salatstealer | 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT2).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
MD5 802a10c9f71f69ebe61eeae7693ba0e5
SHA1 8548aca5802a54f0bceaac04a6c22767de76f86c
SHA512 a37d97055d38a04e4eef3853cdc7519f1b79cb01a63ccf66fe9558ae678da98e696443cba44847bc28ba08eb15f894b4f8b4fad470a93d0e345004a5ddcf48c5
TLSH
T1D5613957E00DDE4AB68EB83FF89EE5E52017C4C31CD6D452439B89E8C84EDBE494E485
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral17/files/0x000d00000001c57e-5519.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
25	4564	powershell.exe
26	4564	powershell.exe
27	4564	powershell.exe
28	4564	powershell.exe
29	4564	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
4492	Setup-TaasfKQdEtTesVxb.exe
5796	agent_uZmdiUnk.exe
1384	Setup-TaasfKQdEtTesVxb.exe
2764	agent_QIfWbZcD.exe
4844	Setup-TaasfKQdEtTesVxb.exe
4936	agent_cXzmeKAg.exe
796	conhost.exe
5452	Setup-TaasfKQdEtTesVxb.exe
1196	agent_cvGqjGCx.exe
4688	conhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2712	certutil.exe
1932	certutil.exe
2440	certutil.exe
5956	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\c3b1ef68-161a-0db0-a074-944496256816	agent_uZmdiUnk.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\winlogon.exe	agent_uZmdiUnk.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\c3b1ef68-161a-0db0-a074-944496256816	agent_uZmdiUnk.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\conhost.exe	agent_uZmdiUnk.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\conhost.exe	conhost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5020	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_uZmdiUnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_cXzmeKAg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_cvGqjGCx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_QIfWbZcD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conhost.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
5796	agent_uZmdiUnk.exe
5796	agent_uZmdiUnk.exe
5796	agent_uZmdiUnk.exe
5796	agent_uZmdiUnk.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
4564	powershell.exe
4564	powershell.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
4564	powershell.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe
796	conhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3692	winws.exe
Token: SeBackupPrivilege	3692	winws.exe
Token: SeDebugPrivilege	3692	winws.exe
Token: SeDebugPrivilege	796	conhost.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeIncreaseQuotaPrivilege	4564	powershell.exe
Token: SeSecurityPrivilege	4564	powershell.exe
Token: SeTakeOwnershipPrivilege	4564	powershell.exe
Token: SeLoadDriverPrivilege	4564	powershell.exe
Token: SeSystemProfilePrivilege	4564	powershell.exe
Token: SeSystemtimePrivilege	4564	powershell.exe
Token: SeProfSingleProcessPrivilege	4564	powershell.exe
Token: SeIncBasePriorityPrivilege	4564	powershell.exe
Token: SeCreatePagefilePrivilege	4564	powershell.exe
Token: SeBackupPrivilege	4564	powershell.exe
Token: SeRestorePrivilege	4564	powershell.exe
