salatstealer | 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT2).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
MD5 802a10c9f71f69ebe61eeae7693ba0e5
SHA1 8548aca5802a54f0bceaac04a6c22767de76f86c
SHA512 a37d97055d38a04e4eef3853cdc7519f1b79cb01a63ccf66fe9558ae678da98e696443cba44847bc28ba08eb15f894b4f8b4fad470a93d0e345004a5ddcf48c5
TLSH
T1D5613957E00DDE4AB68EB83FF89EE5E52017C4C31CD6D452439B89E8C84EDBE494E485
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral16/files/0x000700000002445a-6285.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
51	1848	powershell.exe
52	1848	powershell.exe
53	1848	powershell.exe
54	1848	powershell.exe
55	1848	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
3012	Setup-TaasfKQdEtTesVxb.exe
4484	agent_oQQxtBha.exe
2712	Setup-TaasfKQdEtTesVxb.exe
4308	agent_cxkjPNzY.exe
3696	Setup-TaasfKQdEtTesVxb.exe
3256	agent_KUgprfIy.exe
2596	Setup-TaasfKQdEtTesVxb.exe
8	taskhostw.exe
1656	agent_JIqaFIVo.exe
4984	taskhostw.exe
4460	taskhostw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3824	certutil.exe
2344	certutil.exe
4044	certutil.exe
2088	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\b66fdd4f-04f1-becf-9d26-b1c8b94a4f04	agent_oQQxtBha.exe
File opened for modification	C:\Program Files (x86)\Adobe\WmiPrvSE.exe	agent_oQQxtBha.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\taskhostw.exe	taskhostw.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\taskhostw.exe	taskhostw.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
556	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_oQQxtBha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_JIqaFIVo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_cxkjPNzY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_KUgprfIy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4484	agent_oQQxtBha.exe
4484	agent_oQQxtBha.exe
4484	agent_oQQxtBha.exe
4484	agent_oQQxtBha.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
1848	powershell.exe
8	taskhostw.exe
8	taskhostw.exe
1848	powershell.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe
8	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1548	winws.exe
Token: SeBackupPrivilege	1548	winws.exe
Token: SeDebugPrivilege	1548	winws.exe
Token: SeDebugPrivilege	1848	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2184	556	cmd.exe	86
PID 556 wrote to memory of 2344	556	cmd.exe	91
PID 556 wrote to memory of 3012	556	cmd.exe	93
PID 3012 wrote to memory of 4484	3012	Setup-TaasfKQdEtTesVxb.exe	96
PID 556 wrote to memory of 4044	556	cmd.exe	97
PID 556 wrote to memory of 2712	556	cmd.exe	98
PID 2712 wrote to memory of 4308	2712	Setup-TaasfKQdEtTesVxb.exe	99
PID 556 wrote to memory of 2088	556	cmd.exe	100
PID 556 wrote to memory of 3696	556	cmd.exe	101
PID 3696 wrote to memory of 3256	3696	Setup-TaasfKQdEtTesVxb.exe	104
PID 556 wrote to memory of 3824	556	cmd.exe	105
PID 556 wrote to memory of 2596	556	cmd.exe	106
PID 556 wrote to memory of 1548	556	cmd.exe	107
PID 4484 wrote to memory of 8	4484	agent_oQQxtBha.exe	109
PID 2596 wrote to memory of 1656	2596	Setup-TaasfKQdEtTesVxb.exe	110
PID 8 wrote to memory of 1848	8	taskhostw.exe	111
PID 8 wrote to memory of 4984	8	taskhostw.exe	113
PID 8 wrote to memory of 4460	8	taskhostw.exe	116
PID 1848 wrote to memory of 4712	1848	powershell.exe	118

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT2).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2184
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2344
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Users\Admin\AppData\Roaming\EnterPush\agent_oQQxtBha.exe
    C:\Users\Admin\AppData\Roaming\EnterPush\agent_oQQxtBha.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Users\Admin\AppData\Local\Google\taskhostw.exe
      C:\Users\Admin\AppData\Local\Google\taskhostw.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:8
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1848
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4712
    - - C:\Program Files\Google\Chrome\Application\taskhostw.exe
        
