salatstealer | 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT6).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe
MD5 e6973238d03286140e2469f9616c9edc
SHA1 a01e8061bfc7cb2b93aca815ebcd85bc46145ed7
SHA512 28f8aacc46144648af1d03ede61d4983ee0942469526c49d86c633b63b52b2aeb80ab57b459775ac2b0ef975d1d822907b93171c4999952aecc934a98022d06a
TLSH
T144612753E00DDE4AB68FB83FF85EA6E52017C8C35CD6D452539B89E8C84FDBA494E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 6 IoCs

resource	yara_rule
behavioral24/files/0x0008000000024472-7506.dat	family_salatstealer
behavioral24/memory/2404-13751-0x00000000002E0000-0x0000000000F37000-memory.dmp	family_salatstealer
behavioral24/memory/4264-13752-0x0000000000130000-0x0000000000D87000-memory.dmp	family_salatstealer
behavioral24/memory/4264-13753-0x0000000000130000-0x0000000000D87000-memory.dmp	family_salatstealer
behavioral24/memory/4264-13754-0x0000000000130000-0x0000000000D87000-memory.dmp	family_salatstealer
behavioral24/memory/4264-13760-0x0000000000130000-0x0000000000D87000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
54	2776	powershell.exe
55	2776	powershell.exe
56	2776	powershell.exe
57	2776	powershell.exe
58	2776	powershell.exe

Executes dropped EXE 14 IoCs

pid	Process
3848	Setup-TaasfKQdEtTesVxb.exe
4780	agent_JMKcQoDo.exe
4396	Setup-TaasfKQdEtTesVxb.exe
3844	agent_zMnJJYLZ.exe
1416	Setup-TaasfKQdEtTesVxb.exe
1740	agent_kxwYTiog.exe
4588	SearchApp.exe
1088	Setup-TaasfKQdEtTesVxb.exe
5016	agent_JTWoKuVu.exe
1872	SearchApp.exe
3388	SearchApp.exe
4264	agent_gumyiXTn.exe
2404	agent_TRhCSqSl.exe
3320	WmiPrvSE.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3180	certutil.exe
3492	certutil.exe
2512	certutil.exe
4864	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral24/files/0x000500000000002e-13742.dat	upx
behavioral24/memory/4264-13744-0x0000000000130000-0x0000000000D87000-memory.dmp	upx
behavioral24/memory/2404-13749-0x00000000002E0000-0x0000000000F37000-memory.dmp	upx
behavioral24/memory/2404-13751-0x00000000002E0000-0x0000000000F37000-memory.dmp	upx
behavioral24/memory/4264-13752-0x0000000000130000-0x0000000000D87000-memory.dmp	upx
behavioral24/memory/4264-13753-0x0000000000130000-0x0000000000D87000-memory.dmp	upx
behavioral24/memory/4264-13754-0x0000000000130000-0x0000000000D87000-memory.dmp	upx
behavioral24/memory/4264-13760-0x0000000000130000-0x0000000000D87000-memory.dmp	upx
behavioral24/memory/3320-13761-0x00000000000D0000-0x0000000000D27000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\SearchApp.exe	SearchApp.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SearchApp.exe	SearchApp.exe
File opened for modification	C:\Program Files (x86)\Windows NT\cac7a89e-692b-5a6f-e524-456033609e69	agent_gumyiXTn.exe
File opened for modification	C:\Program Files (x86)\Windows NT\SppExtComObj.Exe	agent_gumyiXTn.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\cac7a89e-692b-5a6f-e524-456033609e69	agent_gumyiXTn.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\WmiPrvSE.exe	agent_gumyiXTn.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1712	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Setup-TaasfKQdEtTesVxb.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiPrvSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_JMKcQoDo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_zMnJJYLZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_kxwYTiog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_TRhCSqSl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_JTWoKuVu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_gumyiXTn.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Setup-TaasfKQdEtTesVxb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Setup-TaasfKQdEtTesVxb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Setup-TaasfKQdEtTesVxb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Setup-TaasfKQdEtTesVxb.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4780	agent_JMKcQoDo.exe
4780	agent_JMKcQoDo.exe
4780	agent_JMKcQoDo.exe
4780	agent_JMKcQoDo.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
2776	powershell.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
2776	powershell.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4588	SearchApp.exe
4264	agent_gumyiXTn.exe
4264	agent_gumyiXTn.exe
4264	agent_gumyiXTn.exe
4264	agent_gumyiXTn.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2428	winws.exe
Token: SeBackupPrivilege	2428	winws.exe
Token: SeDebugPrivilege	2428	winws.exe
Token: SeDebugPrivilege	2776	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3516	1712	cmd.exe	86
PID 1712 wrote to memory of 3180	1712	cmd.exe	87
PID 1712 wrote to memory of 3848	1712	cmd.exe	88
PID 1712 wrote to memory of 3492	1712	cmd.exe	93
PID 3848 wrote to memory of 4780	3848	Setup-TaasfKQdEtTesVxb.exe	94
PID 1712 wrote to memory of 4396	1712	cmd.exe	95
PID 4396 wrote to memory of 3844	4396	Setup-TaasfKQdEtTesVxb.exe	99
PID 1712 wrote to memory of 2512	1712	cmd.exe	101
PID 1712 wrote to memory of 1416	1712	cmd.exe	102
PID 1416 wrote to memory of 1740	1416	Setup-TaasfKQdEtTesVxb.exe	104
PID 4780 wrote to memory of 4588	4780	agent_JMKcQoDo.exe	105
PID 1712 wrote to memory of 4864	1712	cmd.exe	106
PID 1712 wrote to memory of 1088	1712	cmd.exe	107
PID 1712 wrote to memory of 2428	1712	cmd.exe	108
PID 1088 wrote to memory of 5016	1088	Setup-TaasfKQdEtTesVxb.exe	110
PID 4588 wrote to memory of 2776	4588	SearchApp.exe	111
PID 4588 wrote to memory of 1872	4588	SearchApp.exe	113
PID 4588 wrote to memory of 3388	4588	SearchApp.exe	116
PID 2776 wrote to memory of 3728	2776	powershell.exe	118
PID 1416 wrote to memory of 4264	1416	Setup-TaasfKQdEtTesVxb.exe	119
PID 3848 wrote to memory of 2404	3848	Setup-TaasfKQdEtTesVxb.exe	120
PID 4264 wrote to memory of 3320	4264	agent_gumyiXTn.exe	122

