salatstealer | 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT11).bat
Size 4KB
Sample260730-w44lwavemb
SHA256 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85
MD5 81d21053303452399da6b09313cac0b3
SHA1 f4ab94b0bcbb1e29e6f301f1e30772d64608c0a7
SHA512 e44157ba880e11d3e0688856213e2ff3892ce47ce1013ff38c55a3dc0c376971804d777129fa823511672857905c0981ad856fbfb2cf7cc2b5161af95474826d
SSDEEP 96:nL67mQGB/GRRQ1z/IKdUGB/GR6Vv/GRRQuv/GR65P+RJ5+RRLxD:AmQGB/GRRGgVGB/GRKv/GRRDv/GRuP+M
TLSH
T125914BA3E00DEE46F6CE757EF85FF6A52017C8C328D6D452435B89E8CC0EDB9595A084
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral13/files/0x001000000001c4df-5020.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
26	4672	powershell.exe
27	4672	powershell.exe
28	4672	powershell.exe
29	4672	powershell.exe
30	4672	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
4828	Setup-TaasfKQdEtTesVxb.exe
1352	Setup-TaasfKQdEtTesVxb.exe
6000	agent_uqAOiPxv.exe
5940	Setup-TaasfKQdEtTesVxb.exe
4528	agent_AgvJYDhX.exe
2028	Setup-TaasfKQdEtTesVxb.exe
5280	agent_jvvnHGUS.exe
5600	fontdrvhost.exe
6072	agent_WsaGGSVe.exe
1512	fontdrvhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
800	certutil.exe
3776	certutil.exe
2600	certutil.exe
4508	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe	fontdrvhost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\a414fc36-a139-f6cd-1294-9e7c8f4a36a1	agent_uqAOiPxv.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fontdrvhost.exe	agent_uqAOiPxv.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_uqAOiPxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_AgvJYDhX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_jvvnHGUS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_WsaGGSVe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
6000	agent_uqAOiPxv.exe
6000	agent_uqAOiPxv.exe
6000	agent_uqAOiPxv.exe
6000	agent_uqAOiPxv.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe
5600	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	200	winws.exe
Token: SeBackupPrivilege	200	winws.exe
Token: SeDebugPrivilege	200	winws.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	5600	fontdrvhost.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 3620	4456	cmd.exe	90
PID 4456 wrote to memory of 800	4456	cmd.exe	91
PID 4456 wrote to memory of 4828	4456	cmd.exe	92
PID 4456 wrote to memory of 3776	4456	cmd.exe	93
PID 4456 wrote to memory of 1352	4456	cmd.exe	94
PID 4828 wrote to memory of 6000	4828	Setup-TaasfKQdEtTesVxb.exe	95
PID 4456 wrote to memory of 2600	4456	cmd.exe	97
PID 4456 wrote to memory of 5940	4456	cmd.exe	98
PID 1352 wrote to memory of 4528	1352	Setup-TaasfKQdEtTesVxb.exe	99
PID 4456 wrote to memory of 4508	4456	cmd.exe	100
PID 4456 wrote to memory of 2028	4456	cmd.exe	101
PID 4456 wrote to memory of 200	4456	cmd.exe	102
PID 5940 wrote to memory of 5280	5940	Setup-TaasfKQdEtTesVxb.exe	104
PID 6000 wrote to memory of 5600	6000	agent_uqAOiPxv.exe	106
PID 2028 wrote to memory of 6072	2028	Setup-TaasfKQdEtTesVxb.exe	107
PID 5600 wrote to memory of 4672	5600	fontdrvhost.exe	108
PID 5600 wrote to memory of 1512	5600	fontdrvhost.exe	110
PID 4672 wrote to memory of 304	4672	powershell.exe	113

