salatstealer | 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT5).bat
Size 2KB
Sample260730-w44lwavemb
SHA256 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1
MD5 2d3d8bfe1a53bd8e0d03b8339fc02546
SHA1 9c02f16df41e3b7510209f21910331a7c3ca298f
SHA512 7a00daae8665d3d61134e111bb61a88edc657a09744f15fbf4846580d3e5f156e5ff9ac2fbff31327004a8593f581eaeb14f67a36412a8a22017f4284347ba51
TLSH
T15D413987F00DDE46B08DA87EFC5AA6F5601BD8C35DE1D452539788E4C84EDAE8C4E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral23/files/0x000f00000001c4e5-4126.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
33	5356	powershell.exe
34	5356	powershell.exe
35	5356	powershell.exe
36	5356	powershell.exe
37	5356	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2600	Setup-TaasfKQdEtTesVxb.exe
4328	agent_dJNhYpUw.exe
1308	Setup-TaasfKQdEtTesVxb.exe
4872	agent_nCfObEPo.exe
2404	Setup-TaasfKQdEtTesVxb.exe
1264	agent_IxcqXawQ.exe
2304	Setup-TaasfKQdEtTesVxb.exe
4736	winlogon.exe
5424	agent_vAcuUxsi.exe
3348	smartscreen.exe
1628	smartscreen.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3480	certutil.exe
5880	certutil.exe
2324	certutil.exe
4072	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\51cbe81d-746b-ef5b-bd77-1c1689c31d74	agent_dJNhYpUw.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\SearchHost.exe	agent_dJNhYpUw.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\51cbe81d-746b-ef5b-bd77-1c1689c31d74	agent_dJNhYpUw.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\winlogon.exe	agent_dJNhYpUw.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\smartscreen.exe	smartscreen.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_vAcuUxsi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smartscreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_dJNhYpUw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_nCfObEPo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_IxcqXawQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smartscreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4328	agent_dJNhYpUw.exe
4328	agent_dJNhYpUw.exe
4328	agent_dJNhYpUw.exe
4328	agent_dJNhYpUw.exe
5424	agent_vAcuUxsi.exe
5424	agent_vAcuUxsi.exe
5424	agent_vAcuUxsi.exe
5424	agent_vAcuUxsi.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe
3348	smartscreen.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2272	winws.exe
Token: SeBackupPrivilege	2272	winws.exe
Token: SeDebugPrivilege	2272	winws.exe
Token: SeDebugPrivilege	3348	smartscreen.exe
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeIncreaseQuotaPrivilege	5356	powershell.exe
Token: SeSecurityPrivilege	5356	powershell.exe
Token: SeTakeOwnershipPrivilege	5356	powershell.exe
Token: SeLoadDriverPrivilege	5356	powershell.exe
Token: SeSystemProfilePrivilege	5356	powershell.exe
Token: SeSystemtimePrivilege	5356	powershell.exe
Token: SeProfSingleProcessPrivilege	5356	powershell.exe
Token: SeIncBasePriorityPrivilege	5356	powershell.exe
Token: SeCreatePagefilePrivilege	5356	powershell.exe
Token: SeBackupPrivilege	5356	powershell.exe
Token: SeRestorePrivilege	5356	powershell.exe
Token: SeShutdownPrivilege	5356	powershell.exe
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeSystemEnvironmentPrivilege	5356	powershell.exe
