salatstealer | c6e02d8cb4cf05c7506705db675b71486fe468023406ebbcccc4529a3a02fc6d

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_2185a8e2f4b44deddef9fe6c3c878c96_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 302KB
Sample260720-yfbmase16v
SHA256 c6e02d8cb4cf05c7506705db675b71486fe468023406ebbcccc4529a3a02fc6d
MD5 2185a8e2f4b44deddef9fe6c3c878c96
SHA1 9af329d04c6df6388ba116b084aad4d49cf74c6c
SHA512 ffb7f15cd225c2c20666c74920f7e28c24947d57b5e44ea3f0a3f4f8e87ca2e721239fb44e36981c5d438793bf3e7b2dadd1026991b65e5c7ed3469c3dac11fa
SSDEEP 6144:AhftNRR5IptSohQtXjyBCISVvsWlveXPl/4/:AFnj5IptSmQZanwkWy8
TLSH
T110647C25F6A914F9EA67C17CC9520901EA727C564771EBCF03A04AA73F236E06E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 13 IoCs

resource	yara_rule
behavioral2/memory/4596-185-0x0000000000130000-0x0000000000D7F000-memory.dmp	family_salatstealer
behavioral2/memory/4596-184-0x0000000000130000-0x0000000000D7F000-memory.dmp	family_salatstealer
behavioral2/memory/4596-186-0x0000000000130000-0x0000000000D7F000-memory.dmp	family_salatstealer
behavioral2/memory/4596-187-0x0000000000130000-0x0000000000D7F000-memory.dmp	family_salatstealer
behavioral2/memory/4596-194-0x0000000000130000-0x0000000000D7F000-memory.dmp	family_salatstealer
behavioral2/memory/696-196-0x0000000000280000-0x0000000000ECF000-memory.dmp	family_salatstealer
behavioral2/memory/696-197-0x0000000000280000-0x0000000000ECF000-memory.dmp	family_salatstealer
behavioral2/memory/696-198-0x0000000000280000-0x0000000000ECF000-memory.dmp	family_salatstealer
behavioral2/memory/2552-218-0x0000000000BA0000-0x00000000017EF000-memory.dmp	family_salatstealer
behavioral2/memory/696-230-0x0000000000280000-0x0000000000ECF000-memory.dmp	family_salatstealer
behavioral2/memory/696-234-0x0000000000280000-0x0000000000ECF000-memory.dmp	family_salatstealer
behavioral2/memory/696-235-0x0000000000280000-0x0000000000ECF000-memory.dmp	family_salatstealer
behavioral2/memory/696-236-0x0000000000280000-0x0000000000ECF000-memory.dmp	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 13 IoCs

resource	yara_rule
behavioral2/memory/4596-185-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4596-184-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4596-186-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4596-187-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4596-194-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/696-196-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/696-197-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/696-198-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2552-218-0x0000000000BA0000-0x00000000017EF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/696-230-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/696-234-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/696-235-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/696-236-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 13 IoCs

resource	yara_rule
behavioral2/memory/4596-185-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4596-184-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4596-186-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4596-187-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4596-194-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/696-196-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/696-197-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/696-198-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2552-218-0x0000000000BA0000-0x00000000017EF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/696-230-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/696-234-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/696-235-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/696-236-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 13 IoCs

