salatstealer | 3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT12).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7
MD5 707e7f6492429b89d52a665cb47d2e1f
SHA1 5ce1c89efeda8a2bbf3419d1a7169cdfd08fae23
SHA512 7c85dacf2a739dbe585b3dbea34354da8cfc49c10975f1215ed8bc03baa6fb6f3c57483f8926fd24a104133e90a275c8a5f51f808ee7d9007fa61b08edf847c2
TLSH
T1C0816CA3E00DEE46F6CE757EF85FE6A52017C8C328D6D452435B89E8CC0EDB9594E085
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral15/files/0x001400000001c43e-6509.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
20	5648	powershell.exe
21	5648	powershell.exe
22	5648	powershell.exe
23	5648	powershell.exe
24	5648	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
1236	Setup-TaasfKQdEtTesVxb.exe
5064	Setup-TaasfKQdEtTesVxb.exe
4772	agent_XsHxTZso.exe
1404	Setup-TaasfKQdEtTesVxb.exe
2060	agent_CThrwTKU.exe
5084	agent_kjgSQEib.exe
584	Setup-TaasfKQdEtTesVxb.exe
3112	agent_kwmqnzBE.exe
2620	StartMenuExperienceHost.exe
2160	StartMenuExperienceHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2748	certutil.exe
4340	certutil.exe
6132	certutil.exe
5028	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\51cbe81d-746b-ef5b-bd77-1c1689c31d74	agent_XsHxTZso.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe	agent_XsHxTZso.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\StartMenuExperienceHost.exe	StartMenuExperienceHost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2280	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_CThrwTKU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_kjgSQEib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_XsHxTZso.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_kwmqnzBE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4772	agent_XsHxTZso.exe
4772	agent_XsHxTZso.exe
4772	agent_XsHxTZso.exe
4772	agent_XsHxTZso.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
5648	powershell.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
5648	powershell.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe
2620	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3680	winws.exe
Token: SeBackupPrivilege	3680	winws.exe
Token: SeDebugPrivilege	3680	winws.exe
Token: SeDebugPrivilege	2620	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeIncreaseQuotaPrivilege	5648	powershell.exe
Token: SeSecurityPrivilege	5648	powershell.exe
Token: SeTakeOwnershipPrivilege	5648	powershell.exe
Token: SeLoadDriverPrivilege	5648	powershell.exe
Token: SeSystemProfilePrivilege	5648	powershell.exe
Token: SeSystemtimePrivilege	5648	powershell.exe
Token: SeProfSingleProcessPrivilege	5648	powershell.exe
Token: SeIncBasePriorityPrivilege	5648	powershell.exe
Token: SeCreatePagefilePrivilege	5648	powershell.exe
Token: SeBackupPrivilege	5648	powershell.exe
Token: SeRestorePrivilege	5648	powershell.exe
Token: SeShutdownPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeSystemEnvironmentPrivilege	5648	powershell.exe
Token: SeRemoteShutdownPrivilege	5648	powershell.exe
Token: SeUndockPrivilege	5648	powershell.exe
Token: SeManageVolumePrivilege	5648	powershell.exe
Token: 33	5648	powershell.exe
Token: 34	5648	powershell.exe
Token: 35	5648	powershell.exe
Token: 36	5648	powershell.exe
Token: SeIncreaseQuotaPrivilege	5648	powershell.exe
Token: SeSecurityPrivilege	5648	powershell.exe
Token: SeTakeOwnershipPrivilege	5648	powershell.exe
Token: SeLoadDriverPrivilege	5648	powershell.exe
Token: SeSystemProfilePrivilege	5648	powershell.exe
Token: SeSystemtimePrivilege	5648	powershell.exe
Token: SeProfSingleProcessPrivilege	5648	powershell.exe
Token: SeIncBasePriorityPrivilege	5648	powershell.exe
Token: SeCreatePagefilePrivilege	5648	powershell.exe
Token: SeBackupPrivilege	5648	powershell.exe
Token: SeRestorePrivilege	5648	powershell.exe
Token: SeShutdownPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeSystemEnvironmentPrivilege	5648	powershell.exe
Token: SeRemoteShutdownPrivilege	5648	powershell.exe
Token: SeUndockPrivilege	5648	powershell.exe
Token: SeManageVolumePrivilege	5648	powershell.exe
Token: 33	5648	powershell.exe
Token: 34	5648	powershell.exe
Token: 35	5648	powershell.exe
Token: 36	5648	powershell.exe
Token: SeIncreaseQuotaPrivilege	5648	powershell.exe
Token: SeSecurityPrivilege	5648	powershell.exe
Token: SeTakeOwnershipPrivilege	5648	powershell.exe
Token: SeLoadDriverPrivilege	5648	powershell.exe
Token: SeSystemProfilePrivilege	5648	powershell.exe
Token: SeSystemtimePrivilege	5648	powershell.exe
Token: SeProfSingleProcessPrivilege	5648	powershell.exe
Token: SeIncBasePriorityPrivilege	5648	powershell.exe
Token: SeCreatePagefilePrivilege	5648	powershell.exe
Token: SeBackupPrivilege	5648	powershell.exe
Token: SeRestorePrivilege	5648	powershell.exe
Token: SeShutdownPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeSystemEnvironmentPrivilege	5648	powershell.exe
Token: SeRemoteShutdownPrivilege	5648	powershell.exe
Token: SeUndockPrivilege	5648	powershell.exe
Token: SeManageVolumePrivilege	5648	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 5656	2280	cmd.exe	91
PID 2280 wrote to memory of 6132	2280	cmd.exe	92
PID 2280 wrote to memory of 1236	2280	cmd.exe	93
PID 2280 wrote to memory of 5028	2280	cmd.exe	94
PID 2280 wrote to memory of 5064	2280	cmd.exe	95
PID 1236 wrote to memory of 4772	1236	Setup-TaasfKQdEtTesVxb.exe	96
PID 2280 wrote to memory of 2748	2280	cmd.exe	97
PID 2280 wrote to memory of 1404	2280	cmd.exe	98
PID 5064 wrote to memory of 2060	5064	Setup-TaasfKQdEtTesVxb.exe	99
PID 1404 wrote to memory of 5084	1404	Setup-TaasfKQdEtTesVxb.exe	101
PID 2280 wrote to memory of 4340	2280	cmd.exe	102
PID 2280 wrote to memory of 584	2280	cmd.exe	103
PID 2280 wrote to memory of 3680	2280	cmd.exe	104
PID 584 wrote to memory of 3112	584	Setup-TaasfKQdEtTesVxb.exe	106
PID 4772 wrote to memory of 2620	4772	agent_XsHxTZso.exe	109
PID 2620 wrote to memory of 5648	2620	StartMenuExperienceHost.exe	110
PID 2620 wrote to memory of 2160	2620	StartMenuExperienceHost.exe	112
PID 5648 wrote to memory of 1240	5648	powershell.exe	115