Token: SeShutdownPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeSystemEnvironmentPrivilege	4564	powershell.exe
Token: SeRemoteShutdownPrivilege	4564	powershell.exe
Token: SeUndockPrivilege	4564	powershell.exe
Token: SeManageVolumePrivilege	4564	powershell.exe
Token: 33	4564	powershell.exe
Token: 34	4564	powershell.exe
Token: 35	4564	powershell.exe
Token: 36	4564	powershell.exe
Token: SeIncreaseQuotaPrivilege	4564	powershell.exe
Token: SeSecurityPrivilege	4564	powershell.exe
Token: SeTakeOwnershipPrivilege	4564	powershell.exe
Token: SeLoadDriverPrivilege	4564	powershell.exe
Token: SeSystemProfilePrivilege	4564	powershell.exe
Token: SeSystemtimePrivilege	4564	powershell.exe
Token: SeProfSingleProcessPrivilege	4564	powershell.exe
Token: SeIncBasePriorityPrivilege	4564	powershell.exe
Token: SeCreatePagefilePrivilege	4564	powershell.exe
Token: SeBackupPrivilege	4564	powershell.exe
Token: SeRestorePrivilege	4564	powershell.exe
Token: SeShutdownPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeSystemEnvironmentPrivilege	4564	powershell.exe
Token: SeRemoteShutdownPrivilege	4564	powershell.exe
Token: SeUndockPrivilege	4564	powershell.exe
Token: SeManageVolumePrivilege	4564	powershell.exe
Token: 33	4564	powershell.exe
Token: 34	4564	powershell.exe
Token: 35	4564	powershell.exe
Token: 36	4564	powershell.exe
Token: SeIncreaseQuotaPrivilege	4564	powershell.exe
Token: SeSecurityPrivilege	4564	powershell.exe
Token: SeTakeOwnershipPrivilege	4564	powershell.exe
Token: SeLoadDriverPrivilege	4564	powershell.exe
Token: SeSystemProfilePrivilege	4564	powershell.exe
Token: SeSystemtimePrivilege	4564	powershell.exe
Token: SeProfSingleProcessPrivilege	4564	powershell.exe
Token: SeIncBasePriorityPrivilege	4564	powershell.exe
Token: SeCreatePagefilePrivilege	4564	powershell.exe
Token: SeBackupPrivilege	4564	powershell.exe
Token: SeRestorePrivilege	4564	powershell.exe
Token: SeShutdownPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeSystemEnvironmentPrivilege	4564	powershell.exe
Token: SeRemoteShutdownPrivilege	4564	powershell.exe
Token: SeUndockPrivilege	4564	powershell.exe
Token: SeManageVolumePrivilege	4564	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 5672	5020	cmd.exe	90
PID 5020 wrote to memory of 2712	5020	cmd.exe	91
PID 5020 wrote to memory of 4492	5020	cmd.exe	92
PID 4492 wrote to memory of 5796	4492	Setup-TaasfKQdEtTesVxb.exe	93
PID 5020 wrote to memory of 1932	5020	cmd.exe	94
PID 5020 wrote to memory of 1384	5020	cmd.exe	95
PID 1384 wrote to memory of 2764	1384	Setup-TaasfKQdEtTesVxb.exe	97
PID 5020 wrote to memory of 2440	5020	cmd.exe	98
PID 5020 wrote to memory of 4844	5020	cmd.exe	99
PID 4844 wrote to memory of 4936	4844	Setup-TaasfKQdEtTesVxb.exe	100
PID 5796 wrote to memory of 796	5796	agent_uZmdiUnk.exe	102
PID 5020 wrote to memory of 5956	5020	cmd.exe	103
PID 5020 wrote to memory of 5452	5020	cmd.exe	104
PID 5020 wrote to memory of 3692	5020	cmd.exe	105
PID 5452 wrote to memory of 1196	5452	Setup-TaasfKQdEtTesVxb.exe	107
PID 796 wrote to memory of 4564	796	conhost.exe	108
PID 796 wrote to memory of 4688	796	conhost.exe	110
PID 4564 wrote to memory of 2668	4564	powershell.exe	113

