salatstealer | 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT10).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864
MD5 9a77b713dc626138ec7421f560716a28
SHA1 06281de584a2f7a10b7d2fbd594f518efd7e4c9c
SHA512 6e29b0880be24c85c9398fa21b88453b650a0f09045cc7701bba910aa74118e9f179da85b4db53e19b79ad9cfd524916583f7ac83e02c254a955f9ce8bec2c75
TLSH
T130712C93E00DDE47F48DA97EF85FA5B52027D88368D6D452439B89E8CC0ECBE684E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral11/files/0x000e00000001c50d-6723.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
18	5428	powershell.exe
19	5428	powershell.exe
20	5428	powershell.exe
21	5428	powershell.exe
22	5428	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
4668	Setup-TaasfKQdEtTesVxb.exe
2704	agent_aqZtKBMO.exe
1640	Setup-TaasfKQdEtTesVxb.exe
4200	agent_cavDVkcP.exe
5432	Setup-TaasfKQdEtTesVxb.exe
4332	Setup-TaasfKQdEtTesVxb.exe
4520	agent_ARTsnnhp.exe
3024	winlogon.exe
5968	agent_YexxPWva.exe
4764	winlogon.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4228	certutil.exe
3252	certutil.exe
1380	certutil.exe
1176	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe	winlogon.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\038a033d-5bdb-4f70-0860-602723d13d5b	agent_aqZtKBMO.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\smartscreen.exe	agent_aqZtKBMO.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\038a033d-5bdb-4f70-0860-602723d13d5b	agent_aqZtKBMO.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\winlogon.exe	agent_aqZtKBMO.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4360	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_ARTsnnhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_YexxPWva.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_aqZtKBMO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_cavDVkcP.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2704	agent_aqZtKBMO.exe
2704	agent_aqZtKBMO.exe
2704	agent_aqZtKBMO.exe
2704	agent_aqZtKBMO.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
5428	powershell.exe
5428	powershell.exe
5428	powershell.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe
3024	winlogon.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2652	winws.exe
Token: SeBackupPrivilege	2652	winws.exe
Token: SeDebugPrivilege	2652	winws.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	3024	winlogon.exe
Token: SeIncreaseQuotaPrivilege	5428	powershell.exe
Token: SeSecurityPrivilege	5428	powershell.exe
Token: SeTakeOwnershipPrivilege	5428	powershell.exe
Token: SeLoadDriverPrivilege	5428	powershell.exe
Token: SeSystemProfilePrivilege	5428	powershell.exe
Token: SeSystemtimePrivilege	5428	powershell.exe
Token: SeProfSingleProcessPrivilege	5428	powershell.exe
Token: SeIncBasePriorityPrivilege	5428	powershell.exe
Token: SeCreatePagefilePrivilege	5428	powershell.exe
Token: SeBackupPrivilege	5428	powershell.exe
Token: SeRestorePrivilege	5428	powershell.exe
Token: SeShutdownPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeSystemEnvironmentPrivilege	5428	powershell.exe
