salatstealer | 99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT3).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05
MD5 aa4abe5d986341f92ed5529c58002d5c
SHA1 1d369c8ccbadfdf69d47f27aef30159b7f022243
SHA512 6a67fd0193098890cdba4c0c6a51114eb7f10158d57f078c516a7a303bbff516ef73c7c478c9103d29c7d39b7168f7c26e4980c6389c4639d21583ec5fa86681
TLSH
T1AA719E93E00DDE07F4CD6C3EF84FA6B5201788872CD6C851539B49E8C84EDBA6D4B085
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral19/files/0x000d00000001c5e4-6116.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
35	5232	powershell.exe
36	5232	powershell.exe
37	5232	powershell.exe
38	5232	powershell.exe
39	5232	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
4220	Setup-TaasfKQdEtTesVxb.exe
5792	agent_PJYCrEQf.exe
2900	Setup-TaasfKQdEtTesVxb.exe
3880	agent_kCUoTwxB.exe
5628	Setup-TaasfKQdEtTesVxb.exe
4128	Setup-TaasfKQdEtTesVxb.exe
5608	agent_tpnzWIEi.exe
840	RuntimeBroker.exe
260	agent_JqTvVRMK.exe
204	StartMenuExperienceHost.exe
4484	StartMenuExperienceHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5100	certutil.exe
1736	certutil.exe
4184	certutil.exe
2404	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\ShellHost.exe	agent_JqTvVRMK.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\StartMenuExperienceHost.exe	StartMenuExperienceHost.exe
File opened for modification	C:\Program Files (x86)\Common Files\dfba01be-c759-caa2-5103-d435723dbec7	agent_JqTvVRMK.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_kCUoTwxB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_JqTvVRMK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_tpnzWIEi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_PJYCrEQf.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
5792	agent_PJYCrEQf.exe
5792	agent_PJYCrEQf.exe
5792	agent_PJYCrEQf.exe
5792	agent_PJYCrEQf.exe
260	agent_JqTvVRMK.exe
260	agent_JqTvVRMK.exe
260	agent_JqTvVRMK.exe
260	agent_JqTvVRMK.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
5232	powershell.exe
5232	powershell.exe
5232	powershell.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe
204	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	476	winws.exe
Token: SeBackupPrivilege	476	winws.exe
Token: SeDebugPrivilege	476	winws.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	204	StartMenuExperienceHost.exe
Token: SeIncreaseQuotaPrivilege	5232	powershell.exe
Token: SeSecurityPrivilege	5232	powershell.exe
Token: SeTakeOwnershipPrivilege	5232	powershell.exe
Token: SeLoadDriverPrivilege	5232	powershell.exe
Token: SeSystemProfilePrivilege	5232	powershell.exe
Token: SeSystemtimePrivilege	5232	powershell.exe
Token: SeProfSingleProcessPrivilege	5232	powershell.exe
Token: SeIncBasePriorityPrivilege	5232	powershell.exe
Token: SeCreatePagefilePrivilege	5232	powershell.exe
Token: SeBackupPrivilege	5232	powershell.exe
Token: SeRestorePrivilege	5232	powershell.exe
Token: SeShutdownPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeSystemEnvironmentPrivilege	5232	powershell.exe
Token: SeRemoteShutdownPrivilege	5232	powershell.exe
