salatstealer | 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT11).bat
Size 4KB
Sample260730-w44lwavemb
SHA256 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85
MD5 81d21053303452399da6b09313cac0b3
SHA1 f4ab94b0bcbb1e29e6f301f1e30772d64608c0a7
SHA512 e44157ba880e11d3e0688856213e2ff3892ce47ce1013ff38c55a3dc0c376971804d777129fa823511672857905c0981ad856fbfb2cf7cc2b5161af95474826d
SSDEEP 96:nL67mQGB/GRRQ1z/IKdUGB/GR6Vv/GRRQuv/GR65P+RJ5+RRLxD:AmQGB/GRRGgVGB/GRKv/GRRDv/GRuP+M
TLSH
T125914BA3E00DEE46F6CE757EF85FF6A52017C8C328D6D452435B89E8CC0EDB9595A084
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral12/files/0x00070000000245f3-7496.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
53	1204	powershell.exe
54	1204	powershell.exe
55	1204	powershell.exe
56	1204	powershell.exe
57	1204	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
4860	Setup-TaasfKQdEtTesVxb.exe
2724	agent_SpqruCfd.exe
4048	Setup-TaasfKQdEtTesVxb.exe
2408	agent_ItuooIyS.exe
3836	Setup-TaasfKQdEtTesVxb.exe
2912	agent_bCmEljgf.exe
1332	Setup-TaasfKQdEtTesVxb.exe
4948	taskhostw.exe
2212	agent_rtlAVMwC.exe
3780	taskhostw.exe
2072	taskhostw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2252	certutil.exe
868	certutil.exe
2620	certutil.exe
636	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\b523cc60-d1d5-3e48-3446-0285a65960d1	agent_SpqruCfd.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe	agent_SpqruCfd.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\taskhostw.exe	taskhostw.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\taskhostw.exe	taskhostw.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4764	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_ItuooIyS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_bCmEljgf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_rtlAVMwC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_SpqruCfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2724	agent_SpqruCfd.exe
2724	agent_SpqruCfd.exe
2724	agent_SpqruCfd.exe
2724	agent_SpqruCfd.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
1204	powershell.exe
4948	taskhostw.exe
4948	taskhostw.exe
1204	powershell.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe
4948	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4744	winws.exe
Token: SeBackupPrivilege	4744	winws.exe
Token: SeDebugPrivilege	4744	winws.exe
Token: SeDebugPrivilege	1204	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 1440	4764	cmd.exe	88
PID 4764 wrote to memory of 2252	4764	cmd.exe	89
PID 4764 wrote to memory of 4860	4764	cmd.exe	90
PID 4860 wrote to memory of 2724	4860	Setup-TaasfKQdEtTesVxb.exe	93
PID 4764 wrote to memory of 868	4764	cmd.exe	94
PID 4764 wrote to memory of 4048	4764	cmd.exe	95
PID 4048 wrote to memory of 2408	4048	Setup-TaasfKQdEtTesVxb.exe	101
PID 4764 wrote to memory of 2620	4764	cmd.exe	104
PID 4764 wrote to memory of 3836	4764	cmd.exe	105
PID 3836 wrote to memory of 2912	3836	Setup-TaasfKQdEtTesVxb.exe	108
PID 4764 wrote to memory of 636	4764	cmd.exe	109
PID 4764 wrote to memory of 1332	4764	cmd.exe	110
PID 4764 wrote to memory of 4744	4764	cmd.exe	111
PID 2724 wrote to memory of 4948	2724	agent_SpqruCfd.exe	113
PID 1332 wrote to memory of 2212	1332	Setup-TaasfKQdEtTesVxb.exe	114
PID 4948 wrote to memory of 1204	4948	taskhostw.exe	115
PID 4948 wrote to memory of 3780	4948	taskhostw.exe	117
PID 4948 wrote to memory of 2072	4948	taskhostw.exe	119
PID 1204 wrote to memory of 1852	1204	powershell.exe	122

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT11).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1440
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2252
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Roaming\UnpublishTest\agent_SpqruCfd.exe
    C:\Users\Admin\AppData\Roaming\UnpublishTest\agent_SpqruCfd.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe
      "C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1204
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\taskhostw.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\taskhostw.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3780
    - - C:\Program Files\Google\Chrome\Application\taskhostw.exe
        