Token: SeRemoteShutdownPrivilege	5428	powershell.exe
Token: SeUndockPrivilege	5428	powershell.exe
Token: SeManageVolumePrivilege	5428	powershell.exe
Token: 33	5428	powershell.exe
Token: 34	5428	powershell.exe
Token: 35	5428	powershell.exe
Token: 36	5428	powershell.exe
Token: SeIncreaseQuotaPrivilege	5428	powershell.exe
Token: SeSecurityPrivilege	5428	powershell.exe
Token: SeTakeOwnershipPrivilege	5428	powershell.exe
Token: SeLoadDriverPrivilege	5428	powershell.exe
Token: SeSystemProfilePrivilege	5428	powershell.exe
Token: SeSystemtimePrivilege	5428	powershell.exe
Token: SeProfSingleProcessPrivilege	5428	powershell.exe
Token: SeIncBasePriorityPrivilege	5428	powershell.exe
Token: SeCreatePagefilePrivilege	5428	powershell.exe
Token: SeBackupPrivilege	5428	powershell.exe
Token: SeRestorePrivilege	5428	powershell.exe
Token: SeShutdownPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeSystemEnvironmentPrivilege	5428	powershell.exe
Token: SeRemoteShutdownPrivilege	5428	powershell.exe
Token: SeUndockPrivilege	5428	powershell.exe
Token: SeManageVolumePrivilege	5428	powershell.exe
Token: 33	5428	powershell.exe
Token: 34	5428	powershell.exe
Token: 35	5428	powershell.exe
Token: 36	5428	powershell.exe
Token: SeIncreaseQuotaPrivilege	5428	powershell.exe
Token: SeSecurityPrivilege	5428	powershell.exe
Token: SeTakeOwnershipPrivilege	5428	powershell.exe
Token: SeLoadDriverPrivilege	5428	powershell.exe
Token: SeSystemProfilePrivilege	5428	powershell.exe
Token: SeSystemtimePrivilege	5428	powershell.exe
Token: SeProfSingleProcessPrivilege	5428	powershell.exe
Token: SeIncBasePriorityPrivilege	5428	powershell.exe
Token: SeCreatePagefilePrivilege	5428	powershell.exe
Token: SeBackupPrivilege	5428	powershell.exe
Token: SeRestorePrivilege	5428	powershell.exe
Token: SeShutdownPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeSystemEnvironmentPrivilege	5428	powershell.exe
Token: SeRemoteShutdownPrivilege	5428	powershell.exe
Token: SeUndockPrivilege	5428	powershell.exe
Token: SeManageVolumePrivilege	5428	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4552	4360	cmd.exe	90
PID 4360 wrote to memory of 4228	4360	cmd.exe	91
PID 4360 wrote to memory of 4668	4360	cmd.exe	92
PID 4668 wrote to memory of 2704	4668	Setup-TaasfKQdEtTesVxb.exe	93
PID 4360 wrote to memory of 3252	4360	cmd.exe	94
PID 4360 wrote to memory of 1640	4360	cmd.exe	95
PID 1640 wrote to memory of 4200	1640	Setup-TaasfKQdEtTesVxb.exe	96
PID 4360 wrote to memory of 1380	4360	cmd.exe	97
PID 4360 wrote to memory of 5432	4360	cmd.exe	98
PID 4360 wrote to memory of 1176	4360	cmd.exe	99
PID 4360 wrote to memory of 4332	4360	cmd.exe	100
PID 4360 wrote to memory of 2652	4360	cmd.exe	101
PID 5432 wrote to memory of 4520	5432	Setup-TaasfKQdEtTesVxb.exe	103
PID 2704 wrote to memory of 3024	2704	agent_aqZtKBMO.exe	105
PID 4332 wrote to memory of 5968	4332	Setup-TaasfKQdEtTesVxb.exe	106
PID 3024 wrote to memory of 5428	3024	winlogon.exe	108
PID 3024 wrote to memory of 4764	3024	winlogon.exe	110
PID 5428 wrote to memory of 3104	5428	powershell.exe	113