Token: SeRemoteShutdownPrivilege	5356	powershell.exe
Token: SeUndockPrivilege	5356	powershell.exe
Token: SeManageVolumePrivilege	5356	powershell.exe
Token: 33	5356	powershell.exe
Token: 34	5356	powershell.exe
Token: 35	5356	powershell.exe
Token: 36	5356	powershell.exe
Token: SeIncreaseQuotaPrivilege	5356	powershell.exe
Token: SeSecurityPrivilege	5356	powershell.exe
Token: SeTakeOwnershipPrivilege	5356	powershell.exe
Token: SeLoadDriverPrivilege	5356	powershell.exe
Token: SeSystemProfilePrivilege	5356	powershell.exe
Token: SeSystemtimePrivilege	5356	powershell.exe
Token: SeProfSingleProcessPrivilege	5356	powershell.exe
Token: SeIncBasePriorityPrivilege	5356	powershell.exe
Token: SeCreatePagefilePrivilege	5356	powershell.exe
Token: SeBackupPrivilege	5356	powershell.exe
Token: SeRestorePrivilege	5356	powershell.exe
Token: SeShutdownPrivilege	5356	powershell.exe
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeSystemEnvironmentPrivilege	5356	powershell.exe
Token: SeRemoteShutdownPrivilege	5356	powershell.exe
Token: SeUndockPrivilege	5356	powershell.exe
Token: SeManageVolumePrivilege	5356	powershell.exe
Token: 33	5356	powershell.exe
Token: 34	5356	powershell.exe
Token: 35	5356	powershell.exe
Token: 36	5356	powershell.exe
Token: SeIncreaseQuotaPrivilege	5356	powershell.exe
Token: SeSecurityPrivilege	5356	powershell.exe
Token: SeTakeOwnershipPrivilege	5356	powershell.exe
Token: SeLoadDriverPrivilege	5356	powershell.exe
Token: SeSystemProfilePrivilege	5356	powershell.exe
Token: SeSystemtimePrivilege	5356	powershell.exe
Token: SeProfSingleProcessPrivilege	5356	powershell.exe
Token: SeIncBasePriorityPrivilege	5356	powershell.exe
Token: SeCreatePagefilePrivilege	5356	powershell.exe
Token: SeBackupPrivilege	5356	powershell.exe
Token: SeRestorePrivilege	5356	powershell.exe
Token: SeShutdownPrivilege	5356	powershell.exe
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeSystemEnvironmentPrivilege	5356	powershell.exe
Token: SeRemoteShutdownPrivilege	5356	powershell.exe
Token: SeUndockPrivilege	5356	powershell.exe
Token: SeManageVolumePrivilege	5356	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 4804	4080	cmd.exe	90
PID 4080 wrote to memory of 2324	4080	cmd.exe	91
PID 4080 wrote to memory of 2600	4080	cmd.exe	92
PID 2600 wrote to memory of 4328	2600	Setup-TaasfKQdEtTesVxb.exe	93
PID 4080 wrote to memory of 4072	4080	cmd.exe	94
PID 4080 wrote to memory of 1308	4080	cmd.exe	95
PID 1308 wrote to memory of 4872	1308	Setup-TaasfKQdEtTesVxb.exe	97
PID 4080 wrote to memory of 3480	4080	cmd.exe	98
PID 4080 wrote to memory of 2404	4080	cmd.exe	99
PID 4080 wrote to memory of 5880	4080	cmd.exe	100
PID 2404 wrote to memory of 1264	2404	Setup-TaasfKQdEtTesVxb.exe	101
PID 4080 wrote to memory of 2304	4080	cmd.exe	103
PID 4080 wrote to memory of 2272	4080	cmd.exe	104
PID 4328 wrote to memory of 4736	4328	agent_dJNhYpUw.exe	106
PID 2304 wrote to memory of 5424	2304	Setup-TaasfKQdEtTesVxb.exe	107
PID 5424 wrote to memory of 3348	5424	agent_vAcuUxsi.exe	108
PID 3348 wrote to memory of 5356	3348	smartscreen.exe	109
PID 3348 wrote to memory of 1628	3348	smartscreen.exe	111
PID 5356 wrote to memory of 4588	5356	powershell.exe	114