        "C:\Program Files\Google\Chrome\Application\taskhostw.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\taskhostw.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\taskhostw.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4460
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4044
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Users\Admin\AppData\Roaming\RepairJoin\agent_cxkjPNzY.exe
    C:\Users\Admin\AppData\Roaming\RepairJoin\agent_cxkjPNzY.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4308
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2088
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Users\Admin\AppData\Roaming\Mozilla\agent_KUgprfIy.exe
    C:\Users\Admin\AppData\Roaming\Mozilla\agent_KUgprfIy.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3256
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3824
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Users\Admin\AppData\Roaming\NewRename\agent_JIqaFIVo.exe
    C:\Users\Admin\AppData\Roaming\NewRename\agent_JIqaFIVo.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1656
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 430a6e344da69c81025b7da7f38f36e48780837f685978fa0d1d01e624beb8dd
MD5 83737ea3da30a4140057311e7a5927f7
SHA1 4c92c12952bf31b115895894799727970a67392a
SHA512 8e3af443385243e773551b60defcddf23a3dee835d4c0b7d88fe85f02400a695bb2c66bd34dd0ac4c02a7bd812ca2856f772ef55aea5bdd7d6459d940d222ef2
SSDEEP 384:lVH9x1M0YqutQse9FKkNKn5BYdAQFNl88uayR2ZxBp6UaMEDEZ/Hopsli:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZP
TLSH
T107926E704AE33CBD3D8C7C5061505DAC5D6C2F8B51650209ABC834FA63E85BC8E6AD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 802f423b8d0386974b0cf5c9019d5e53a86d04ad12896c542f2305bcbfc49c8a
MD5 858f23c4bc7fc84b9c0b2b9c71a0258b
SHA1 50eae682f4dec6a50ae85c6ccb1aa76b10e195a4
SHA512 c13db50d1fe28e286f6f0b1e882014309f9a045ae095935be410897bbaae798452d0666c08acc2974662b67b2d3e305aed209d6f415886db3db56af32eacba5f
SSDEEP 384:3AHg2zETTHQ5fKnL0Kqrn7Rz7W/lKZ1yU3nq/9WDplPvB:/nHQX177Rz7WNKZ1y0K9WDplPZ
TLSH
T17792A63A06AB74B8387D7E46A0121D4D5E8E6A0B177A1706B7C6307B67FD5D0CA18F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 13.0MB
SHA256 8f22fab3360415893a6aaba9a319f1840e58af1d679bbeff373dd75524c32f12
MD5 10937a328f8954cc0ae1732e3cefcaf8
SHA1 61fe16dbaf7e3a9a4b9000a68a839208884e728f
SHA512 83bf7076837559f243071b9825429e40781da84d7ddc9915ff849c1a43e0662d50ab0a2c123d80d021961308e2a70ed51f64986e22fcac5dda823eff7429f680
SSDEEP 49152:dmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6Cp:4
TLSH
T1D5D6CF320243FDBD3FAD2D45E0052D451D9D7A1B62A8D299FB8930BA63EE564CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 11.7MB
SHA256 b633e689db7aa86f4d683c125b1f427ce5d1bae379e6d15c65f1ec0b6d734aaa
MD5 57a9bf59c1f6f35e3fe348f62395be84
SHA1 22e62a759a1078e722b5529ab32b433236fb5c1a
SHA512 88690de4e75f5f5d63c2d70410537b445144d3e97aebfc26279b86058a45da63bf09ce3055d5678f34c118af9be6a3cfeeed2e9b0d37340d4972b5b374d2aa4e
SSDEEP 49152:EnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxhdC:k
TLSH
T12CC6D0334243FDEE2F6A5D88D0043A415D9D7A5B62A4D298FF4D34BA22EE524DE3C874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 4d4440a251ef8ecc9d1b18f23c0ceb01efdc89b92e3742df595dce415e412d08
MD5 0b45919f93529f2314dd6ed37e3f4497
SHA1 ed22b2f8dfafc1ba8c85f0658efab430e0f2e37b
SHA512 b6ea3ecbabcf25a5e4af7fd65d62c273906c9e56ea4f97bdd29f7556a3180b0309de7f8e8db1689ca3d3fa1dd6e931c26cdffd8f1d003b6d348e93bfc914ea87
SSDEEP 384:KSePeDD1l92sw+GZxZncE3iZrDpGfrZkGkVuJoYrLmWrLTCQhTx4:lePq1l7MxieiZByEVuJZrLmWrLGQh2
TLSH
T19F924B3543A764F936BC7C4860320C9D9D5DAA48187D135377CA3CFA638D8AC891EEA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 01280f2808983b377b0f6f0e793b9cdca3290142299d56fa0bf7bd134d0cc1f3
MD5 faecc046f72e7afdf1803b0409fd059e
SHA1 919da5acda9df28ee9a4a5b1bdaf8afc524514bf
SHA512 f6e91f42e7d4b4c8f3a14d5a22b1c999e6c3e35f916715359fb9112bf54f14924defa84950d06e85fddc58e203e629b4bb2bd1edcdce441d6545a750b000f1c9
SSDEEP 384:z5zfs/xvzqfj67XiJd/WFmF/bMUdzrT8hysAV5IRUK2ttKddZW9Pgqkr1jC:9zElqODKFFPoyjMUK2vKj092C
TLSH
T18D923A3512E2E43E31FDBE5620210CCB5C6CED96E430835213CA38B46AB79FD6957B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 13.1MB
SHA256 fa16df2ef3d8d438205712a9ae8e93e0891bc6efcd442d312380ef76d3c734a2
MD5 31d63f0bde9613e3a36ace76c6d1eae3
SHA1 3c8c7dcba1e80af056fffcd91c3dbfadc7e322b4
SHA512 1eb7669716e21fd0bd1c29d1af99efefdade960c9e5150b6fa396ef823575419a7095124a2f4fb609820a3b477a3a4fad72c507fc71be9e54d4ff7090e7d35bf
SSDEEP 49152:EhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6m:j
TLSH
T137D6CF320243FDBD3FAD2D45E0012D455D9D7A1B62A8D299FB8930BA63EE564CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bevq0p1w.5sn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bevq0p1w.5sn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_oQQxtBha.exe