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT10).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4552
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4228
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Users\Admin\AppData\Roaming\ExitSelect\agent_aqZtKBMO.exe
    C:\Users\Admin\AppData\Roaming\ExitSelect\agent_aqZtKBMO.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Program Files (x86)\Mozilla Maintenance Service\winlogon.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\winlogon.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5428
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4764
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3252
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Users\Admin\AppData\Roaming\PopUnprotect\agent_cavDVkcP.exe
    C:\Users\Admin\AppData\Roaming\PopUnprotect\agent_cavDVkcP.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4200
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1380
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Users\Admin\AppData\Roaming\UnblockExit\agent_ARTsnnhp.exe
    C:\Users\Admin\AppData\Roaming\UnblockExit\agent_ARTsnnhp.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4520
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1176
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Users\Admin\AppData\Roaming\SyncUnpublish\agent_YexxPWva.exe
    C:\Users\Admin\AppData\Roaming\SyncUnpublish\agent_YexxPWva.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5968
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=none --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 430a6e344da69c81025b7da7f38f36e48780837f685978fa0d1d01e624beb8dd
MD5 83737ea3da30a4140057311e7a5927f7
SHA1 4c92c12952bf31b115895894799727970a67392a
SHA512 8e3af443385243e773551b60defcddf23a3dee835d4c0b7d88fe85f02400a695bb2c66bd34dd0ac4c02a7bd812ca2856f772ef55aea5bdd7d6459d940d222ef2
SSDEEP 384:lVH9x1M0YqutQse9FKkNKn5BYdAQFNl88uayR2ZxBp6UaMEDEZ/Hopsli:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZP
TLSH
T107926E704AE33CBD3D8C7C5061505DAC5D6C2F8B51650209ABC834FA63E85BC8E6AD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 88KB
SHA256 89a96a2a5785e2ac51bfe307557691cb521abe91b804a8218bbcfe9cd2e487c0
MD5 14d719eeac65606b1d27c5196d388422
SHA1 0d2b7ddcbf81ad1b4aef4d88e17c47c24fe231d8
SHA512 ef4f9c18f8949314a96f8b79f2773fd56d41d068990e0e8ea4c36f16604c72b6b7c703a3facb9007e7363a8b26f369350b0dc1bb06175f706b1241d81a334913
SSDEEP 1536:wMl1EFc3fcIK+Ivp/Kdp/t6yvmTjfxsLGc+Y:wMl1EFbko016qqxnc+Y
TLSH
T1B3931A360B9BB4BC39BC7E4279114C4C8E5D261E157A474B63C134BEE3A86E8CE15E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 12.6MB
SHA256 f097bdadcf392cec63280ed109f1e8f26770086c42ca6de0bfc9306478e1110f
MD5 694fa6536271ec2ba4b913e7a5cccea4
SHA1 2e14310f2d11baa3971286417f9146cd7bc24df5
SHA512 ea0b1b6b4aa19973f24d0c893a3fd0e825ef6dc34f26b03c2f92af8377c81927ffa95a8e16d2d9fb676110f85ce0a6ec966fb7ca7ad79ea81d14875b3ee1a965
SSDEEP 49152:HcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8U:u
TLSH
T123D6CF320243FDBD3FAD2D85E0052D451D5D7A1B62A8D299FB8D30BA62EA564CE3CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 64KB
SHA256 7fd463409adb020167cb05498bb53f4e71cb5df7d07ae3b85c55d2fd205779fe
MD5 6cdf0de1edf627f1868fe18695d4c3d7
SHA1 67ee739a6e1f3073339578bac02e89e4156983df
SHA512 b056dc5f627d49fed3506cfb6ebfb0b274ed3668daaf62bb9466213ed12e067dda4e79c5ed9ceb76b6578073b8d7e6c867224d64b861408af99965da83ba36c6
SSDEEP 1536:PrzL8rFqD1yUwK54mb9VImoutZ5S12jTARLgW9o:Pb4FhUwKea8mD212CLt9o
TLSH
T1EB530210F78B52D7B58D61B10AC2F00F13A557A0E72DB9EB124CB5602A2CED671D7AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 6.1MB
SHA256 a3352148f680a051708340c3c2640be462637f0b4a46a8b2edbc3bc02ae5401d
MD5 540069330e5d137760a94370745485f7
SHA1 58e9cb907ca6d43bd9f59b3ec11b39d46710cb1f
SHA512 29bc9ce549f6436356fc45802aa399ea3e95924bc507ee956e104595f64db33562d13eb70f4fe9e34c75489031ecac7bda4e07665f83cc8bac4f49a3baf4a28d
SSDEEP 49152:d8EPyTfwpHneao+6CP8WaSghxhdm727DJi5y3SkSIIGo0subUVLhmXTjdzLooMjZ:p
TLSH
T1E7562331DF1FED2E3669BB2CE05B2EA61F7B2917D558F0CDDA1480A612E9600CD4B874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 14.2MB
SHA256 ba9dba70f971a6e8682b463609ee06b8af6ee226d6a7c98c2257d528d2f60e8f
MD5 e71f4f71cea01f4fc7135daef22ad03b
SHA1 d2289647a71bd9d8d581a9e6446fe17b9f743cf0
SHA512 85b8167e5304481dcd9edc68c8cc75b30da0e4c30e972f459ea9ec56492eef93c51a9da9d09e721f224530efdea932885b6b3842ae7eb1183837507fd2b85239
SSDEEP 49152:gJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHZ:n
TLSH
T117E6CF320643FDBD3FAD3D45E0012E495D5D7A1B22A89249FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 28KB
SHA256 ffc5ba17f90c5e9287c0c9ec62d01634fb1efc63f60e32ae54926df8a2552453
MD5 fe99662adbe194a835fc0e2461a343ad
SHA1 7dad4064a1a9c0d815733315103a5745507e334e
SHA512 c56d743f64ab5a2538f006934a5073b4503b333990cfc3d5ac7ea09352a4860ad4208b832fa05ff94f6f2bc13b249cdf976f01af4093ad518040146be5c9abf6
SSDEEP 384:NcWw4IFDAMYiU/kAKJ9Y5MIcCEWu6OR6kXqaK4Tp/6WRkSsn94SvaLm:DT6DoD/kA9uC1uckXDbTR6WRTC
TLSH
T148D208750AE3207D38FC7E8638611D9D5D2C2B0D69BE030643C431B6A3AD5E8CE29E79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_aqZtKBMO.exe

