000-0x0000000000C9F000-memory.dmp	family_salatstealer
behavioral2/memory/5760-200-0x0000000000050000-0x0000000000C9F000-memory.dmp	family_salatstealer
behavioral2/memory/5760-228-0x0000000000050000-0x0000000000C9F000-memory.dmp	family_salatstealer
behavioral2/memory/5760-237-0x0000000000050000-0x0000000000C9F000-memory.dmp	family_salatstealer
behavioral2/memory/2164-238-0x0000000000650000-0x000000000129F000-memory.dmp	family_salatstealer
behavioral2/memory/2164-239-0x0000000000650000-0x000000000129F000-memory.dmp	family_salatstealer
behavioral2/memory/2164-240-0x0000000000650000-0x000000000129F000-memory.dmp	family_salatstealer
behavioral2/memory/4080-259-0x00000000003B0000-0x0000000000FFF000-memory.dmp	family_salatstealer
behavioral2/memory/2164-274-0x0000000000650000-0x000000000129F000-memory.dmp	family_salatstealer
behavioral2/memory/2164-275-0x0000000000650000-0x000000000129F000-memory.dmp	family_salatstealer
behavioral2/memory/2164-276-0x0000000000650000-0x000000000129F000-memory.dmp	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 12 IoCs

resource	yara_rule
behavioral2/memory/5760-175-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5760-196-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5760-200-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5760-228-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5760-237-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2164-238-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2164-239-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2164-240-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4080-259-0x00000000003B0000-0x0000000000FFF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2164-274-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2164-275-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2164-276-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 12 IoCs

resource	yara_rule
behavioral2/memory/5760-175-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5760-196-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5760-200-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5760-228-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5760-237-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2164-238-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2164-239-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2164-240-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4080-259-0x00000000003B0000-0x0000000000FFF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2164-274-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2164-275-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2164-276-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 12 IoCs

resource	yara_rule
behavioral2/memory/5760-175-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5760-196-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5760-200-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5760-228-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5760-237-0x0000000000050000-0x0000000000C9F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2164-238-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2164-239-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2164-240-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4080-259-0x00000000003B0000-0x0000000000FFF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2164-274-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2164-275-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2164-276-0x0000000000650000-0x000000000129F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 16 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c4c1-141.dat	UPX
behavioral2/memory/5760-148-0x0000000000050000-0x0000000000C9F000-memory.dmp	UPX
behavioral2/memory/5760-175-0x0000000000050000-0x0000000000C9F000-memory.dmp	UPX
behavioral2/memory/5760-196-0x0000000000050000-0x0000000000C9F000-memory.dmp	UPX
behavioral2/memory/5760-200-0x0000000000050000-0x0000000000C9F000-memory.dmp	UPX
behavioral2/memory/5760-228-0x0000000000050000-0x0000000000C9F000-memory.dmp	UPX
behavioral2/memory/2164-236-0x0000000000650000-0x000000000129F000-memory.dmp	UPX
behavioral2/memory/5760-237-0x0000000000050000-0x0000000000C9F000-memory.dmp	UPX
behavioral2/memory/2164-238-0x0000000000650000-0x000000000129F000-memory.dmp	UPX
behavioral2/memory/2164-239-0x0000000000650000-0x000000000129F000-memory.dmp	UPX
behavioral2/memory/2164-240-0x0000000000650000-0x000000000129F000-memory.dmp	UPX
behavioral2/memory/4080-256-0x00000000003B0000-0x0000000000FFF000-memory.dmp	UPX
behavioral2/memory/4080-259-0x00000000003B0000-0x0000000000FFF000-memory.dmp	UPX
behavioral2/memory/2164-274-0x0000000000650000-0x000000000129F000-memory.dmp	UPX
behavioral2/memory/2164-275-0x0000000000650000-0x000000000129F000-memory.dmp	UPX
behavioral2/memory/2164-276-0x0000000000650000-0x000000000129F000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4912	powershell.exe
4268	powershell.exe
3520	powershell.exe
4912	powershell.exe
4268	powershell.exe
3520	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
3	716	2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe
4	716	2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe

Executes dropped EXE 4 IoCs

pid	Process
5760	Service_1.exe
3960	Service_2.exe
2164	build.exe
4080	build.exe

Loads dropped DLL 2 IoCs

pid	Process
3960	Service_2.exe
3960	Service_2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000f00000001c4c1-141.dat	upx
behavioral2/memory/5760-148-0x0000000000050000-0x0000000000C9F000-memory.dmp	upx
behavioral2/memory/5760-175-0x0000000000050000-0x0000000000C9F000-memory.dmp	upx
behavioral2/memory/5760-196-0x0000000000050000-0x0000000000C9F000-memory.dmp	upx
behavioral2/memory/5760-200-0x0000000000050000-0x0000000000C9F000-memory.dmp	upx
behavioral2/memory/5760-228-0x0000000000050000-0x0000000000C9F000-memory.dmp	upx
behavioral2/memory/2164-236-0x0000000000650000-0x000000000129F000-memory.dmp	upx
behavioral2/memory/5760-237-0x0000000000050000-0x0000000000C9F000-memory.dmp	upx
behavioral2/memory/2164-238-0x0000000000650000-0x000000000129F000-memory.dmp	upx
behavioral2/memory/2164-239-0x0000000000650000-0x000000000129F000-memory.dmp	upx
behavioral2/memory/2164-240-0x0000000000650000-0x000000000129F000-memory.dmp	upx
behavioral2/memory/4080-256-0x00000000003B0000-0x0000000000FFF000-memory.dmp	upx
behavioral2/memory/4080-259-0x00000000003B0000-0x0000000000FFF000-memory.dmp	upx
behavioral2/memory/2164-274-0x0000000000650000-0x000000000129F000-memory.dmp	upx
behavioral2/memory/2164-275-0x0000000000650000-0x000000000129F000-memory.dmp	upx
behavioral2/memory/2164-276-0x0000000000650000-0x000000000129F000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\build.exe	build.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Service_1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4912	powershell.exe
4912	powershell.exe
4268	powershell.exe
4268	powershell.exe
3520	powershell.exe
3520	powershell.exe
3960	Service_2.exe
5760	Service_1.exe
5760	Service_1.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
4328	powershell.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
4328	powershell.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe
2164	build.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeIncreaseQuotaPrivilege	4912	powershell.exe
Token: SeSecurityPrivilege	4912	powershell.exe
Token: SeTakeOwnershipPrivilege	4912	powershell.exe
Token: SeLoadDriverPrivilege	4912	powershell.exe
Token: SeSystemProfilePrivilege	4912	powershell.exe
Token: SeSystemtimePrivilege	4912	powershell.exe
Token: SeProfSingleProcessPrivilege	4912	powershell.exe
Token: SeIncBasePriorityPrivilege	4912	powershell.exe
Token: SeCreatePagefilePrivilege	4912	powershell.exe
Token: SeBackupPrivilege	4912	powershell.exe
Token: SeRestorePrivilege	4912	powershell.exe
Token: SeShutdownPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeSystemEnvironmentPrivilege	4912	powershell.exe
Token: SeRemoteShutdownPrivilege	4912	powershell.exe
Token: SeUndockPrivilege	4912	powershell.exe
Token: SeManageVolumePrivilege	4912	powershell.exe
Token: 33	4912	powershell.exe
Token: 34	4912	powershell.exe
Token: 35	4912	powershell.exe
Token: 36	4912	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeIncreaseQuotaPrivilege	4268	powershell.exe
Token: SeSecurityPrivilege	4268	powershell.exe
Token: SeTakeOwnershipPrivilege	4268	powershell.exe
Token: SeLoadDriverPrivilege	4268	powershell.exe
Token: SeSystemProfilePrivilege	4268	powershell.exe
Token: SeSystemtimePrivilege	4268	powershell.exe
Token: SeProfSingleProcessPrivilege	4268	powershell.exe
Token: SeIncBasePriorityPrivilege	4268	powershell.exe
Token: SeCreatePagefilePrivilege	4268	powershell.exe
Token: SeBackupPrivilege	4268	powershell.exe
Token: SeRestorePrivilege	4268	powershell.exe
Token: SeShutdownPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeSystemEnvironmentPrivilege	4268	powershell.exe
Token: SeRemoteShutdownPrivilege	4268	powershell.exe
Token: SeUndockPrivilege	4268	powershell.exe
Token: SeManageVolumePrivilege	4268	powershell.exe
Token: 33	4268	powershell.exe
Token: 34	4268	powershell.exe
Token: 35	4268	powershell.exe
Token: 36	4268	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeIncreaseQuotaPrivilege	3520	powershell.exe
Token: SeSecurityPrivilege	3520	powershell.exe
Token: SeTakeOwnershipPrivilege	3520	powershell.exe
Token: SeLoadDriverPrivilege	3520	powershell.exe
Token: SeSystemProfilePrivilege	3520	powershell.exe
Token: SeSystemtimePrivilege	3520	powershell.exe
Token: SeProfSingleProcessPrivilege	3520	powershell.exe
Token: SeIncBasePriorityPrivilege	3520	powershell.exe
Token: SeCreatePagefilePrivilege	3520	powershell.exe
Token: SeBackupPrivilege	3520	powershell.exe
Token: SeRestorePrivilege	3520	powershell.exe
Token: SeShutdownPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeSystemEnvironmentPrivilege	3520	powershell.exe
Token: SeRemoteShutdownPrivilege	3520	powershell.exe
Token: SeUndockPrivilege	3520	powershell.exe
Token: SeManageVolumePrivilege	3520	powershell.exe
Token: 33	3520	powershell.exe
Token: 34	3520	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 4912	716	2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe	86
PID 716 wrote to memory of 4268	716	2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 716 wrote to memory of 3520	716	2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe	91
PID 716 wrote to memory of 3584	716	2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 716 wrote to memory of 3936	716	2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 716 wrote to memory of 2980	716	2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe	97
PID 716 wrote to memory of 5760	716	2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 716 wrote to memory of 3960	716	2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe	100
PID 5760 wrote to memory of 2164	5760	Service_1.exe	102
PID 2164 wrote to memory of 4328	2164	build.exe	103
PID 2164 wrote to memory of 4080	2164	build.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\ampiwbo'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c dir 2>nul >nul
  2⤵
  PID:3584
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo Spazzatura 2>nul >nul
  2⤵
  PID:3936
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ver 2>nul >nul
  2⤵
  PID:2980
- C:\Users\Admin\AppData\Local\ampiwbo\Service_1.exe
  "C:\Users\Admin\AppData\Local\ampiwbo\Service_1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Users\Admin\AppData\Roaming\build.exe
    C:\Users\Admin\AppData\Roaming\build.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\build.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\build.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4080
- C:\Users\Admin\AppData\Local\ampiwbo\Service_2.exe
  "C:\Users\Admin\AppData\Local\ampiwbo\Service_2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0c20e4bb258aae4f75f63d08bddb12eda719d5bb634528daead1f19e826533c4
MD5 443da1d76cfba97edbc43f630263a888
SHA1 4f41e206bed7873fd97ab70034adc1ee44bcfdb8
SHA512 01d915ecde5210754862a241c64c96529c7911e8da2a15f9adef05fd2b200d7aa92c771d260aede0513db1dfa0f34c1a4da9b36607bfb0b17e24e7f9528c5ce3
TLSH
T1F9216837B3DD8624DC9A413A10CDAD1036B6CBDB40DECE5B7B84E655A43F699CE61060
MD5 SHA1 SHA512 TLSH

