salatstealer | feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT4).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d
MD5 1a9353401fc545311572880d32a88f78
SHA1 9e005a4a276e9b93f0499bdea7aeae070048d31e
SHA512 86b79c6aa9cda652549cfce001c82eda023e32ddecfdd33d11decbb5afbe9b24fc5eafa5673fa1019a4caddd9ff32855cc6b78753769283f2ad96ebf0d8d44c5
TLSH
T1EE715A93E00CDE42F6CDA53EF86FA6A421279CC318D6D452439B89F8DC0ECBD584E594
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral20/files/0x0008000000024467-7316.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
68	2884	powershell.exe
69	2884	powershell.exe
70	2884	powershell.exe
71	2884	powershell.exe
72	2884	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
1476	Setup-TaasfKQdEtTesVxb.exe
2764	Setup-TaasfKQdEtTesVxb.exe
3852	agent_ILlXbHap.exe
4348	agent_swtWYXyj.exe
3276	Setup-TaasfKQdEtTesVxb.exe
2952	Setup-TaasfKQdEtTesVxb.exe
2604	agent_TvIGhBrx.exe
4764	Setup-TaasfKQdEtTesVxb.exe
4836	agent_gWjnSygj.exe
1080	winlogon.exe
4576	winlogon.exe
464	winlogon.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1584	certutil.exe
5100	certutil.exe
4788	certutil.exe
2636	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\60e35b11-8844-b0d2-1908-42dd4ddb1188	agent_ILlXbHap.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\Setup-TaasfKQdEtTesVxb.exe	agent_ILlXbHap.exe
File opened for modification	C:\Program Files (x86)\Common Files\60e35b11-8844-b0d2-1908-42dd4ddb1188	agent_gWjnSygj.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\60e35b11-8844-b0d2-1908-42dd4ddb1188	agent_gWjnSygj.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\winlogon.exe	agent_gWjnSygj.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe	agent_ILlXbHap.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\60e35b11-8844-b0d2-1908-42dd4ddb1188	agent_ILlXbHap.exe
File opened for modification	C:\Program Files (x86)\Common Files\explorer.exe	agent_gWjnSygj.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe	winlogon.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\winlogon.exe	winlogon.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_ILlXbHap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_swtWYXyj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup-TaasfKQdEtTesVxb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_TvIGhBrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_gWjnSygj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3852	agent_ILlXbHap.exe
3852	agent_ILlXbHap.exe
3852	agent_ILlXbHap.exe
3852	agent_ILlXbHap.exe
4836	agent_gWjnSygj.exe
4836	agent_gWjnSygj.exe
4836	agent_gWjnSygj.exe
4836	agent_gWjnSygj.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
2884	powershell.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
2884	powershell.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe
1080	winlogon.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	448	winws.exe
Token: SeBackupPrivilege	448	winws.exe
Token: SeDebugPrivilege	448	winws.exe
Token: SeDebugPrivilege	2884	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3376	2660	cmd.exe	85
PID 2660 wrote to memory of 5100	2660	cmd.exe	86
PID 2660 wrote to memory of 1476	2660	cmd.exe	87
PID 2660 wrote to memory of 4788	2660	cmd.exe	88
PID 2660 wrote to memory of 2764	2660	cmd.exe	89
PID 1476 wrote to memory of 3852	1476	Setup-TaasfKQdEtTesVxb.exe	90
PID 2764 wrote to memory of 4348	2764	Setup-TaasfKQdEtTesVxb.exe	91
PID 2660 wrote to memory of 2636	2660	cmd.exe	96
PID 2660 wrote to memory of 3276	2660	cmd.exe	97
PID 2660 wrote to memory of 1584	2660	cmd.exe	103
PID 2660 wrote to memory of 2952	2660	cmd.exe	104
PID 2660 wrote to memory of 448	2660	cmd.exe	105
PID 3276 wrote to memory of 2604	3276	Setup-TaasfKQdEtTesVxb.exe	107
PID 3852 wrote to memory of 4764	3852	agent_ILlXbHap.exe	108
PID 2952 wrote to memory of 4836	2952	Setup-TaasfKQdEtTesVxb.exe	109
PID 4836 wrote to memory of 1080	4836	agent_gWjnSygj.exe	110
PID 1080 wrote to memory of 2884	1080	winlogon.exe	111
PID 1080 wrote to memory of 4576	1080	winlogon.exe	113
PID 1080 wrote to memory of 464	1080	winlogon.exe	115
PID 2884 wrote to memory of 2168	2884	powershell.exe	118