Token: SeUndockPrivilege	5232	powershell.exe
Token: SeManageVolumePrivilege	5232	powershell.exe
Token: 33	5232	powershell.exe
Token: 34	5232	powershell.exe
Token: 35	5232	powershell.exe
Token: 36	5232	powershell.exe
Token: SeIncreaseQuotaPrivilege	5232	powershell.exe
Token: SeSecurityPrivilege	5232	powershell.exe
Token: SeTakeOwnershipPrivilege	5232	powershell.exe
Token: SeLoadDriverPrivilege	5232	powershell.exe
Token: SeSystemProfilePrivilege	5232	powershell.exe
Token: SeSystemtimePrivilege	5232	powershell.exe
Token: SeProfSingleProcessPrivilege	5232	powershell.exe
Token: SeIncBasePriorityPrivilege	5232	powershell.exe
Token: SeCreatePagefilePrivilege	5232	powershell.exe
Token: SeBackupPrivilege	5232	powershell.exe
Token: SeRestorePrivilege	5232	powershell.exe
Token: SeShutdownPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeSystemEnvironmentPrivilege	5232	powershell.exe
Token: SeRemoteShutdownPrivilege	5232	powershell.exe
Token: SeUndockPrivilege	5232	powershell.exe
Token: SeManageVolumePrivilege	5232	powershell.exe
Token: 33	5232	powershell.exe
Token: 34	5232	powershell.exe
Token: 35	5232	powershell.exe
Token: 36	5232	powershell.exe
Token: SeIncreaseQuotaPrivilege	5232	powershell.exe
Token: SeSecurityPrivilege	5232	powershell.exe
Token: SeTakeOwnershipPrivilege	5232	powershell.exe
Token: SeLoadDriverPrivilege	5232	powershell.exe
Token: SeSystemProfilePrivilege	5232	powershell.exe
Token: SeSystemtimePrivilege	5232	powershell.exe
Token: SeProfSingleProcessPrivilege	5232	powershell.exe
Token: SeIncBasePriorityPrivilege	5232	powershell.exe
Token: SeCreatePagefilePrivilege	5232	powershell.exe
Token: SeBackupPrivilege	5232	powershell.exe
Token: SeRestorePrivilege	5232	powershell.exe
Token: SeShutdownPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeSystemEnvironmentPrivilege	5232	powershell.exe
Token: SeRemoteShutdownPrivilege	5232	powershell.exe
Token: SeUndockPrivilege	5232	powershell.exe
Token: SeManageVolumePrivilege	5232	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1100	4616	cmd.exe	90
PID 4616 wrote to memory of 5100	4616	cmd.exe	91
PID 4616 wrote to memory of 4220	4616	cmd.exe	92
PID 4220 wrote to memory of 5792	4220	Setup-TaasfKQdEtTesVxb.exe	93
PID 4616 wrote to memory of 1736	4616	cmd.exe	94
PID 4616 wrote to memory of 2900	4616	cmd.exe	95
PID 2900 wrote to memory of 3880	2900	Setup-TaasfKQdEtTesVxb.exe	97
PID 4616 wrote to memory of 4184	4616	cmd.exe	98
PID 4616 wrote to memory of 5628	4616	cmd.exe	99
PID 4616 wrote to memory of 2404	4616	cmd.exe	101
PID 4616 wrote to memory of 4128	4616	cmd.exe	102
PID 4616 wrote to memory of 476	4616	cmd.exe	103
PID 5628 wrote to memory of 5608	5628	Setup-TaasfKQdEtTesVxb.exe	105
PID 5792 wrote to memory of 840	5792	agent_PJYCrEQf.exe	106
PID 4128 wrote to memory of 260	4128	Setup-TaasfKQdEtTesVxb.exe	107
PID 260 wrote to memory of 204	260	agent_JqTvVRMK.exe	108
PID 204 wrote to memory of 5232	204	StartMenuExperienceHost.exe	109
PID 204 wrote to memory of 4484	204	StartMenuExperienceHost.exe	111
PID 5232 wrote to memory of 1572	5232	powershell.exe	114