Submit Download

libskiasharp.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\37F9D0B669DC3608A7CEFB671B865AA3\64\libskiasharp.dll
Size 6.7MB
SHA256 b8dce1cbaab17976e3bba7c530abdb18f7b84c00f72fba5e00a5593b196b151c
MD5 ee7fb09006ce57da37fc69eabfd761d9
SHA1 1665423e6079ae4b2017c60d3ff23786b8eb9891
SHA512 16f3a16348df5d03b2e0309bca86470316cf62b3465ee738e90623fb9ca09f76184e177bc264a6e4076812447a02065f275da37132f24843a386014a494067f8
SSDEEP 98304:r1O/k6V4MLi5nDtNLGStmis1jPznt06FjY9ln:086qMLi5nDtNLGStmiwvn66N+l
TLSH
T125669E5771B900E8D1BAD078DA579507FBB1384903B48AEF12A149DA2F27BF079BB311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wfpx.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\37F9D0B669DC3608A7CEFB671B865AA3\64\wfpx.dll
Size 12KB
SHA256 4068c5f98c69656fbfa5fe5f490f69afcc9e2244f63bf0cce688d404b3ebaab8
MD5 86f8b49bedda21b9db2294593c6f8174
SHA1 bdfc8997e03ca9a8cc4526f27d92d7ae2bdef475
SHA512 fdbf31f2c186bdd0c99edc7c4765afddf30d98a9edcaf7f7a6ca62f7bbb90cc29b497177af31af18d334b8ba790fc4558ea7a87fd4fc8ad5409f95dd2f5a6bed
SSDEEP 96:scbubosza/sbQZcSaHvs1IucLyJZNl0Z+IjH2tnl1yGtdVvsnj14LSgYdR56HBo4:s2kWca1t+sIH2tn1dGndgYABocZi
TLSH
T1D1423C86FA9548B4D16A05B4C8331F5AF6F5BA102B125B8F5370A10F2E72712F26F7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_t0z41s2i.jm5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0z41s2i.jm5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Service_1.exe