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT4).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3376
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5100
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Users\Admin\AppData\Roaming\EnterSkip\agent_ILlXbHap.exe
    C:\Users\Admin\AppData\Roaming\EnterSkip\agent_ILlXbHap.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Program Files (x86)\Windows Defender\Setup-TaasfKQdEtTesVxb.exe
      "C:\Program Files (x86)\Windows Defender\Setup-TaasfKQdEtTesVxb.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4764
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4788
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Roaming\BackupStep\agent_swtWYXyj.exe
    C:\Users\Admin\AppData\Roaming\BackupStep\agent_swtWYXyj.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4348
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Users\Admin\AppData\Roaming\Microsoft\agent_TvIGhBrx.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\agent_TvIGhBrx.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2604
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1584
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Users\Admin\AppData\Roaming\BackupStep\agent_gWjnSygj.exe
    C:\Users\Admin\AppData\Roaming\BackupStep\agent_gWjnSygj.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Program Files (x86)\Windows Media Player\winlogon.exe
      "C:\Program Files (x86)\Windows Media Player\winlogon.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1080
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2884
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4576
    - - C:\Program Files\Google\Chrome\Application\winlogon.exe
        
        "C:\Program Files\Google\Chrome\Application\winlogon.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:464
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=1000 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 430a6e344da69c81025b7da7f38f36e48780837f685978fa0d1d01e624beb8dd
MD5 83737ea3da30a4140057311e7a5927f7
SHA1 4c92c12952bf31b115895894799727970a67392a
SHA512 8e3af443385243e773551b60defcddf23a3dee835d4c0b7d88fe85f02400a695bb2c66bd34dd0ac4c02a7bd812ca2856f772ef55aea5bdd7d6459d940d222ef2
SSDEEP 384:lVH9x1M0YqutQse9FKkNKn5BYdAQFNl88uayR2ZxBp6UaMEDEZ/Hopsli:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZP
TLSH
T107926E704AE33CBD3D8C7C5061505DAC5D6C2F8B51650209ABC834FA63E85BC8E6AD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 2.2MB
SHA256 c30e17ed1aece47e396dfd3c89698f470ba0fc59e027bae7cad9156c9479f6f2
MD5 b61c74a33f1657f027b85a8b620b3ea3
SHA1 580e6f28ec15d68263084d6a86d956d4f64fe273
SHA512 abbdd81a4f2a97cee786add26ebe6af6e2e926c08380f600a7bfe15d3cff082a81ce82e652c93381ef3ecad041d929da3a764e212dc44fb8059591c0142fd055
SSDEEP 24576:7g0YLtIim/hEaK4uJEieJpmWMQSfun4r3:7gPLhmOcuOJplhxno
TLSH
T1B4B5293506A774BC38BC7D4675120D4D6E9D2A0E157A430777C530BEA3AD8E8CE29E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 13.6MB
SHA256 7889b694f4e89815ba803cdf21d0fc66840efd4b754649ec6d8eb391c777fe38
MD5 75217b8bc77e95c0d05264d39770b013
SHA1 b755721adef40eb003f168c97f0579912f3b5536
SHA512 0406ef708b1304345fcbff53007a42d059df7dce4ecf1080535cff79edc47c74c7010a1626824c1d2207a370829be0911201a5aaacacad5309828d35e8a8c472
SSDEEP 49152:7gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHnead:b
TLSH
T16CE6BE320243FDBD3FAD3D45E0012D455D9D7A1B62A8D299FB8930BA63E95A4CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 11.5MB
SHA256 fc9dc529f054fd2e21a1e7a8fc7b4fa4f99809d0bba54748b1e4c4ce7644eaaf
MD5 b9c901ac237ef816d4670da5ef7ee9c9
SHA1 cb644133a6faad5c34fcde582cd6d77c32897ada
SHA512 3daafe0bec89bb74095f267a5f7e1b3c6d6fa6f0db9374c2f428fc974c0a608d8412aac9228ca37b08c6f9208b0c9f7eb4164122d4d7f24aa7fde5d01682ab6f
SSDEEP 49152:BT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxhdm7D:z
TLSH
T16AC6D0734243FEDE2FAA1D88D0043A415C9D7A5B62A4D298FF4D35FA22EA524DD3C874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 148KB
SHA256 5a10bdff635037e84e6b942bb9e8e55784c23ffa253b2b4fbb0917d67e676411
MD5 340e8f35cde7226ac744cf7505864698
SHA1 197f3882165a69b229aaea80904227f6497ace99
SHA512 c0dac4e91350ef02911b9fef4e39a3251bafb6ab8e5eb2029da0b6523bfdfd8136d40b0a04f26fd9d4fafe4154bae6c79afade266955a1b381a30d5bc1f8fdbc
SSDEEP 3072:2CynMTxS56j6m299B9gQghYz/YhQ69A1zz6a6CcKQyr1SGoftEr0XkqewGic:2ziuzS/U+u
TLSH
T137E3F83683AB647C346C799779620D9E9F4E372D213A630667C1307A675CCEC8E2DE12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 5c12f5eb490bc83ad07a0397a0a80b3dfdb3a70bc4f8bf9b981bffba1dc4b72f
MD5 52c9400f4fc82a9b14a9bbce9293f94f
SHA1 0dd54efe0feb40beff8f71096d6f24520152f5e7
SHA512 1548b54083022da4fc4139e717f580b29a09b740d7daada645807b990d05cb49f33ca4d53a02c6272ca8e4de94e481d0e893d37b5befc6dd307dc64471c37be0
SSDEEP 384:RpQUlGYI5cewKGFwIBqP5+FL13IBYP3ME3r70IHAikC6DGB:3QUlU5cFB3h1oGME3UdikCCQ
TLSH
T13D920A359593B0BC387C3D0765130D4D1E1E270A666AAB0B63C435BE676D8F88E19E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 13.1MB
SHA256 5214886297fa82a76eb7869abf4f8eca955704ae9fe53b633e0865218957b95d
MD5 8bafb8506ac74e2a8427a21499e8f3cd
SHA1 40f6a1ad94278d65eecd8dc523612a6d4c963b90
SHA512 698f31b3b580afe08718135b6563b4fa90c087437dc05191f3fed2e24e345c49dfaba2ce1515ba47822bc78fbc340b61ca10dac5ac6eb67a5d88f6895d0f2506
SSDEEP 49152:ehmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6m:F
TLSH
T17FD6CF320243FDBD3FAD2D45E0012D455D9D7A1B62A8D299FB8930BA63EE564CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_a0ymq0xl.0j1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a0ymq0xl.0j1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_ILlXbHap.exe