        "C:\Program Files\Google\Chrome\Application\taskhostw.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2072
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:868
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Users\Admin\AppData\Roaming\CheckpointReceive\agent_ItuooIyS.exe
    C:\Users\Admin\AppData\Roaming\CheckpointReceive\agent_ItuooIyS.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2408
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2620
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Users\Admin\AppData\Roaming\Adobe\agent_bCmEljgf.exe
    C:\Users\Admin\AppData\Roaming\Adobe\agent_bCmEljgf.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2912
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:636
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Users\Admin\AppData\Roaming\Microsoft\agent_rtlAVMwC.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\agent_rtlAVMwC.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2212
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n4
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 12.9MB
SHA256 4c3feced005a42daa619f0f7311c714b1ac719b6fb707e54b9bb888b9e9d734b
MD5 c3449f78d0eb832286c8ba066e50001f
SHA1 4a7e01e4f0d9845665a1fd8f0efd4589676c44fe
SHA512 71551cb2cbdebea3141be0928faf221634692ddec291293b6af98bdeb5a3ef0c6c6ce3912421275fefbd4f0e7c5bfcd1d465fdd4ae27d7dfd4d3858f86313bcd
SSDEEP 49152:7mOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6Cp:u
TLSH
T160D6CF320243FDBD3FAD2D45E0052D451D9D7A1B62A8D299FB8930BA63EA564CE3CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 2c2638f234882b9224ec4afb79baecb02b4fc79c89a64fb2509562b2d9526b3e
MD5 62a4d9ec20231ef2cb5e7eb1ae987adc
SHA1 4bbdd124a61d75a6136ec43524c874f1aac09914
SHA512 45979047915ce80feb427f8ee10e7d8f0a4c846da1802ef24151e4cf88d1626676eddc02744c5fc73d12924ae3eaaef1a5ad07666398e254095c81bdb93f5591
SSDEEP 384:kVByA2BZAFSuwNAQrDKHggqnB3TMY5Xlk4JnpDiV:kVYA2BZAFSyQrEggq9PkiRq
TLSH
T13292E8384BE3247C39AC7D8639224D9DAEAC2B4C1476074B57C530F9F79C9AC8E19939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 1a2341b8d7a035fc8924709e2c818e9c2231470a4cffcb268e043c56a151c2fe
MD5 51537630cb01f0a7675fbe8c08961f06
SHA1 babc62e22d9e7bed18824496b811f593e77a09cc
SHA512 d623c7ee0dd9bc83cc74163ee5feeccceaa800d71f472dc1c1069a60ff3881a101a240ffdf66acd095f4acb234126facb4ef262c4797ad95587f06d7864ffa01
SSDEEP 384:+Uw+qQCxPqIVRaogJdRKGwBuUfnhLDV0KUOQABUsDQB:rvqPqIVRaog/lwkU/N7asDQB
TLSH
T197921A38870B657C39AD7C55B4021E4D2E8E7629523E57167BC2343E73680E88F28FB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 14.2MB
SHA256 e0bf4257c2d8dd567fb272ebe4b6d97022638fb3c7fbba7eb515aac2aecef8ea
MD5 f3845346454d3e8fd3521879bd27c620
SHA1 bb9c87638e2b7e6d210d03eecb9c7ca8b15721bc
SHA512 ae75e85149812187e9c28299780fc359ffd875c2c6a7b8945ffece7db1157a20132544d034a0da15acc362ba67e2dcf28d03da71bc6f53598f4352e74c2d3b61
SSDEEP 49152:gJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHZ:n
TLSH
T1EBE6CF320643FDBD3FAD3D45E0012D495D9D7A1B22A89249FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 430a6e344da69c81025b7da7f38f36e48780837f685978fa0d1d01e624beb8dd
MD5 83737ea3da30a4140057311e7a5927f7
SHA1 4c92c12952bf31b115895894799727970a67392a
SHA512 8e3af443385243e773551b60defcddf23a3dee835d4c0b7d88fe85f02400a695bb2c66bd34dd0ac4c02a7bd812ca2856f772ef55aea5bdd7d6459d940d222ef2
SSDEEP 384:lVH9x1M0YqutQse9FKkNKn5BYdAQFNl88uayR2ZxBp6UaMEDEZ/Hopsli:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZP
TLSH
T107926E704AE33CBD3D8C7C5061505DAC5D6C2F8B51650209ABC834FA63E85BC8E6AD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 3.3MB
SHA256 957c7a0fc7ee60e51d328e191b6634a0acab1b9f1d0e6a5ecd6e1448b5cc8bb7
MD5 b782abff8bac9cc199db5b9e92384322
SHA1 9242af6f5d1c2463d1f44b59e11f2671825834b0
SHA512 2429d092ebc1602c9e999e7f0b2070134adebacc6ba811382139ebafe33c76614f3146dc06f2fb1aa4a071027957a1a58616562e42fe7d5a86bd4f566ee77c7a
SSDEEP 24576:9g04WGFfV1rYAAl7g0YLtIim/hEaK4uJEieJpmWMQSfun4ryHIb0l:KLJr0gPLhmOcuOJplhxnDTl
TLSH
T117F5293506A774BC39BC7D4674120D4D6E9D2B0E157A430767C530BEA3AD8E8CE29E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 14.3MB
SHA256 0a018ab973b7cea1b61def32dbe282698a793f25e0598d280aa08124c37c2714
MD5 9ecf441eeb317af10a478d424b2b20b8
SHA1 03cc17f0659103e0c2ae417d056f8b9a7cfcf61d
SHA512 fd5484ba25596411d15b1722c854a421e696e2377b62ff10c8be89901351577b0b65ebf30c08b2d9c6788cc019bbc19b06752527617f9327d00bc7ce360a5baf
SSDEEP 49152:KLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwp5:B
TLSH
T138E6CF320643FDBD3FAD3D85E0012E495D5D7A1B12A89249FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zlb3mhkf.o2u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zlb3mhkf.o2u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_SpqruCfd.exe