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT2).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5672
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Users\Admin\AppData\Roaming\SendExport\agent_uZmdiUnk.exe
    C:\Users\Admin\AppData\Roaming\SendExport\agent_uZmdiUnk.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Program Files (x86)\Windows Media Player\conhost.exe
      "C:\Program Files (x86)\Windows Media Player\conhost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:796
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4564
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\conhost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\conhost.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4688
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1932
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Users\Admin\AppData\Roaming\CheckpointGrant\agent_QIfWbZcD.exe
    C:\Users\Admin\AppData\Roaming\CheckpointGrant\agent_QIfWbZcD.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2764
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2440
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Users\Admin\AppData\Roaming\InstallRequest\agent_cXzmeKAg.exe
    C:\Users\Admin\AppData\Roaming\InstallRequest\agent_cXzmeKAg.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4936
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5956
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Users\Admin\AppData\Roaming\GrantOpen\agent_cvGqjGCx.exe
    C:\Users\Admin\AppData\Roaming\GrantOpen\agent_cvGqjGCx.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1196
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 157d7d3b65b5a11f12f40e04c509a9cf8a6eab029c44ab8c9198421b0ac514ed
MD5 2b6a18c6a7b121743e6e95b987244145
SHA1 c3b7edf923cd7851d04bbd40c987e5ff9748e66a
SHA512 2684f4b70578c4e1b780d497ff5ea209d2a22674b9d505e0437f7d8fde3b697cef378ae85169d5c7c924819fcef0ada5743d176a4dfb9fc9aa2960739c6c840d
SSDEEP 384:KIfwAPQds3iHjK6abBBWZpHeS3/FSc8RKpZQOxwEEksVTLkuq3:Kmi4iHjK68Bs+kkc8RsOUh
TLSH
T1F2927C3BE541BDEA0FD1B0C2848205C62C1CF01726F875E9374E64BE825BEBD6ABE554
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 9.5MB
SHA256 a462a5fcaa7de89f567f24d2f248964491b47d71dd11cf938f1cd24f432a0056
MD5 124c8fb57561682fa1ee958dd5e49850
SHA1 318e198a98704d4035a9080c957a73f6ab561c91
SHA512 d69f1bf9b973b78adc9d54b573bad9f72096d9851727d0a2830bb83fb4cb357e6380a705a5b37e187afbaf0ea6ddb68a0624d47a67dd433b9527c7960b1aecc3
SSDEEP 49152:7Rf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxhdm727DJi5y3SkE:E
TLSH
T1CEA6F1331607FDDA2FA95D45D00539811C5C796B53A4E2E8FF4E71AB21EA620EE3D8B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 7aebc7fa52bfaad5156aef8c40efd1f7520c2cc19a1445ab7508601a439a30a7
MD5 4e06f1c54e92066fc94fe34d11f0f789
SHA1 10dc88653fc1eb99fde25b8334ab4443f4c310a0
SHA512 addd8a920b58d6777a53ffda68008ce686cf616df05f225cb1206c1476583cccf46b601db7d0806d83dc4e605cf31f9f9a1954ffe68605caec93e99305428dab
SSDEEP 768:fvpSMp9vXjUAOKUvgCU00K/2LUq8/wh7CelMK+Rbn7:n3rvxU6QbvD7
TLSH
T1DFB24ABB965137BBE9129F01154A7F87D205B74739B342C3DF098E4B80B1C6B24B9A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 10.2MB
SHA256 34f2403cef88c61add7c6c0760f52de58ff9e3f5c07da9a7b96c7f86a52b589b
MD5 f6c65bf754f8d9234839ef96de8303a2
SHA1 1e2debf65b1fa0fcedd6dba16c6192db2fddfec5
SHA512 5df811950c009ab15032ba60df15cbb276417b98c6d770f1f41fcb10099b3c3892f3d69510acb69c3f894a80e6ff3084c880e547ac51870db90d9ce5ddec20db
SSDEEP 49152:DA4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxhdm7276:Z
TLSH
T172B6F1331603FDDA2FA65D45D00839812C5CB95B52A4D2E8FF4E74EB60EA624EE3D874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 13.0MB
SHA256 e468c83cb7d15f0810dfb2c4e06948653edfe34e4d590eededb0876758fb0e64
MD5 5a45f829008d50258fcd4b4f23f97e36
SHA1 43eff00d946b33e06f82cce36dd5fcfce0d410ed
SHA512 df066967bc1aea260a74b0533f73d5fe6e960dab26ca3f0deee9662410067813c72880b349e4a555895506fd717ebc4c20ffc64d0d6333047fd0fae01fedf335
SSDEEP 49152:tmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6Cp:o
TLSH
T120D6CF320243FDBD3FAD2D45E0052D451D9D7A1B62A8D299FB8930BA63EE564CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 64KB
SHA256 072759b6958d532b86879b8271eb2b524bf26de37d119051012e16111852b120
MD5 e5a4c94f6a09ef5266008905cc174b37
SHA1 47a3f5b781f303d782239d17fbf2476fdbadfccd
SHA512 4a897a379fa89541c5c28a337953537f5a515ec9e89c605e29b1af270eadf8e75687eb262f2805856586e9f47b383137a65c2e05ecb1d6a29bb60e534d670fe0
SSDEEP 1536:r1cS6VDbb6Z86xh0kbOlJ/abaeYuyp4PIl:xPaDK6MqyubNDl
TLSH
T1DD533B38022751FA363CBA4C25390D9DAD9D958D1C3E466377CF28BA638D87C860F9B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 d8eccfe1ae6ec6e4a7f865688fe1760856033db69e133417e03679e60859c79e
MD5 47715b1ddc196dbb2f50b7a3bb7d9366
SHA1 e4bede47168a0bd15dbfb2cd4c144c2eb2518819
SHA512 f87aa4dab947035b1b77b568e1e2206babe7ca2e71826dda6250d11afff37d701f81f50227719aa866d43483452524d997707ec963dd92aa3174b4d29462584b
SSDEEP 768:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZGl9+e:lV9utQVN65vt6j6Uam
TLSH
T11DB24C304FE328BD399C7C5175205DEC6D6C2F8B1465030A97C978FAA2985BC8E29C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_uZmdiUnk.exe