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT3).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1100
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5100
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Users\Admin\AppData\Roaming\ReadRequest\agent_PJYCrEQf.exe
    C:\Users\Admin\AppData\Roaming\ReadRequest\agent_PJYCrEQf.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Users\Admin\AppData\Local\Google\RuntimeBroker.exe
      C:\Users\Admin\AppData\Local\Google\RuntimeBroker.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:840
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Roaming\GroupInitialize\agent_kCUoTwxB.exe
    C:\Users\Admin\AppData\Roaming\GroupInitialize\agent_kCUoTwxB.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3880
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Users\Admin\AppData\Roaming\DisableLimit\agent_tpnzWIEi.exe
    C:\Users\Admin\AppData\Roaming\DisableLimit\agent_tpnzWIEi.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5608
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Users\Admin\AppData\Roaming\InstallRemove\agent_JqTvVRMK.exe
    C:\Users\Admin\AppData\Roaming\InstallRemove\agent_JqTvVRMK.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:260
  - - C:\Users\Admin\AppData\Local\Temp\StartMenuExperienceHost.exe
      C:\Users\Admin\AppData\Local\Temp\StartMenuExperienceHost.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5232
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\StartMenuExperienceHost.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\StartMenuExperienceHost.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4484
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-hostfakesplit-mod=host=www.google.com,altorder=1 --dpi-desync-fooling=ts --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-hostfakesplit-mod=host=www.google.com,altorder=1 --dpi-desync-fooling=ts --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,hostfakesplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fake-tls-mod=rnd,dupsid,sni=ya.ru --dpi-desync-hostfakesplit-mod=host=ya.ru,altorder=1 --dpi-desync-fooling=ts --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n4
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 eff9b895fa7e6bdb79c2db5de33c91476a908c581da782c8177923616fa63418
MD5 4f927168e13a5d0e6f9be40771671dca
SHA1 02d6a7d133f2f4ff901f26d29859b6b24290a7a4
SHA512 e49769d76dd5b404c4b0fa65ae21c7db5d8a505720a80ebb354d9c65530cc0a8361d77ec74223d2ba6cbc4ab6b7bf6c7a537052824a2c8d6ac49cf7e1adefec0
SSDEEP 384:CEDEZ/Hopsl9YvyzmOQKfcvWbtvvrE/TtNyZHYZKHXqWa9V4qg7f:CeZGl9+LvM5vrcNyZcKHXqWaBwf
TLSH
T10D92D7604EF718BC7AEC7D6725704DEC9D6C1B4814B5230F43C4B9F9A41EABC8A29879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 1dfef5200970c10d1f54005c70a4f45b0926b0f5dfe4a669e602e0e413f98afd
MD5 c82a63540d6ad28d624539e6a0903e14
SHA1 668ae3788c90f07b7dc84b47bb755644ef973619
SHA512 1fe95cfc960ff51791bcd0f89aa7b611b3cfaaea527953156220beec8a1efed969686775a957fe3f6213e18ff20d25135513f8cc43ea6a6abfe52a1da3061471
SSDEEP 49152:c2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:Q
TLSH
T13DF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 13.2MB
SHA256 b1915875a45d3d9f6a374cefc56b34b6583b1ff43ad6e9bb17a2dbdc34bf2cc4
MD5 c3870f95b84fda43cc41e2a8ae961fcd
SHA1 f441ce6464fb807fa16cef6f6edc78dd22554e60
SHA512 971c663cd2b81239ed73a45e64039be88fba4738dbec71d3ef1d25102db88c9cdce57263081f7a5683da5300115a7661a5d0aa2fb7d8426942de56501f2c4fc3
SSDEEP 49152:+hmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6m:l
TLSH
T170D6CF320243FDBD3FAD2D45E0012D455D9D7A1B62A8D299FB8930BA63EE564CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 356c964a769a770853bc525bf0f2baef4f528d2f9cd301a515ed4e5e36a6e72e
MD5 52b390db77f8c385f1214380f8b82474
SHA1 e07d759b394c44ec2a3a23529545d74dabd1e0d2
SHA512 8e345b93dbf0f96b640bd1aef6299ca95ba10407f2db69553ba93056db20f7913fba93daa98f664890bf82ed773687226a72ab075c58adeccee260907f009244
SSDEEP 384:nnrw4G4lYu59aulpOtQUe9B85OX+M3NCBni:nrkuLatQUeeY9j
TLSH
T18692E6790BEB74B938BC3D5760110D4D9D4D2B0E15AA434AA3C530BA67EE5E4CF18E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 28KB
SHA256 aea1b230016efa7fda61f27031d8ef084e1274701f0b7db64c57a473c1d4706d
MD5 a5d180875c15f5f31ffc3797df34f066
SHA1 c6366495c196e7cb953fd8be1055cb219f44e7e8
SHA512 0000d9eba71baa793cc151b02f67c86f437ad0cccfb101084e475d57f0daecc842f5e86ea27a41043da088008653231ff3be806b960340fee0763456999394d7
SSDEEP 768:8dvB3LvC+UG97t+x8R78DioRtifdYwnsigQg4B:ORLMG6+DTgQg4B
TLSH
T1F6D2F83A036B313C216829C634025F5D6EAD571E26B9564677CA38FD7369CF8CE68A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 11.3MB
SHA256 faf7c1fbbb0e7309bd3f2dd532f737b9eb7f2699b7ee1b13add3e8884ebfe698
MD5 24bca7f168c621f1263fd72dda0ec4d3
SHA1 914149a3d53665b49d870ed40102158491db53c2
SHA512 0ac28c06bf4806486813c23e65ed707d9874cc0aa31945d0d567e5585168b88fe06144aa90314603517f420649437ee6bb0f27a343d7a8b4d392b3aac6ad31ea
SSDEEP 49152:8T7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxhdm7D:0
TLSH
T1FEC6D0735203FEDE2FAA5D88D0083A411C9DB95B62A4D298FF4D75FA21EA520DD3C874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 430a6e344da69c81025b7da7f38f36e48780837f685978fa0d1d01e624beb8dd
MD5 83737ea3da30a4140057311e7a5927f7
SHA1 4c92c12952bf31b115895894799727970a67392a
SHA512 8e3af443385243e773551b60defcddf23a3dee835d4c0b7d88fe85f02400a695bb2c66bd34dd0ac4c02a7bd812ca2856f772ef55aea5bdd7d6459d940d222ef2
SSDEEP 384:lVH9x1M0YqutQse9FKkNKn5BYdAQFNl88uayR2ZxBp6UaMEDEZ/Hopsli:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZP
TLSH
T107926E704AE33CBD3D8C7C5061505DAC5D6C2F8B51650209ABC834FA63E85BC8E6AD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_PJYCrEQf.exe

