e817b32f226327891e148f0bb956825d1b2d933a6fa1f447344edb0e761a2276

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_9844a2848049f3a2908a009c37376b6b_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 42.6MB
Sample260722-vyvw4saa23
SHA256 e817b32f226327891e148f0bb956825d1b2d933a6fa1f447344edb0e761a2276
MD5 9844a2848049f3a2908a009c37376b6b
SHA1 d30ed7e2f0a121cdcfec82353809732342957424
SHA512 c2e8d4982a9018f9bfe8bcc09ec094d261565bd8604994cd37779ff559b1d5ecc557a58b4a5cde0eab82be1f9bf59f3d25da388ced3bd8d38b7fc2d914d43150
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf2:fMguj8Q4VfvpqFTrYv
TLSH
T153A79D2773E600A5E5B3D1388AA74503DB73B4635331CADF329D06551FABAE09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6024	helper.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4176	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2216	cmd.exe
5800	cmd.exe
3068	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
248	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292150337216795"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5604	chrome.exe
5604	chrome.exe
6088	chrome.exe
6088	chrome.exe
5604	chrome.exe
5604	chrome.exe
2720	chrome.exe
2720	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	tasklist.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 2216	4100	2026-07-22_9844a2848049f3a2908a009c37376b6b_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 2216 wrote to memory of 4176	2216	cmd.exe	91
PID 4100 wrote to memory of 5800	4100	2026-07-22_9844a2848049f3a2908a009c37376b6b_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 5800 wrote to memory of 5604	5800	cmd.exe	94
PID 5604 wrote to memory of 1404	5604	chrome.exe	95
PID 5604 wrote to memory of 252	5604	chrome.exe	97
PID 5604 wrote to memory of 248	5604	chrome.exe	96
PID 5604 wrote to memory of 252	5604	chrome.exe	97
PID 5604 wrote to memory of 2508	5604	chrome.exe	99
PID 5604 wrote to memory of 2508	5604	chrome.exe	99
PID 5604 wrote to memory of 5896	5604	chrome.exe	100
PID 5604 wrote to memory of 5896	5604	chrome.exe	100
PID 5604 wrote to memory of 1540	5604	chrome.exe	101
PID 5604 wrote to memory of 1540	5604	chrome.exe	101
PID 5604 wrote to memory of 2944	5604	chrome.exe	102
PID 5604 wrote to memory of 2944	5604	chrome.exe	102
PID 4100 wrote to memory of 3068	4100	2026-07-22_9844a2848049f3a2908a009c37376b6b_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	103
PID 3068 wrote to memory of 6024	3068	cmd.exe	105
PID 6024 wrote to memory of 6088	6024	helper.exe	106
PID 6024 wrote to memory of 6088	6024	helper.exe	106
PID 5604 wrote to memory of 1776	5604	chrome.exe	109
PID 5604 wrote to memory of 2644	5604	chrome.exe	113
PID 5604 wrote to memory of 5932	5604	chrome.exe	114
PID 5604 wrote to memory of 3060	5604	chrome.exe	115
PID 5604 wrote to memory of 2720	5604	chrome.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-07-22_9844a2848049f3a2908a009c37376b6b_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_9844a2848049f3a2908a009c37376b6b_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq chrome.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --disable-extensions --disable-plugins --disable-sync --disable-default-apps --mute-audio"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --disable-extensions --disable-plugins --disable-sync --disable-default-apps --mute-audio