resource	yara_rule
behavioral2/memory/4596-185-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4596-184-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4596-186-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4596-187-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4596-194-0x0000000000130000-0x0000000000D7F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/696-196-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/696-197-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/696-198-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2552-218-0x0000000000BA0000-0x00000000017EF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/696-230-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/696-234-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/696-235-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/696-236-0x0000000000280000-0x0000000000ECF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 17 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c502-113.dat	UPX
behavioral2/memory/4596-183-0x0000000000130000-0x0000000000D7F000-memory.dmp	UPX
behavioral2/memory/4596-185-0x0000000000130000-0x0000000000D7F000-memory.dmp	UPX
behavioral2/memory/4596-184-0x0000000000130000-0x0000000000D7F000-memory.dmp	UPX
behavioral2/memory/4596-186-0x0000000000130000-0x0000000000D7F000-memory.dmp	UPX
behavioral2/memory/4596-187-0x0000000000130000-0x0000000000D7F000-memory.dmp	UPX
behavioral2/memory/696-195-0x0000000000280000-0x0000000000ECF000-memory.dmp	UPX
behavioral2/memory/4596-194-0x0000000000130000-0x0000000000D7F000-memory.dmp	UPX
behavioral2/memory/696-196-0x0000000000280000-0x0000000000ECF000-memory.dmp	UPX
behavioral2/memory/696-197-0x0000000000280000-0x0000000000ECF000-memory.dmp	UPX
behavioral2/memory/696-198-0x0000000000280000-0x0000000000ECF000-memory.dmp	UPX
behavioral2/memory/2552-215-0x0000000000BA0000-0x00000000017EF000-memory.dmp	UPX
behavioral2/memory/2552-218-0x0000000000BA0000-0x00000000017EF000-memory.dmp	UPX
behavioral2/memory/696-230-0x0000000000280000-0x0000000000ECF000-memory.dmp	UPX
behavioral2/memory/696-234-0x0000000000280000-0x0000000000ECF000-memory.dmp	UPX
behavioral2/memory/696-235-0x0000000000280000-0x0000000000ECF000-memory.dmp	UPX
behavioral2/memory/696-236-0x0000000000280000-0x0000000000ECF000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4572	powershell.exe
1668	powershell.exe
3824	powershell.exe
5932	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	3900	2026-07-20_2185a8e2f4b44deddef9fe6c3c878c96_cobalt-strike_icedid_njrat_satacom_stealc.exe