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT6).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3516
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3180
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Users\Admin\AppData\Roaming\ProtectDismount\agent_JMKcQoDo.exe
    C:\Users\Admin\AppData\Roaming\ProtectDismount\agent_JMKcQoDo.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Users\Admin\AppData\Local\Comms\SearchApp.exe
      C:\Users\Admin\AppData\Local\Comms\SearchApp.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2776
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3728
    - - C:\Program Files\Google\Chrome\Application\SearchApp.exe
        
        "C:\Program Files\Google\Chrome\Application\SearchApp.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\SearchApp.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\SearchApp.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3388
- - C:\Users\Admin\AppData\Roaming\SaveBlock\agent_TRhCSqSl.exe
    C:\Users\Admin\AppData\Roaming\SaveBlock\agent_TRhCSqSl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2404
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3492
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Users\Admin\AppData\Roaming\Sun\agent_zMnJJYLZ.exe
    C:\Users\Admin\AppData\Roaming\Sun\agent_zMnJJYLZ.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3844
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Users\Admin\AppData\Roaming\Adobe\agent_kxwYTiog.exe
    C:\Users\Admin\AppData\Roaming\Adobe\agent_kxwYTiog.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1740
- - C:\Users\Admin\AppData\Roaming\CompleteSearch\agent_gumyiXTn.exe
    C:\Users\Admin\AppData\Roaming\CompleteSearch\agent_gumyiXTn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Program Files (x86)\Windows Media Player\WmiPrvSE.exe
      "C:\Program Files (x86)\Windows Media Player\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3320
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4864
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Users\Admin\AppData\Roaming\Sun\agent_JTWoKuVu.exe
    C:\Users\Admin\AppData\Roaming\Sun\agent_JTWoKuVu.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5016
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 10.0MB
SHA256 1b2a146637e01a6f35bd18c706f0f3016ce4adc152f2e1f5d02fea34fc43f707
MD5 8e6c3b6dbdaabb2ee2bec6a194b282a9
SHA1 6243fab02966903f432ed9ef51f552b854e39849
SHA512 2cd18eb75d79ff0d25689860ce051ee85029c1ec21c8ad5f1cd123bf9f9137dbecff0d517916246a85afd319e689d5b68d5256335919805d6338d3766da53527
SSDEEP 49152:AVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxhdm727DJi5yU:V
TLSH
T1B7B6F1331603FDDA2FAA5D45D00839812C5C795B52A4E2E4FF4E74EB61EA620EE3D874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 9f8da25c68d16a12a8d3040beb35be5c166b973679135ae34068467d76da6c2a
MD5 12f247edf90d4c1ca0a05eddb2b02bc6
SHA1 639080f2f9472b8007092753d742a427fc88b545
SHA512 eeea157f102831fad708f56d35109c862390c32aa5d47eec53226634d4669ace9010c45867ae3b81020bcdd348bfe181167a6ad12c8ba4a7067d6e50cb0a2bf8
SSDEEP 384:bmEKcI43+3lEVUXBEBhU3kXaTjBB6BDSCAOR3QQia1yMkWmm0EybYpt0fPjSrYm7:bmEP93+VEVUXBEBhU3kXaTjf6BDSCAOr
TLSH
T12B92F17B0526F7D94B1B460858AD23129A38A7B37372CAEFE5B670DD381026715ECB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 44KB
SHA256 331aa40ee4a15edf170e4acc3f9c13ca276e5949e2ada808f80f549939a4c4f3
MD5 1dd17f13c8fdf24f2dc390b5095d0a10
SHA1 c589dd3baeee0611948716b100aa88ebfbbc7b87
SHA512 1dac1aff962a9529a6b994a7066c15ec72e8a5f3f1f0b3afa624f7417a637de899381e0a6199e4d3d66ca086b28e0454129947ad466202dd0c20450211006a96
SSDEEP 768:vc2H57YNeKbVl/u3aOHhsqIC3VMkzoEJbK5ZlwCvR7E2yhYJf6Kr8C5CeA+u:vc2H57keKbj/uKOHhsqV3VZoEsZNR7hE