Path C:\Users\Admin\AppData\Local\ampiwbo\Service_1.exe
Size 3.4MB
SHA256 f36467769f8a9e79cf9342a01622cd6a099fb0104f20057c44fa8758823f1c6e
MD5 57cc2a7038bbd3e297c59144e2f3ed85
SHA1 3fe86ee5b3223af55f54554f37003ab8a33e9b0e
SHA512 c1ccf8e3dc18bcf5f5ec79b9e77ff09ce26af38922c401fea9903618efce081813dae17ae352bf0216a23054bfc2f06442792aa87a72799b5326cf8ecf1a2ebd
SSDEEP 98304:jBW7O5ewR7PlvFo7D0xTXa5j7LBk5WgTWEV:jIG7PlvFo7ya5e5WgTW
TLSH
T187F5331BFDB45FC8FCC242B7D7D8BA8822F0462479D4E369E56D201EE59310528A9BD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Service_2.exe

Path C:\Users\Admin\AppData\Local\ampiwbo\Service_2.exe
Size 37.8MB
SHA256 d21ff11ac4f9077b53a22545a510d302ca371f12bc5ff8dd85c8e7d8198d6dc4
MD5 78dc6637f0e94499109c20ba7328b481
SHA1 288bfa5a79b58683bdd175566bc0503d186e1d66
SHA512 23460e9d9cbc47fa11f0d7b3349f7a46ac4adeccc1cc089ba5ebd484693cb9a0d804839c88071ac92603e0f1038fd5868a3ac24e81196d8b39bd137b64d0cd89
SSDEEP 786432:izd9ymsz0p4tEGOom1+fdlgxRI6CtejL7GP3PZiLdnUwsTvYmvdM:i746GZmul4dPqHZqUwevpvG
TLSH
T1E8973312AB659B3FC94A8336EA7F00256336C3C57B9A8ACF2A50E1743D437481E7794D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2164-274-0x0000000000650000-0x000000000129F000-memory.dmp