Path C:\Users\Admin\AppData\Roaming\EnterPush\agent_oQQxtBha.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-13546-0x00007FF8F2B00000-0x00007FF8F2E02000-memory.dmp

Download

memory/1548-13547-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1548-13550-0x00007FF8F2B00000-0x00007FF8F2E02000-memory.dmp

Download

memory/1548-13549-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/1848-13578-0x0000000005D40000-0x0000000006094000-memory.dmp

Download

memory/1848-13591-0x00000000705B0000-0x0000000070904000-memory.dmp

Download

memory/1848-13570-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Download

memory/1848-13569-0x0000000005510000-0x0000000005576000-memory.dmp

Download

memory/1848-13567-0x0000000005580000-0x0000000005BA8000-memory.dmp

Download

memory/1848-13566-0x0000000004DB0000-0x0000000004DE6000-memory.dmp

Download

memory/1848-13579-0x0000000006350000-0x000000000636E000-memory.dmp

Download

memory/1848-13580-0x0000000006400000-0x000000000644C000-memory.dmp

Download

memory/1848-13585-0x00000000068B0000-0x00000000068F4000-memory.dmp

Download

memory/1848-13586-0x0000000007680000-0x00000000076F6000-memory.dmp

Download

memory/1848-13588-0x0000000007700000-0x000000000771A000-memory.dmp

Download

memory/1848-13587-0x0000000007D80000-0x00000000083FA000-memory.dmp

Download

memory/1848-13589-0x00000000078C0000-0x00000000078F2000-memory.dmp

Download

memory/1848-13568-0x0000000005370000-0x0000000005392000-memory.dmp

Download

memory/1848-13599-0x0000000007900000-0x000000000791E000-memory.dmp

Download

memory/1848-13590-0x000000006FE20000-0x000000006FE6C000-memory.dmp

Download

memory/1848-13600-0x0000000007920000-0x00000000079C3000-memory.dmp

Download

memory/1848-13601-0x0000000007A20000-0x0000000007A2A000-memory.dmp

Download

memory/1848-13602-0x0000000007AF0000-0x0000000007B86000-memory.dmp

Download

memory/1848-13603-0x0000000007A50000-0x0000000007A61000-memory.dmp

Download

memory/1848-13604-0x0000000007A80000-0x0000000007A8E000-memory.dmp

Download

memory/1848-13605-0x0000000007A90000-0x0000000007AA4000-memory.dmp

Download

memory/1848-13606-0x0000000007B90000-0x0000000007BAA000-memory.dmp

Download

memory/1848-13607-0x0000000007AC0000-0x0000000007AC8000-memory.dmp

Download

memory/1848-13612-0x0000000007B90000-0x0000000007BB2000-memory.dmp

Download

memory/1848-13613-0x00000000089B0000-0x0000000008F54000-memory.dmp

Download