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT5).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4804
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Users\Admin\AppData\Roaming\RemoveDebug\agent_dJNhYpUw.exe
    C:\Users\Admin\AppData\Roaming\RemoveDebug\agent_dJNhYpUw.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Program Files (x86)\WindowsPowerShell\winlogon.exe
      "C:\Program Files (x86)\WindowsPowerShell\winlogon.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4736
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\AppData\Roaming\UninstallPush\agent_nCfObEPo.exe
    C:\Users\Admin\AppData\Roaming\UninstallPush\agent_nCfObEPo.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4872
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3480
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Users\Admin\AppData\Roaming\Adobe\agent_IxcqXawQ.exe
    C:\Users\Admin\AppData\Roaming\Adobe\agent_IxcqXawQ.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1264
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5880
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Roaming\ApproveDisconnect\agent_vAcuUxsi.exe
    C:\Users\Admin\AppData\Roaming\ApproveDisconnect\agent_vAcuUxsi.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5424
  - - C:\Users\Admin\AppData\Local\D3DSCache\smartscreen.exe
      C:\Users\Admin\AppData\Local\D3DSCache\smartscreen.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3348
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5356
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\smartscreen.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\smartscreen.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1628
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-l3=ipv4 --filter-tcp=80,443,2053,2083,2087,2096,8443 --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=syndata,multidisorder --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=14 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n3
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 01c77d5b787089d365a8b0982cd995aed3f999dc62149a47cd601ecee3a6f1d3
MD5 7934eca91a8848eacbbdc335aa0c1d4f
SHA1 6a899e87f718ce5f02094965f3dcaff8dc93e6bc
SHA512 2ec0dbdb7bf77f39fa08b3d86322408880415f22836d7ab3282bf24c17e1ad3c5f368f605803e9d5cdc84845e5ba020538e66797a2e21e07601b48f65c24fae6
SSDEEP 384:2Ne6aOBT6HKxCLgM64/+oZVzE/s5+ZDcFTXzOKCfdE:QeSBTAKxCLpNzOpti
TLSH
T18FB235B31247FDDF2F7B1D80804035446C9D7C2BA32DD5A8FE8A029666FA610EE69C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 7.2MB
SHA256 13321fdbabb6bd3c5966d19b7d1c6ca150895f27ec110ed7209c874d9a2731da
MD5 960513877946ab02e2b8c59dfa6c6e4f
SHA1 272ca754a34a7f0084e4859e734615538e4cdb82
SHA512 153f75a3ec65b542cdbf6f61a65e2f88fc857ef7e2f0f644f388074e005f12096c6eae93242e75d85eff9c3e384290cdcc10a3b7e07432ed0e7914cd9fea7637
SSDEEP 49152:SQVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxhdm727DJi5y3SkSIIGo0su6:F
TLSH
T1897623329A0BFD9E3B6A7E4CD04B39551F6E2D17D158F09CEF4884E621E9600DE2B874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 32KB
SHA256 4e01e99ad79ba57cdd2916c5083977b5b99867ce20aaacae2156442d69d54600
MD5 0d88bbc9cfdd7480105a837c4b8a14bf
SHA1 d7136c39f6520fc4de39d06373e2f8b6fdd87bf5
SHA512 ad8abea8b039146c0c4d80e72636960ffb7b49853d40519744f69a3dfba5b2ebe00e404064b00ce3319208e7b8d2b5029971e3fde3b286512613f3582dafd145
SSDEEP 768:U2FMukfPbRiCNaRZ95iJls4uBhTIT3N2fqgT3y:hjkrRiuaR0JlaB9I7N2fly
TLSH
T174E22B3606A770BC34BC7E4634121D9D5E8D271E15BA435637C8307EA3B98E88E2DE76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 11.9MB
SHA256 327ac4e463b9b1e26671d980b4ca95a930a175f38f0ec9c03ba6070d3a9babd8
MD5 41737c55536aea6980e3026d4d23b093
SHA1 cc22514a855f7663664a4e8f8fb58af1857730bf
SHA512 64c80721d8ff06257f290aece4a5b8983395b31c421b08d1d691eddde7231940172c084303ae981265bda280b22376cacef496bd3d9c82d2decd4ff87e81c335
SSDEEP 49152:nlhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSgh0:r
TLSH
T1ECC6D0320243FDED2F6A6D84D0043E415D9D7A1B62A8D299FF8D34BA62EA524DD3CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 10.5MB
SHA256 2cc6dce547eabfff119d75fa9704b72fc4dc4976d344c6b9e7e5cc584128e196
MD5 16f7f98a6229cc48b6c16638bf965b67
SHA1 9d18861ba9f57232ee07363c1c2d52ce1b5a7c5f
SHA512 f0ba46124a25e60cfade8f64375283108b86bf2bee75e8c767f1161493d1a9a0c07a387223ef47117ae6a670b1879ba51d7758381dde0e9fe2a5857e686d56ef
SSDEEP 49152:HA4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxhdm7276:t
TLSH
T167B6F1731603FDDA2FAA5D44D00839811C5CB95B52A4D2E8FF4E74EB61EA620EE7C874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 b98038e14bbbd1156b116ebc4bed0f0ffd7251637c0410be5759432c4b12a246
MD5 b163b3b776d5cb3c5d2448c00a741390
SHA1 0a2ad3ee8af259e201eecd0e16f11e9940dcf615
SHA512 83bf1647d3278744b3a3fa1f77639b885e403d47c292bf9f10a1df6a6d65c02d661e4d0bee6862a9a44c8b0f2b7035150ea644463a505534015e6afeac6a0783
SSDEEP 384:LT4Gh/4MxyVVPmWgWVAb44vDi+Ihi38WBVp2e8F7f:NxySJMcDZEhF7f
TLSH
T1B5B2AC794043FDD92FA60D8CD0453E814D9FA85BE518E64AFE8876BE16BE4049CBCD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 430a6e344da69c81025b7da7f38f36e48780837f685978fa0d1d01e624beb8dd
MD5 83737ea3da30a4140057311e7a5927f7
SHA1 4c92c12952bf31b115895894799727970a67392a
SHA512 8e3af443385243e773551b60defcddf23a3dee835d4c0b7d88fe85f02400a695bb2c66bd34dd0ac4c02a7bd812ca2856f772ef55aea5bdd7d6459d940d222ef2
SSDEEP 384:lVH9x1M0YqutQse9FKkNKn5BYdAQFNl88uayR2ZxBp6UaMEDEZ/Hopsli:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZP
TLSH
T107926E704AE33CBD3D8C7C5061505DAC5D6C2F8B51650209ABC834FA63E85BC8E6AD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_dJNhYpUw.exe