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff80637c728,0x7ff80637c734,0x7ff80637c740
      4⤵
      PID:1404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1516,i,7738343842090533546,7460524359491058748,524288 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
      4⤵
      System Time Discovery
      PID:248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,4929647503640321830,879652583581709436,262144 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
      4⤵
      PID:252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,1079019561264389230,8973979988657376235,524288 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
      4⤵
      PID:2508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,9017346917165381785,17038962693907710294,2097152 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,7494477396284254964,3519325764035134848,2097152 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:1540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,11581517345333746876,4812714145494274847,2097152 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
      4⤵
      PID:2944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,13335408549997799322,9913849380180678764,524288 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:1776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,5132748613228753027,2815365080651432153,524288 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:2644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,6882955962539828563,6761510025669798345,524288 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,10016729543821486028,3517151359910532361,524288 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6068,i,17088769774057982048,12455610870442089847,262144 --field-trial-handle=2028,i,13940063476975237470,14036199451978616051,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\grapper_1784741428019_qehfir\helper.exe" chrome"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\grapper_1784741428019_qehfir\helper.exe
    "C:\Users\Admin\AppData\Local\Temp\grapper_1784741428019_qehfir\helper.exe" chrome
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b09a37444bf772258c381a955c12333d2f8952332871cd16c8076edf9f6ddcea
MD5 00e42bfb8e728947fbd293efec84c95e
SHA1 7a4819c8ec1599ac020a03b0726ea8758db152cd
SHA512 006fb8d87e5492ba1564da22f0ee96cad809bdb695defbab090273f3818ad0f9f6f6d1f550d3d9a137bc36943ec2853052d9f5f02e22f0e93413cf598d922e87
TLSH
T13E717DF7C3D88A7D841566F4DB257E1FCE6D0A24022C3C66C8D8AE5B97E2872D21075E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b8f3c9d9-a212-4f6c-b6dd-a75230671f4e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b8f3c9d9-a212-4f6c-b6dd-a75230671f4e.tmp
Size 2KB
SHA256 1ff77a6ed250b8fcbbaaeb68354687362cdaa788bdf5356f3a5cd6646d85960c
MD5 09865d7a0c1234c38ebdffb1245b30fb
SHA1 7a4eb785598dd5b108e531adaa0a375295c721db
SHA512 cb18378ff6794968194d1939476b0336ca680b761b1462facc3149ceac9fa47fd59b6423d5fffb09c65278d6feb54db29df59ea363e1f898d38f0faefbfed88c
TLSH
T1CE518DF7D3D48A7D841562E49B217E1BCE7E0A19122C3C22C8D8AE5B57E2872D21075E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b1070cf1bec513af6cfaea20981ee3c6e20d1ed3ab43afab7ee7bf0cdb8dae49
MD5 735b74497649c3f59b88b722a010b45a
SHA1 ea28b39dcda3cb164c0b2b0e7e12015dbcbb9a06
SHA512 e3b9989a54628d6a5e6a3cef41393e1dc75259ca933a5cff2d46fb1cfe3336cd8e83f0bc1b0ed222beec58a548ee0abf405ff9a9ac85547eda5a3ec930b4384d