Executes dropped EXE 3 IoCs

pid	Process
4596	Service.exe
696	chrome.exe
2552	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000f00000001c502-113.dat	upx
behavioral2/memory/4596-183-0x0000000000130000-0x0000000000D7F000-memory.dmp	upx
behavioral2/memory/4596-185-0x0000000000130000-0x0000000000D7F000-memory.dmp	upx
behavioral2/memory/4596-184-0x0000000000130000-0x0000000000D7F000-memory.dmp	upx
behavioral2/memory/4596-186-0x0000000000130000-0x0000000000D7F000-memory.dmp	upx
behavioral2/memory/4596-187-0x0000000000130000-0x0000000000D7F000-memory.dmp	upx
behavioral2/memory/696-195-0x0000000000280000-0x0000000000ECF000-memory.dmp	upx
behavioral2/memory/4596-194-0x0000000000130000-0x0000000000D7F000-memory.dmp	upx
behavioral2/memory/696-196-0x0000000000280000-0x0000000000ECF000-memory.dmp	upx
behavioral2/memory/696-197-0x0000000000280000-0x0000000000ECF000-memory.dmp	upx
behavioral2/memory/696-198-0x0000000000280000-0x0000000000ECF000-memory.dmp	upx
behavioral2/memory/2552-215-0x0000000000BA0000-0x00000000017EF000-memory.dmp	upx
behavioral2/memory/2552-218-0x0000000000BA0000-0x00000000017EF000-memory.dmp	upx
behavioral2/memory/696-230-0x0000000000280000-0x0000000000ECF000-memory.dmp	upx
behavioral2/memory/696-234-0x0000000000280000-0x0000000000ECF000-memory.dmp	upx
behavioral2/memory/696-235-0x0000000000280000-0x0000000000ECF000-memory.dmp	upx
behavioral2/memory/696-236-0x0000000000280000-0x0000000000ECF000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
1668	powershell.exe
1668	powershell.exe
3824	powershell.exe
3824	powershell.exe
3824	powershell.exe
5932	powershell.exe
5932	powershell.exe
4572	powershell.exe
4572	powershell.exe
4596	Service.exe
4596	Service.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
5332	powershell.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
5332	powershell.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeIncreaseQuotaPrivilege	1668	powershell.exe
Token: SeSecurityPrivilege	1668	powershell.exe
Token: SeTakeOwnershipPrivilege	1668	powershell.exe
Token: SeLoadDriverPrivilege	1668	powershell.exe
Token: SeSystemProfilePrivilege	1668	powershell.exe
Token: SeSystemtimePrivilege	1668	powershell.exe
Token: SeProfSingleProcessPrivilege	1668	powershell.exe
Token: SeIncBasePriorityPrivilege	1668	powershell.exe
Token: SeCreatePagefilePrivilege	1668	powershell.exe
Token: SeBackupPrivilege	1668	powershell.exe
Token: SeRestorePrivilege	1668	powershell.exe
Token: SeShutdownPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeSystemEnvironmentPrivilege	1668	powershell.exe
Token: SeRemoteShutdownPrivilege	1668	powershell.exe
Token: SeUndockPrivilege	1668	powershell.exe
Token: SeManageVolumePrivilege	1668	powershell.exe
Token: 33	1668	powershell.exe
Token: 34	1668	powershell.exe
Token: 35	1668	powershell.exe
Token: 36	1668	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeIncreaseQuotaPrivilege	3824	powershell.exe
Token: SeSecurityPrivilege	3824	powershell.exe
Token: SeTakeOwnershipPrivilege	3824	powershell.exe
Token: SeLoadDriverPrivilege	3824	powershell.exe
Token: SeSystemProfilePrivilege	3824	powershell.exe
Token: SeSystemtimePrivilege	3824	powershell.exe
Token: SeProfSingleProcessPrivilege	3824	powershell.exe
Token: SeIncBasePriorityPrivilege	3824	powershell.exe
Token: SeCreatePagefilePrivilege	3824	powershell.exe
Token: SeBackupPrivilege	3824	powershell.exe
Token: SeRestorePrivilege	3824	powershell.exe
Token: SeShutdownPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeSystemEnvironmentPrivilege	3824	powershell.exe
Token: SeRemoteShutdownPrivilege	3824	powershell.exe
Token: SeUndockPrivilege	3824	powershell.exe
Token: SeManageVolumePrivilege	3824	powershell.exe
Token: 33	3824	powershell.exe
Token: 34	3824	powershell.exe
Token: 35	3824	powershell.exe
Token: 36	3824	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeIncreaseQuotaPrivilege	5932	powershell.exe
Token: SeSecurityPrivilege	5932	powershell.exe
Token: SeTakeOwnershipPrivilege	5932	powershell.exe
Token: SeLoadDriverPrivilege	5932	powershell.exe
Token: SeSystemProfilePrivilege	5932	powershell.exe
Token: SeSystemtimePrivilege	5932	powershell.exe
Token: SeProfSingleProcessPrivilege	5932	powershell.exe
Token: SeIncBasePriorityPrivilege	5932	powershell.exe
Token: SeCreatePagefilePrivilege	5932	powershell.exe
Token: SeBackupPrivilege	5932	powershell.exe
Token: SeRestorePrivilege	5932	powershell.exe
Token: SeShutdownPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeSystemEnvironmentPrivilege	5932	powershell.exe
Token: SeRemoteShutdownPrivilege	5932	powershell.exe
Token: SeUndockPrivilege	5932	powershell.exe
Token: SeManageVolumePrivilege	5932	powershell.exe
Token: 33	5932	powershell.exe
Token: 34	5932	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 1668	3900	2026-07-20_2185a8e2f4b44deddef9fe6c3c878c96_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 3900 wrote to memory of 3824	3900	2026-07-20_2185a8e2f4b44deddef9fe6c3c878c96_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 3900 wrote to memory of 5932	3900	2026-07-20_2185a8e2f4b44deddef9fe6c3c878c96_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 3900 wrote to memory of 4572	3900	2026-07-20_2185a8e2f4b44deddef9fe6c3c878c96_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 3900 wrote to memory of 4596	3900	2026-07-20_2185a8e2f4b44deddef9fe6c3c878c96_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 4596 wrote to memory of 696	4596	Service.exe	101
PID 696 wrote to memory of 5332	696	chrome.exe	102
PID 696 wrote to memory of 2552	696	chrome.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-20_2185a8e2f4b44deddef9fe6c3c878c96_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_2185a8e2f4b44deddef9fe6c3c878c96_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\JRZ7e4f'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Users\Admin\AppData\Local\JRZ7e4f\Service.exe
  "C:\Users\Admin\AppData\Local\JRZ7e4f\Service.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\AppData\Roaming\chrome.exe
    C:\Users\Admin\AppData\Roaming\chrome.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Service.exe