Path C:\Users\Admin\AppData\Roaming\RemoveDebug\agent_dJNhYpUw.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2272-11426-0x00007FF8496F0000-0x00007FF8499F2000-memory.dmp

Download

memory/2272-11427-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2272-11428-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2272-11430-0x00007FF8496F0000-0x00007FF8499F2000-memory.dmp

Download

memory/5356-11453-0x0000000005C10000-0x0000000005C32000-memory.dmp

Download

memory/5356-11467-0x0000000007E30000-0x0000000007E66000-memory.dmp

Download

memory/5356-11451-0x0000000003190000-0x00000000031C6000-memory.dmp

Download

memory/5356-11455-0x00000000064C0000-0x0000000006526000-memory.dmp

Download

memory/5356-11454-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Download

memory/5356-11458-0x00000000066A0000-0x00000000069FB000-memory.dmp

Download

memory/5356-11459-0x0000000006A00000-0x0000000006A1E000-memory.dmp

Download

memory/5356-11460-0x0000000006A30000-0x0000000006A7C000-memory.dmp

Download

memory/5356-11463-0x00000000079D0000-0x0000000007A18000-memory.dmp

Download

memory/5356-11452-0x0000000005E70000-0x00000000064BA000-memory.dmp

Download

memory/5356-11468-0x0000000070C80000-0x0000000070CCC000-memory.dmp

Download

memory/5356-11469-0x0000000070DE0000-0x000000007113B000-memory.dmp

Download

memory/5356-11472-0x0000000007E70000-0x0000000007E90000-memory.dmp

Download

memory/5356-11473-0x0000000007E90000-0x0000000007F33000-memory.dmp

Download

memory/5356-11475-0x0000000007FB0000-0x0000000007FCA000-memory.dmp

Download

memory/5356-11474-0x00000000085F0000-0x0000000008C6C000-memory.dmp

Download

memory/5356-11476-0x0000000008010000-0x000000000801A000-memory.dmp

Download

memory/5356-11477-0x00000000080C0000-0x0000000008156000-memory.dmp

Download

memory/5356-11478-0x00000000084C0000-0x00000000084E2000-memory.dmp

Download

memory/5356-11479-0x0000000009230000-0x00000000097EA000-memory.dmp

Download