SSDEEP 192:lRhzffrv7zAPRp2Q9NLHsb+WNnyGm0LbDe+2y1VyIsnAUgG:lRhz3TCXD3wy30Lf2mG
TLSH
T1B932B72EBA60693B6ECBC31AF9257B53DBF5102161942E84E7FC892C15D76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8718897d20122b03bd285ea9ab2608c18d86d265576c6c92615b870320b91c60
MD5 94e74eb10d34737f12ebe44a6b9a63da
SHA1 fc689cf6cbefc754feb05bad712c7e654a985239
SHA512 30d623c080cb44388101b26c6a705e839a5b02b149bc9009991825fa2c42d255ce2bf2bef59e39035a2ad3e3febe206ad2a814d2634363a944d667aab00a3bee
SSDEEP 192:lRhzffrv7zPPRpbQ9NLHsb+WNnyGm0LCDe+2yZVyIsnAUgY:lRhz3THX83wy30Lw2AY
TLSH
T19B42D72EB910293B6EC7C65AF925BB53DBF5102161902E84E7FC8A2C15EB6CC3327017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 984e94c02a95178b4c4959e147fa879fe623f0216dd450ee980baf4fa6073bdb
MD5 6d67d923c07a308b4537f6e2708c08c8
SHA1 9481a9c4650718000d21e713f30e71e4b9f4380b
SHA512 96cd2fdddbe5734e7806f98abf753e542d1a615571812b82aea97129e857acbd8f5a3f4a8384e683859ed32c80747c4829ca8d0a34c5b01519a1b1161520a4dc
SSDEEP 3072:34TY7uxmvbzC6plWFgHVZtTb+KOtjyEdOXICj8aD+qT:38dxmDzC6jWFQjtTb+XngXpj8aK4
TLSH
T170C312BAA8336CB6C3AD590970093F0A5FC9CB66EB61C0BD90D42DCD544F8C46A67E06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3f0c89ec4fd8123a8146328a34c9988a0fac551bd53ee15d84a9bf08916eb807
MD5 d22053ed8e0ce537f0389bf3b03e3530
SHA1 913dfead8d5b8f98e2e71bd4561f044afce308ec
SHA512 f2fe89ea3d720d19be9739b3ee8a2bc925c195edb627737c9e873c673bdd85c0a3991f69d67f5c35ed7c7c868d4e254e9ab31bedb12960d93df5db5016c5f8f4
SSDEEP 96:hC0d+hDK+UyKovbfaNQYEtqSl8h4otop576DYB6VGyvUgIlG1QzbOQUEfEf0j9IR:hC0qDHUgvIdNiU2osdsIlTLUEfEfUQ
TLSH
T139C1397AB42CAC7319B2954AF4132B43CDF6606B9A61AE94C6CA0F0D12D74EC2343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 9126aed5cae477d9608f1bd9e5d6be80308993886e36db0e7fa3d2af285ccbc5
MD5 2a1d71eb10baff7e199b0723c23d3b02
SHA1 0b7a14abfb256b1bb95e6d96853d843c4f8fc625
SHA512 c44f605da0e548ff8d80594b081a83606b9259cdfb60f8474c953b28bba5522fae29beb6c15345211619fdf2c74873237d368c93f9520c89b47d84a4794c5412
SSDEEP 3072:3hTY7uxmvbzC6plWFgHVZtTb+KOtjyEdOXICj8aD+qT:3JdxmDzC6jWFQjtTb+XngXpj8aK4
TLSH
T14CC312A6A8337C75C3AD5605B4093F0D9FCACA51EB61C0FA80D05EDD588A8C46672E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8a5af8b388089c8c8f37b03f6985776fcfc04bc03115dc9285d43f544a85700d
MD5 10444067ad235e92bce42cb9f7560ae4
SHA1 3aed02123487c64fa506fab9f2127fd23da9dbf4
SHA512 0c4a087c6b646f85a958a5817e61990d9e46d83d6cd7a4355b9473d617669e0bcfab5f6532d78b7a791cdf158b65b704050178c5d0af203c133408b5b3e361f8
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok57qDYB6WGyvUU+EsbL/Mmv4a:BC0qDHUgvIdaDUDIsCI+EsbL/N
TLSH
T1B3A11A32B46D4D776A76D549F8662E43CEB4607BEA21BE84D9DE0F0C11E70EC1342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe

Path C:\Users\Admin\AppData\Local\Temp\grapper_1784741428019_qehfir\helper.exe
Size 1.4MB
SHA256 99413092119b00c09f77a4de1919958a13535cdab1aeebe6dbe406b6581661fa
MD5 f21ee1c62100e896a4fbd6ec6186e6ea
SHA1 282208974eb43c161c6274144ed5b8798555b966
SHA512 93170f84313e89524649d8b1054d4fbd414a93bcf415b332ae367b51e6e711b2c8e6a277c52b7bbd0f1b6452b942f545128a0d4adf71e8430b640aec35b3bacd
SSDEEP 24576:jnrDCpbI66LK8GD9eYfoYwbkVlP8yprpmxWnDuiCK8iW/2rTezxy:3eBI/Wp9FfoYZVW4f718FOne
TLSH
T12565025B66A500F9E1A7C2B9CD51580AE673FC4647B4BB4F03E849960F336B09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download