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT12).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5656
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:6132
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Users\Admin\AppData\Roaming\ProtectRevoke\agent_XsHxTZso.exe
    C:\Users\Admin\AppData\Roaming\ProtectRevoke\agent_XsHxTZso.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe
      "C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5648
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\StartMenuExperienceHost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\StartMenuExperienceHost.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2160
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Users\Admin\AppData\Roaming\ConvertFromSkip\agent_CThrwTKU.exe
    C:\Users\Admin\AppData\Roaming\ConvertFromSkip\agent_CThrwTKU.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2060
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2748
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Users\Admin\AppData\Roaming\UseSend\agent_kjgSQEib.exe
    C:\Users\Admin\AppData\Roaming\UseSend\agent_kjgSQEib.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5084
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Users\Admin\AppData\Roaming\MeasureUninstall\agent_kwmqnzBE.exe
    C:\Users\Admin\AppData\Roaming\MeasureUninstall\agent_kwmqnzBE.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3112
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=3 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n4
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 d8eccfe1ae6ec6e4a7f865688fe1760856033db69e133417e03679e60859c79e
MD5 47715b1ddc196dbb2f50b7a3bb7d9366
SHA1 e4bede47168a0bd15dbfb2cd4c144c2eb2518819
SHA512 f87aa4dab947035b1b77b568e1e2206babe7ca2e71826dda6250d11afff37d701f81f50227719aa866d43483452524d997707ec963dd92aa3174b4d29462584b
SSDEEP 768:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZGl9+e:lV9utQVN65vt6j6Uam
TLSH
T11DB24C304FE328BD399C7C5175205DEC6D6C2F8B1465030A97C978FAA2985BC8E29C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 b344e7df31031ed6f7edb0ce602cf0520a7283b4d76d17cbbcdc64f56deaf846
MD5 7304234d77b9f55c5ec26a8eef864a63
SHA1 97b5dc98cf3abd47c3e73a7eddeaf77b9f3243b1
SHA512 d85e9de877111110836c8dd652860e7d5abc950d6fe54d73e108009bfa6d26d0e96ae6db1db410c11b4ebd0cce6ca726f97502ed99da1793a07ec7d03a4289e2
SSDEEP 768:/FH31B2krfjmhFAKiHQ8J5Ma9zR20jjig:/FHH2krfjmhFAKiHQ8J5Ma9zR20vig
TLSH
T1FDB2F8735B723D302FEBB450266879A9930EB49470B3C2D9DF0D6DC6FEE616602B1528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 9.9MB
SHA256 71503d64faf081db130edd3262ffc918ae721c8a7fb51c6f03983cbafd2d0d26
MD5 a43391f762c6d3a46a14b8f3be427731
SHA1 b6849711da0edfb1d75c7ec741dc401f5edc1803
SHA512 6a1e7714136fa4c297557ca021548bca0e9f5fd541c4283e31172b54fdda3bcb8517be93abb949a824f5a619d00f5dad028a0401f478ab0f2e576b68275ccb2b
SSDEEP 49152:PrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxhdm727DJi5y3E:c
TLSH
T110A6F1331603FDDA2FA95D45D00439812C5C796B52E4E2E4FF4E75AB61EA620EE3D8B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 44KB
SHA256 ff817a02237fb32a1af9cc2c881265f83c8be6ad73e7b9430300de68ab3f2743
MD5 ff69cfb172296b6435ce0b3b5a4f9d71
SHA1 e1807d4fdb865925abfde89240c62154829c99d7
SHA512 f914bb6f221beefb4eee65bdd556046da28db0245cf62919bcd5bf5c675689e91fd651482bfe089ba71380a94c1c5668c65856fd510d73be2dd8d81ef01651f0
SSDEEP 768:jKFFPoyjMUK2vKj092kADeQUlU5cFB3h1oGME3UdikCCqc9AwOve:j6FPoyjMUK2vKj092kADe/UGBkdikCaT
TLSH
T164134A3651D3A07D34BC7D0674120D8E1C1EAA1AA526674323C534BDA7BE8FC9A1BF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 13.1MB
SHA256 ae28774e78700d6ac525c53bcd45468c67383a0bcf42f223ae8127347cb484e0
MD5 2a588d0202bca386f1058ed7d09f2d3b
SHA1 48b52b599011f576e97023ccd7f9f2d17135bdee
SHA512 a11bb1dc7963b21b7d31531da6f9773269580cfb5203c7d1152901029d2d6db17b4a43680fae244c94b65ca1ae21bd7b044910fecfbad62e1b35ce6a8a4f1ef1
SSDEEP 49152:thmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6m:S
TLSH
T1C6D6CF320243FDBD3FAD2D45E0052D451D9D7A1B62A8D299FB8930BA63EE564CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_XsHxTZso.exe