Path C:\Users\Admin\AppData\Local\JRZ7e4f\Service.exe
Size 3.4MB
SHA256 0f3f573291640f052d0ddfa9a6aa46c240a4dbaaf4f60e71916ee2daa05dfb6b
MD5 a843751cc28ee2096d2b9e0f49e3be3c
SHA1 b29be11e2879eeab1b34d91c46bec528f97425b0
SHA512 389ec564ed2d8ca5a6d23627c9a12eba5031ffb43485cbd878005128c1b4f487448fd2a872eeacb834a2e0c96189cacfad43bfc1b062f6f94294654ed58f6b05
SSDEEP 98304:PUsk6JPAWc6O4umG5quf7ZHHHC7cFGMgwlbrNzly:csTJ4J6O4lYlhHHauRXNzY
TLSH
T124F5333BD8A5C241E1B0673844789BE2AD28BA931C4DA1BDD2724DDB9FD728494C93D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

output.log

Path C:\Users\Admin\AppData\Local\JRZ7e4f\output.log
Size 1KB
SHA256 2656494844b2f8dd7d191004a0447d27250295a3a347b4e4a7f4105de7051b7e
MD5 520e0b7f25c97f73288ebdd95a5b6a2a
SHA1 101da6c0ece77602de33eac1d5618b162201b614
SHA512 9e5209dc7db9b1a089265c7b057b59b7e850226e4862a3130f9d73fdde193d5aa3f23ec39e1ec6b804e10a4a5ed069d2d980d90e1d47273ca630a5659f88b03f
TLSH
T1E93144339ECFD16F92BB080D537BB6A086F97817CF0E14052ADC4058A39835CDA7A2E4
MD5 SHA1 SHA512 TLSH

Submit Download

output.log

Path C:\Users\Admin\AppData\Local\JRZ7e4f\output.log
Size 439B
SHA256 53f4aa23bcfe74bb731d0b13f1c3f49206a8dc016235b16c1e3ecd1a67429e78
MD5 04385e1bc01962fbafd325a0420e585b
SHA1 86b3e7b6eca7a007333dba047652a495e146b95e
SHA512 8c5c72809d9c159bb3d2f9e0e64f14b7932f9acb361c770db82702ef872bfe7741106e09abc5e22d8b85bdcdad905b2a01cbe88b824d8d27a5287c1f3ff7d1da
TLSH
T161F0C023DCDF52D710AB02070696AA58D0FDDC25FB1A3A037F44844D265879CE99B245
MD5 SHA1 SHA512 TLSH

Submit Download

system_2.tmp

Path C:\Users\Admin\AppData\Local\JRZ7e4f\system_2.tmp
Size 54B
SHA256 53053450acef402de9f34feb2d8117d55abc889ae2f685dfdc61b3500f14610a
MD5 4a43db1ffa72830c2b52096b1472ee23
SHA1 934dc7242f670b4d6e9341a37a5b41cbcbae1b6f
SHA512 f0ba7e593eeb0f50959c78678e5dc5db398de11a8caed177a5a1ef0bf70dae3e89435f390407a40f132b6eb56650b2a137bf4bba6b93a73c11625a47eb75f3d1
TLSH
T11B9002CC554248566442D5A20828A5501565A70D1E4750960586511D50424763326934
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f593a5bc18c609f44f0ab9d2d72046b7ff5d2841494193e5ef06bbd8028cfb5d
MD5 69f19c63d57747dd202a1435a52e62bb
SHA1 37fed3f373ef2608be0f6ecfba2285a9af04c58b
SHA512 9a6e458a9d6f5af2d75cafddb571d7bd86f244ba0146cdedfe057bf2f9dc56012141f5ab646f933d0306f052579f49c030c03b9562828ca86166bdf2eb616749
TLSH
T19D216837B3DD8624CC9A413A10CDAD1036B6CBDB40DECE5B7B85E655A43F699CE61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5e160bb2a1a359663df820917d027ac520496d29b54f22b2bed712c2d69149de
MD5 5c89a318a34b8e5380e7867c7c3624f5
SHA1 6edbeb5ebdc5436e8a177a8c8a1dc8d48540f8c4
SHA512 36397e4ddf8abb11e7a18295a8fc013e3b317143683e0607c15232e12b653f357c16eb53f964995ccc7a924f6db2b49393344d1fece96220b1ad02d386d458f1
TLSH
T1F3216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mmxdncqo.zkv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mmxdncqo.zkv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/696-195-0x0000000000280000-0x0000000000ECF000-memory.dmp