Download

memory/2164-236-0x0000000000650000-0x000000000129F000-memory.dmp

Download

memory/2164-238-0x0000000000650000-0x000000000129F000-memory.dmp

Download

memory/2164-239-0x0000000000650000-0x000000000129F000-memory.dmp

Download

memory/2164-240-0x0000000000650000-0x000000000129F000-memory.dmp

Download

memory/2164-275-0x0000000000650000-0x000000000129F000-memory.dmp

Download

memory/2164-276-0x0000000000650000-0x000000000129F000-memory.dmp

Download

memory/3960-186-0x000001C166660000-0x000001C166668000-memory.dmp

Download

memory/3960-173-0x000001C14A220000-0x000001C14A240000-memory.dmp

Download

memory/3960-182-0x000001C166670000-0x000001C166684000-memory.dmp

Download

memory/3960-163-0x000001C148820000-0x000001C148828000-memory.dmp

Download

memory/3960-195-0x000001C16B880000-0x000001C16B88E000-memory.dmp

Download

memory/3960-194-0x000001C16B8B0000-0x000001C16B8EE000-memory.dmp

Download

memory/3960-193-0x000001C167730000-0x000001C167738000-memory.dmp

Download

memory/3960-192-0x000001C167680000-0x000001C16769A000-memory.dmp

Download

memory/3960-191-0x000001C167EA0000-0x000001C168418000-memory.dmp

Download

memory/3960-184-0x000001C162A80000-0x000001C162A94000-memory.dmp

Download

memory/3960-185-0x000001C1672E0000-0x000001C167308000-memory.dmp

Download

memory/3960-189-0x000001C167540000-0x000001C16754A000-memory.dmp

Download

memory/3960-188-0x000001C167530000-0x000001C167536000-memory.dmp

Download

memory/3960-187-0x000001C167310000-0x000001C16731A000-memory.dmp

Download

memory/3960-183-0x000001C1672B0000-0x000001C1672D6000-memory.dmp

Download

memory/3960-190-0x000001C167550000-0x000001C167660000-memory.dmp

Download

memory/3960-174-0x000001C14A240000-0x000001C14A26E000-memory.dmp

Download

memory/3960-176-0x000001C1665D0000-0x000001C16660E000-memory.dmp

Download

memory/3960-177-0x000001C167090000-0x000001C167148000-memory.dmp

Download

memory/3960-171-0x000001C14A200000-0x000001C14A208000-memory.dmp

Download

memory/3960-172-0x000001C14A210000-0x000001C14A220000-memory.dmp

Download

memory/3960-170-0x000001C163270000-0x000001C16598C000-memory.dmp

Download

memory/3960-178-0x000001C162AA0000-0x000001C162AA8000-memory.dmp

Download

memory/3960-179-0x000001C167150000-0x000001C16716C000-memory.dmp

Download

memory/3960-180-0x000001C166680000-0x000001C166688000-memory.dmp

Download

memory/3960-181-0x000001C1671B0000-0x000001C1671B8000-memory.dmp

Download

memory/3960-160-0x000001C145DC0000-0x000001C148390000-memory.dmp

Download

memory/3960-161-0x000001C162AC0000-0x000001C16316C000-memory.dmp

Download

memory/4080-256-0x00000000003B0000-0x0000000000FFF000-memory.dmp

Download

memory/4080-259-0x00000000003B0000-0x0000000000FFF000-memory.dmp

Download

memory/4268-100-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4268-114-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4268-110-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4268-109-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4268-105-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4268-104-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4268-103-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4268-102-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4268-101-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4268-99-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4268-98-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4328-243-0x00000000056F0000-0x0000000005712000-memory.dmp

Download

memory/4328-262-0x0000000070510000-0x000000007086B000-memory.dmp

Download

memory/4328-272-0x00000000085E0000-0x0000000008B9A000-memory.dmp

Download

memory/4328-271-0x0000000007870000-0x0000000007892000-memory.dmp

Download

memory/4328-270-0x0000000007470000-0x0000000007506000-memory.dmp

Download

memory/4328-269-0x00000000073C0000-0x00000000073CA000-memory.dmp

Download

memory/4328-268-0x0000000007360000-0x000000000737A000-memory.dmp

Download

memory/4328-267-0x00000000079A0000-0x000000000801C000-memory.dmp

Download

memory/4328-266-0x0000000007210000-0x00000000072B3000-memory.dmp

Download

memory/4328-265-0x00000000071F0000-0x0000000007210000-memory.dmp

Download

memory/4328-261-0x0000000070290000-0x00000000702DC000-memory.dmp

Download

memory/4328-260-0x00000000071B0000-0x00000000071E6000-memory.dmp

Download

memory/4328-257-0x0000000006D70000-0x0000000006DB8000-memory.dmp

Download

memory/4328-250-0x00000000060A0000-0x00000000060EC000-memory.dmp

Download

memory/4328-249-0x0000000005A20000-0x0000000005A3E000-memory.dmp

Download

memory/4328-248-0x0000000005A80000-0x0000000005DDB000-memory.dmp

Download

memory/4328-245-0x0000000005800000-0x0000000005866000-memory.dmp

Download

memory/4328-244-0x0000000005790000-0x00000000057F6000-memory.dmp

Download

memory/4328-242-0x0000000005050000-0x000000000569A000-memory.dmp

Download

memory/4328-241-0x0000000002560000-0x0000000002596000-memory.dmp

Download

memory/4912-92-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-75-0x000001EBCA2E0000-0x000001EBCA302000-memory.dmp

Download

memory/4912-77-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-76-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-79-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-71-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-89-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-93-0x000001EBCA630000-0x000001EBCA63A000-memory.dmp

Download

memory/4912-91-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-95-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-78-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-81-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-72-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-90-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-94-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-97-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-88-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-70-0x00007FFEB989F000-0x00007FFEB98A0000-memory.dmp

Download

memory/4912-84-0x000001EBCA550000-0x000001EBCA56E000-memory.dmp

Download

memory/4912-87-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-86-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-80-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4912-85-0x000001EBCA570000-0x000001EBCA622000-memory.dmp

Download

memory/5760-200-0x0000000000050000-0x0000000000C9F000-memory.dmp

Download

memory/5760-148-0x0000000000050000-0x0000000000C9F000-memory.dmp

Download

memory/5760-175-0x0000000000050000-0x0000000000C9F000-memory.dmp

Download

memory/5760-196-0x0000000000050000-0x0000000000C9F000-memory.dmp

Download

memory/5760-237-0x0000000000050000-0x0000000000C9F000-memory.dmp

Download

memory/5760-228-0x0000000000050000-0x0000000000C9F000-memory.dmp

Download