Path C:\Users\Admin\AppData\Roaming\EnterSkip\agent_ILlXbHap.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/448-13617-0x00007FFB284A0000-0x00007FFB287A2000-memory.dmp

Download

memory/448-13621-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/448-13623-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/448-13624-0x00007FFB284A0000-0x00007FFB287A2000-memory.dmp

Download

memory/2884-13657-0x00000000060B0000-0x0000000006404000-memory.dmp

Download

memory/2884-13671-0x0000000070580000-0x00000000705CC000-memory.dmp

Download

memory/2884-13650-0x0000000005780000-0x00000000057E6000-memory.dmp

Download

memory/2884-13651-0x0000000005F00000-0x0000000005F66000-memory.dmp

Download

memory/2884-13648-0x0000000005820000-0x0000000005E48000-memory.dmp

Download

memory/2884-13647-0x0000000002D90000-0x0000000002DC6000-memory.dmp

Download

memory/2884-13664-0x00000000066E0000-0x00000000066FE000-memory.dmp

Download

memory/2884-13665-0x0000000006780000-0x00000000067CC000-memory.dmp

Download

memory/2884-13666-0x0000000006C40000-0x0000000006C84000-memory.dmp

Download

memory/2884-13667-0x00000000077E0000-0x0000000007856000-memory.dmp

Download

memory/2884-13668-0x00000000080E0000-0x000000000875A000-memory.dmp

Download

memory/2884-13669-0x0000000007A80000-0x0000000007A9A000-memory.dmp

Download

memory/2884-13670-0x0000000007C50000-0x0000000007C82000-memory.dmp

Download

memory/2884-13649-0x00000000055E0000-0x0000000005602000-memory.dmp

Download

memory/2884-13672-0x0000000070DD0000-0x0000000071124000-memory.dmp

Download

memory/2884-13680-0x0000000007C90000-0x0000000007CAE000-memory.dmp

Download

memory/2884-13681-0x0000000007CB0000-0x0000000007D53000-memory.dmp

Download

memory/2884-13682-0x0000000007DB0000-0x0000000007DBA000-memory.dmp

Download

memory/2884-13683-0x0000000007E80000-0x0000000007F16000-memory.dmp

Download

memory/2884-13684-0x0000000007DE0000-0x0000000007DF1000-memory.dmp

Download

memory/2884-13685-0x0000000007E10000-0x0000000007E1E000-memory.dmp

Download

memory/2884-13686-0x0000000007E20000-0x0000000007E34000-memory.dmp

Download

memory/2884-13687-0x0000000007F20000-0x0000000007F3A000-memory.dmp

Download

memory/2884-13688-0x0000000007E50000-0x0000000007E58000-memory.dmp

Download

memory/2884-13693-0x0000000007F50000-0x0000000007F72000-memory.dmp

Download

memory/2884-13694-0x0000000008D10000-0x00000000092B4000-memory.dmp

Download