Path C:\Users\Admin\AppData\Roaming\SendExport\agent_uZmdiUnk.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3692-12234-0x00007FFB73B10000-0x00007FFB73E12000-memory.dmp

Download

memory/3692-12235-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3692-12236-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/3692-12238-0x00007FFB73B10000-0x00007FFB73E12000-memory.dmp

Download

memory/4564-12245-0x00000000050F0000-0x0000000005112000-memory.dmp

Download

memory/4564-12259-0x00000000072F0000-0x0000000007326000-memory.dmp

Download

memory/4564-12243-0x0000000002650000-0x0000000002686000-memory.dmp

Download

memory/4564-12246-0x0000000005890000-0x00000000058F6000-memory.dmp

Download

memory/4564-12247-0x0000000005970000-0x00000000059D6000-memory.dmp

Download

memory/4564-12250-0x00000000059E0000-0x0000000005D3B000-memory.dmp

Download

memory/4564-12253-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

Download

memory/4564-12254-0x0000000006400000-0x000000000644C000-memory.dmp

Download

memory/4564-12258-0x00000000070C0000-0x0000000007108000-memory.dmp

Download

memory/4564-12244-0x0000000005240000-0x000000000588A000-memory.dmp

Download

memory/4564-12260-0x0000000070620000-0x000000007066C000-memory.dmp

Download

memory/4564-12261-0x00000000708D0000-0x0000000070C2B000-memory.dmp

Download

memory/4564-12264-0x0000000007330000-0x0000000007350000-memory.dmp

Download

memory/4564-12265-0x0000000007350000-0x00000000073F3000-memory.dmp

Download

memory/4564-12267-0x00000000074A0000-0x00000000074BA000-memory.dmp

Download

memory/4564-12266-0x0000000007AE0000-0x000000000815C000-memory.dmp

Download

memory/4564-12268-0x0000000007500000-0x000000000750A000-memory.dmp

Download

memory/4564-12269-0x00000000075B0000-0x0000000007646000-memory.dmp

Download

memory/4564-12270-0x00000000079A0000-0x00000000079C2000-memory.dmp

Download

memory/4564-12271-0x0000000008720000-0x0000000008CDA000-memory.dmp

Download