Path C:\Users\Admin\AppData\Roaming\ReadRequest\agent_PJYCrEQf.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/476-13949-0x00007FFC2AE90000-0x00007FFC2B192000-memory.dmp

Download

memory/476-13955-0x00007FFC2AE90000-0x00007FFC2B192000-memory.dmp

Download

memory/476-13953-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/476-13952-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5232-13984-0x00000000058C0000-0x00000000058E2000-memory.dmp

Download

memory/5232-13993-0x0000000007380000-0x00000000073B6000-memory.dmp

Download

memory/5232-13979-0x0000000002700000-0x0000000002736000-memory.dmp

Download

memory/5232-13986-0x00000000059D0000-0x0000000005A36000-memory.dmp

Download

memory/5232-13985-0x0000000005960000-0x00000000059C6000-memory.dmp

Download

memory/5232-13989-0x0000000005C00000-0x0000000005F5B000-memory.dmp

Download

memory/5232-13990-0x0000000005F60000-0x0000000005F7E000-memory.dmp

Download

memory/5232-13991-0x0000000006120000-0x000000000616C000-memory.dmp

Download

memory/5232-13992-0x0000000006520000-0x0000000006568000-memory.dmp

Download

memory/5232-13980-0x00000000051E0000-0x000000000582A000-memory.dmp

Download

memory/5232-13994-0x0000000070E90000-0x0000000070EDC000-memory.dmp

Download

memory/5232-13999-0x00000000073E0000-0x0000000007483000-memory.dmp

Download

memory/5232-13998-0x00000000073C0000-0x00000000073E0000-memory.dmp

Download

memory/5232-13995-0x0000000071090000-0x00000000713EB000-memory.dmp

Download

memory/5232-14001-0x0000000007530000-0x000000000754A000-memory.dmp

Download

memory/5232-14000-0x0000000007B70000-0x00000000081EC000-memory.dmp

Download

memory/5232-14002-0x0000000007590000-0x000000000759A000-memory.dmp

Download

memory/5232-14003-0x0000000007640000-0x00000000076D6000-memory.dmp

Download

memory/5232-14004-0x0000000007A40000-0x0000000007A62000-memory.dmp

Download

memory/5232-14005-0x00000000087B0000-0x0000000008D6A000-memory.dmp

Download