Path C:\Users\Admin\AppData\Roaming\UnpublishTest\agent_SpqruCfd.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1204-14498-0x00000000079D0000-0x00000000079EE000-memory.dmp

Download

memory/1204-14487-0x00000000075C0000-0x00000000075DA000-memory.dmp

Download

memory/1204-14512-0x0000000008910000-0x0000000008EB4000-memory.dmp

Download

memory/1204-14465-0x0000000002AC0000-0x0000000002AF6000-memory.dmp

Download

memory/1204-14466-0x0000000005690000-0x0000000005CB8000-memory.dmp

Download

memory/1204-14467-0x0000000005460000-0x0000000005482000-memory.dmp

Download

memory/1204-14468-0x0000000005D30000-0x0000000005D96000-memory.dmp

Download

memory/1204-14511-0x0000000007BC0000-0x0000000007BE2000-memory.dmp

Download

memory/1204-14469-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Download

memory/1204-14475-0x0000000005E10000-0x0000000006164000-memory.dmp

Download

memory/1204-14479-0x00000000064B0000-0x00000000064FC000-memory.dmp

Download

memory/1204-14478-0x0000000006400000-0x000000000641E000-memory.dmp

Download

memory/1204-14484-0x00000000069B0000-0x00000000069F4000-memory.dmp

Download

memory/1204-14485-0x0000000007540000-0x00000000075B6000-memory.dmp

Download

memory/1204-14486-0x0000000007C40000-0x00000000082BA000-memory.dmp

Download

memory/1204-14506-0x0000000007B90000-0x0000000007B98000-memory.dmp

Download

memory/1204-14488-0x0000000007990000-0x00000000079C2000-memory.dmp

Download

memory/1204-14489-0x0000000070040000-0x000000007008C000-memory.dmp

Download

memory/1204-14490-0x0000000070740000-0x0000000070A94000-memory.dmp

Download

memory/1204-14505-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

Download

memory/1204-14499-0x00000000079F0000-0x0000000007A93000-memory.dmp

Download

memory/1204-14500-0x0000000007AF0000-0x0000000007AFA000-memory.dmp

Download

memory/1204-14501-0x00000000082C0000-0x0000000008356000-memory.dmp

Download

memory/1204-14502-0x0000000007B20000-0x0000000007B31000-memory.dmp

Download

memory/1204-14503-0x0000000007B50000-0x0000000007B5E000-memory.dmp

Download

memory/1204-14504-0x0000000007B60000-0x0000000007B74000-memory.dmp

Download

memory/4744-14445-0x00007FFE097D0000-0x00007FFE09AD2000-memory.dmp

Download

memory/4744-14449-0x00007FFE097D0000-0x00007FFE09AD2000-memory.dmp

Download

memory/4744-14448-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4744-14446-0x0000000100400000-0x000000010043C000-memory.dmp

Download