Download

memory/696-235-0x0000000000280000-0x0000000000ECF000-memory.dmp

Download

memory/696-236-0x0000000000280000-0x0000000000ECF000-memory.dmp

Download

memory/696-197-0x0000000000280000-0x0000000000ECF000-memory.dmp

Download

memory/696-234-0x0000000000280000-0x0000000000ECF000-memory.dmp

Download

memory/696-230-0x0000000000280000-0x0000000000ECF000-memory.dmp

Download

memory/696-198-0x0000000000280000-0x0000000000ECF000-memory.dmp

Download

memory/696-196-0x0000000000280000-0x0000000000ECF000-memory.dmp

Download

memory/1668-76-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-81-0x000001B0E9040000-0x000001B0E90F2000-memory.dmp

Download

memory/1668-88-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-90-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-86-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-85-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-84-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-83-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-82-0x000001B0E8DA0000-0x000001B0E8DAA000-memory.dmp

Download

memory/1668-87-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-80-0x000001B0E8D80000-0x000001B0E8D9E000-memory.dmp

Download

memory/1668-77-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-75-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-74-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-73-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-72-0x000001B0E8CE0000-0x000001B0E8D02000-memory.dmp

Download

memory/1668-71-0x00007FFC47C70000-0x00007FFC48614000-memory.dmp

Download

memory/1668-68-0x00007FFC47DFF000-0x00007FFC47E00000-memory.dmp

Download

memory/2552-218-0x0000000000BA0000-0x00000000017EF000-memory.dmp

Download

memory/2552-215-0x0000000000BA0000-0x00000000017EF000-memory.dmp

Download

memory/4596-183-0x0000000000130000-0x0000000000D7F000-memory.dmp

Download

memory/4596-185-0x0000000000130000-0x0000000000D7F000-memory.dmp

Download

memory/4596-184-0x0000000000130000-0x0000000000D7F000-memory.dmp

Download

memory/4596-186-0x0000000000130000-0x0000000000D7F000-memory.dmp

Download

memory/4596-194-0x0000000000130000-0x0000000000D7F000-memory.dmp

Download

memory/4596-187-0x0000000000130000-0x0000000000D7F000-memory.dmp

Download

memory/5332-219-0x0000000007170000-0x00000000071A6000-memory.dmp

Download

memory/5332-224-0x00000000071B0000-0x00000000071D0000-memory.dmp

Download

memory/5332-208-0x0000000005D60000-0x0000000005D7E000-memory.dmp

Download

memory/5332-216-0x0000000006F30000-0x0000000006F78000-memory.dmp

Download

memory/5332-207-0x0000000005830000-0x0000000005B8B000-memory.dmp

Download

memory/5332-203-0x0000000005660000-0x00000000056C6000-memory.dmp

Download

memory/5332-220-0x000000006FED0000-0x000000006FF1C000-memory.dmp

Download

memory/5332-221-0x00000000701A0000-0x00000000704FB000-memory.dmp

Download

memory/5332-225-0x00000000071D0000-0x0000000007273000-memory.dmp

Download

memory/5332-209-0x0000000005D80000-0x0000000005DCC000-memory.dmp

Download

memory/5332-227-0x0000000007320000-0x000000000733A000-memory.dmp

Download

memory/5332-226-0x0000000007960000-0x0000000007FDC000-memory.dmp

Download

memory/5332-228-0x0000000007380000-0x000000000738A000-memory.dmp

Download

memory/5332-229-0x0000000007430000-0x00000000074C6000-memory.dmp

Download

memory/5332-204-0x0000000005780000-0x00000000057E6000-memory.dmp

Download

memory/5332-231-0x0000000007850000-0x0000000007872000-memory.dmp

Download

memory/5332-232-0x00000000085A0000-0x0000000008B5A000-memory.dmp

Download

memory/5332-202-0x0000000004F50000-0x0000000004F72000-memory.dmp

Download

memory/5332-201-0x0000000004FA0000-0x00000000055EA000-memory.dmp

Download

memory/5332-200-0x00000000024F0000-0x0000000002526000-memory.dmp

Download