Path C:\Users\Admin\AppData\Roaming\ProtectRevoke\agent_XsHxTZso.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3680-13580-0x00007FF828CA0000-0x00007FF828FA2000-memory.dmp

Download

memory/3680-13584-0x00007FF828CA0000-0x00007FF828FA2000-memory.dmp

Download

memory/3680-13582-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/3680-13581-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5648-13601-0x0000000005750000-0x00000000057B6000-memory.dmp

Download

memory/5648-13614-0x00000000078C0000-0x00000000078F6000-memory.dmp

Download

memory/5648-13600-0x00000000056B0000-0x00000000056D2000-memory.dmp

Download

memory/5648-13602-0x0000000005F40000-0x0000000005FA6000-memory.dmp

Download

memory/5648-13598-0x0000000002C60000-0x0000000002C96000-memory.dmp

Download

memory/5648-13605-0x0000000005FB0000-0x000000000630B000-memory.dmp

Download

memory/5648-13606-0x00000000064A0000-0x00000000064BE000-memory.dmp

Download

memory/5648-13607-0x0000000006590000-0x00000000065DC000-memory.dmp

Download

memory/5648-13610-0x0000000007680000-0x00000000076C8000-memory.dmp

Download

memory/5648-13599-0x00000000057C0000-0x0000000005E0A000-memory.dmp

Download

memory/5648-13615-0x0000000070DB0000-0x0000000070DFC000-memory.dmp

Download

memory/5648-13616-0x0000000070FC0000-0x000000007131B000-memory.dmp

Download

memory/5648-13619-0x0000000007900000-0x0000000007920000-memory.dmp

Download

memory/5648-13620-0x0000000007920000-0x00000000079C3000-memory.dmp

Download

memory/5648-13621-0x00000000080A0000-0x000000000871C000-memory.dmp

Download

memory/5648-13622-0x0000000007A60000-0x0000000007A7A000-memory.dmp

Download

memory/5648-13623-0x0000000007AC0000-0x0000000007ACA000-memory.dmp

Download

memory/5648-13624-0x0000000007B70000-0x0000000007C06000-memory.dmp

Download

memory/5648-13625-0x0000000007F70000-0x0000000007F92000-memory.dmp

Download

memory/5648-13626-0x0000000008CE0000-0x000000000929A000-memory.dmp

Download