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT11).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3620
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:800
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Users\Admin\AppData\Roaming\EditWait\agent_uqAOiPxv.exe
    C:\Users\Admin\AppData\Roaming\EditWait\agent_uqAOiPxv.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Program Files (x86)\Windows Defender\fontdrvhost.exe
      "C:\Program Files (x86)\Windows Defender\fontdrvhost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5600
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4672
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1512
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3776
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Users\Admin\AppData\Roaming\OutUse\agent_AgvJYDhX.exe
    C:\Users\Admin\AppData\Roaming\OutUse\agent_AgvJYDhX.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4528
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Users\Admin\AppData\Roaming\OptimizeUndo\agent_jvvnHGUS.exe
    C:\Users\Admin\AppData\Roaming\OptimizeUndo\agent_jvvnHGUS.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5280
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Roaming\ConvertSwitch\agent_WsaGGSVe.exe
    C:\Users\Admin\AppData\Roaming\ConvertSwitch\agent_WsaGGSVe.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6072
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n4
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 28KB
SHA256 64135003ce193949f85243b654b99cd04e6be3ed8f755999261d99d1321faaf3
MD5 a409f9757dfce89644e5ebf7b884c13e
SHA1 41367c001e4f20bd43313bb0fe54c6729fb2ba3b
SHA512 9ba3757e46b9dde67c529629a2149ff4699ef6738da8e1ab3b63d68ad1f7cc91edb759c19f6c51e0d2a36f3b1735d4567ddd7d6f615c747973c6cf40f5583d4e
SSDEEP 768:EiKPRZ7XQoO4Y+K97nyD1+r5UVgJZ0+cH:uPRtgoO4Y5yZ+CCJZ0+cH
TLSH
T141D2E0A3F8F9B0E52EBFD4729F234FD51429CEBF168DB6489606080B8B565D4554E00F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 4.6MB
SHA256 4d698bacabad194f0b8044c571d609daddb18778f9df79da3502c1a38b9d32af
MD5 b3cbb3f86848ca561520db37afe44554
SHA1 fdc0c7d50835cd9ab399786538280872a4c92204
SHA512 a960c32d24f2f8fcfe07c9cb4df33e35523143c2fc2aa50fe223a351a9f90f6cff80088bcae2670a6a3f17f12e7f79cac6d7c76af0f8be558a24c659fe9ec5de
SSDEEP 49152:cxhdm727DJi5y3SkSIIGo0subUVLhmXTjdzLooMjsMiAAPCCm:3
TLSH
T156262332DF0FED2E7669BB1CE05B2DA61F7B2967D154E08DDA24D0B612E8640CD0B874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 218783a1aabe6386bf2aa4638cdae31cd54c771c39fef6515ce79a45ef83e467
MD5 f20aceaef5e6772d13fb6fbe0345dae3
SHA1 688290bd76ef895abc41523ba23b8a7137126373
SHA512 97707910a99bf321d7e86570c506038f587cd1927e8b499cd97f8147ccef2df2ac38ad926bc6c9cc1eecbefafebb14b4e09b111b95c797ab7d7b928532e83780
SSDEEP 384:+Z8KehPDzqo05yosfAe4kshCztUo7adAl4JT1Ks2syL+R/YqHWcdfaqQrh8dVp:uehP45MAeRZUo7yD2XL+b2cdbd7
TLSH
T158B22A780AF734BD35BC3C1664121D1E5E5E4B0E466A430B67C471BAB3ED4E88E28A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 12.1MB
SHA256 e61747de17eef8185826c36858ee8154bd821abc238246ef997d40185cfd199c
MD5 9fc3cc4328a2fdc63c9b4d636f48d078
SHA1 3fe109eff2a308e7ccb42dd1beb48a2b83551a0f
SHA512 64c96a0e7b3836b6c044aee63dfc067a347c969e30e28f0daa8c0fc3a40ac7efc501f1f32fee58b0403d038b95f0bc568cf94b6231e333dbf8c1dead1021de74
SSDEEP 49152:JJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSV:p
TLSH
T11BD6DF320243FDED2F6A2D84D0053E411D9D7A1B62A4D299FF8D34BA62EA564DE3CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 68KB
SHA256 ca929ef7c960adf5a9032f5c5c0cc06f77e0cee2c07cf10d69bad583efb2a8bd
MD5 02d9dd7bc2d0d53bee70fdda3ba76ac0
SHA1 442c11247b7b6918ea8f07d6c8102dd9a0c52574
SHA512 01e34e28ae8e6ba1c03798f1f87b1c9d69ba9cf111e588b1b2f3a7316978abf92055f4eeb2aad9132957784fd48d27e535256fb82c5efb22a1fc85130a654ab4
SSDEEP 1536:lV9utQVN65vt6j6Uaj8YMc03aBP2RTqI9fMlhO:lV9uUN6x8pc0qBP2R8O
TLSH
T1FE634A304FF728FD39AC7D6234604E9C9D6C1E0B19A9131B57C434FA729D6AC8F29869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_uqAOiPxv.exe

Path C:\Users\Admin\AppData\Roaming\EditWait\agent_uqAOiPxv.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-11964-0x00007FFDB2BB0000-0x00007FFDB2EB2000-memory.dmp

Download

memory/200-11968-0x00007FFDB2BB0000-0x00007FFDB2EB2000-memory.dmp

Download

memory/200-11966-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/200-11965-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4672-11993-0x0000000006320000-0x0000000006386000-memory.dmp

Download

memory/4672-12001-0x0000000007CE0000-0x0000000007D16000-memory.dmp

Download

memory/4672-11989-0x0000000006100000-0x0000000006122000-memory.dmp

Download

memory/4672-11992-0x00000000062B0000-0x0000000006316000-memory.dmp

Download

memory/4672-11986-0x0000000005420000-0x0000000005456000-memory.dmp

Download

memory/4672-11994-0x0000000006440000-0x000000000679B000-memory.dmp

Download

memory/4672-11995-0x0000000006890000-0x00000000068AE000-memory.dmp

Download

memory/4672-11996-0x00000000068F0000-0x000000000693C000-memory.dmp

Download

memory/4672-12000-0x0000000006D50000-0x0000000006D98000-memory.dmp

Download

memory/4672-11988-0x0000000005AB0000-0x00000000060FA000-memory.dmp

Download

memory/4672-12002-0x00000000702A0000-0x00000000702EC000-memory.dmp

Download

memory/4672-12003-0x0000000070400000-0x000000007075B000-memory.dmp

Download

memory/4672-12006-0x0000000007D20000-0x0000000007D40000-memory.dmp

Download

memory/4672-12007-0x0000000007D40000-0x0000000007DE3000-memory.dmp

Download

memory/4672-12008-0x00000000084B0000-0x0000000008B2C000-memory.dmp

Download

memory/4672-12009-0x0000000007E70000-0x0000000007E8A000-memory.dmp

Download

memory/4672-12010-0x0000000007ED0000-0x0000000007EDA000-memory.dmp

Download

memory/4672-12011-0x0000000007F80000-0x0000000008016000-memory.dmp

Download

memory/4672-12012-0x0000000008380000-0x00000000083A2000-memory.dmp

Download

memory/4672-12013-0x00000000090F0000-0x00000000096AA000-memory.dmp

Download