Path C:\Users\Admin\AppData\Roaming\ExitSelect\agent_aqZtKBMO.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2652-12290-0x00007FFE69990000-0x00007FFE69C92000-memory.dmp

Download

memory/2652-12293-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2652-12295-0x00007FFE69990000-0x00007FFE69C92000-memory.dmp

Download

memory/2652-12292-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5428-12315-0x0000000005260000-0x0000000005282000-memory.dmp

Download

memory/5428-12327-0x00000000074B0000-0x00000000074E6000-memory.dmp

Download

memory/5428-12313-0x0000000002800000-0x0000000002836000-memory.dmp

Download

memory/5428-12317-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Download

memory/5428-12316-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Download

memory/5428-12320-0x0000000005B40000-0x0000000005E9B000-memory.dmp

Download

memory/5428-12324-0x0000000006060000-0x000000000607E000-memory.dmp

Download

memory/5428-12325-0x0000000006120000-0x000000000616C000-memory.dmp

Download

memory/5428-12326-0x0000000006630000-0x0000000006678000-memory.dmp

Download

memory/5428-12314-0x0000000005360000-0x00000000059AA000-memory.dmp

Download

memory/5428-12328-0x0000000070270000-0x00000000702BC000-memory.dmp

Download

memory/5428-12329-0x0000000070480000-0x00000000707DB000-memory.dmp

Download

memory/5428-12332-0x00000000074F0000-0x0000000007510000-memory.dmp

Download

memory/5428-12333-0x0000000007510000-0x00000000075B3000-memory.dmp

Download

memory/5428-12334-0x0000000007C70000-0x00000000082EC000-memory.dmp

Download

memory/5428-12335-0x0000000007630000-0x000000000764A000-memory.dmp

Download

memory/5428-12336-0x0000000007690000-0x000000000769A000-memory.dmp

Download

memory/5428-12337-0x0000000007740000-0x00000000077D6000-memory.dmp

Download

memory/5428-12338-0x0000000007B50000-0x0000000007B72000-memory.dmp

Download

memory/5428-12339-0x00000000088B0000-0x0000000008E6A000-memory.dmp

Download