TLSH
T1D713D53A175B60FC39AC7D4661531E4C6E6D3608627F470A73C531BB67A90F48E28E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 14.0MB
SHA256 99f6a6a202e462b252954f36ee9de526c666dcb876989cf86aa3f8e6832ef581
MD5 2deaef5fc7515e4a412422157fd54f1a
SHA1 ca32427651ce394fa871b13c6fa29326eb9ec838
SHA512 3cd18e256dcfc99d46cfc267e470d0c0fe47ab2391baf9f1671f3548b733c8986c3cf61b944429b318d64c6de8405bf7875906d58b5fcec703efcf41e18556cf
SSDEEP 49152:Ir0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHnZ:d
TLSH
T170E6CF320647FDBD3FAD3D45E0012E455D9D7A1B22A89249FB8930BA63ED5A4CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 d8eccfe1ae6ec6e4a7f865688fe1760856033db69e133417e03679e60859c79e
MD5 47715b1ddc196dbb2f50b7a3bb7d9366
SHA1 e4bede47168a0bd15dbfb2cd4c144c2eb2518819
SHA512 f87aa4dab947035b1b77b568e1e2206babe7ca2e71826dda6250d11afff37d701f81f50227719aa866d43483452524d997707ec963dd92aa3174b4d29462584b
SSDEEP 768:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZGl9+e:lV9utQVN65vt6j6Uam
TLSH
T11DB24C304FE328BD399C7C5175205DEC6D6C2F8B1465030A97C978FAA2985BC8E29C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 840KB
SHA256 d8887d8b1b913c93765591915406555182150da11f11b3fbd053fbd05e57786a
MD5 3e8a4f30f9033f48b074c6848fad48fd
SHA1 fd97282a61035bd7e19853ed0aac15b6b3a3e867
SHA512 9166a7b1b8532b85997c1108d0d71e23d0a2e70729afae09caeb0c1bee4d826bd7f56fb80b222762093824a5a9a6308a9788d2a2ea07069fee739537ae8512af
SSDEEP 12288:2e4A2icg04FU9oBLzfSvywrUrB7+vyLEo24shPMR:2e2icg04WGFfV1rYAAlG
TLSH
T1320519354AE734BC39EC7D8674220E4C5D6D2B0D557A030A67C534BA73AD4E8CE29E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 14.3MB
SHA256 619a9fb9d8f0d2e37fb063dadd1ca5da4c90527a57d401863b9ca6849a6b9fca
MD5 a45030eb1387f438328c05fba93c5e07
SHA1 d83ae1d1737e3b7257627508697ad15359ba738c
SHA512 0e0ec8892525156a9f385031f64cbaa7e377892a49462f747f9357b8bd33260ef747d7793a0387739284636d600d888e77eb00d45cf89e55bb3250007ff8dc6c
SSDEEP 49152:7LJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwp5:o
TLSH
T1AFE6CF320643FDBD3FAD3D85E0012E495D5D7A1B12A89249FB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_n0eyrrs1.45i.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n0eyrrs1.45i.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gumyiXTn.exe

Path C:\Users\Admin\AppData\Roaming\CompleteSearch\agent_gumyiXTn.exe
Size 3.4MB
SHA256 18e4b49fd7e15ca846c6346ce58268ff206974eefde55ef5998a2e9cd3b203e2
MD5 4bcf896b2ce2408e8ac04bba1465a488
SHA1 02d86ea709f605fff40c08ebfffa204de4201736
SHA512 7d7d45441619cb9fcf6e5e3981147b1a721d9da5126ba6902af207782294c3f0f5b0f19342acae2a17d6bfd49f5758d4cfb58b88ca32033a057ed387e3a645e7
SSDEEP 98304:ICaZpkH/byuFxzPj5YYzNxI8/OeL/fTOD:ICaUH/byuzj5YYzNxb3O
TLSH
T116F53311896ECB6FF53674B78B12A42A1D41C25EC36B106DF84908135BE8BF77A734CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_JMKcQoDo.exe

Path C:\Users\Admin\AppData\Roaming\ProtectDismount\agent_JMKcQoDo.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2404-13751-0x00000000002E0000-0x0000000000F37000-memory.dmp

Download

memory/2404-13749-0x00000000002E0000-0x0000000000F37000-memory.dmp

Download

memory/2428-13677-0x00007FFDC73F0000-0x00007FFDC76F2000-memory.dmp

Download

memory/2428-13678-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2428-13680-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2428-13681-0x00007FFDC73F0000-0x00007FFDC76F2000-memory.dmp

Download

memory/2776-13710-0x0000000007910000-0x0000000007986000-memory.dmp

Download

memory/2776-13726-0x0000000007FB0000-0x0000000008046000-memory.dmp

Download

memory/2776-13702-0x0000000006290000-0x00000000065E4000-memory.dmp

Download

memory/2776-13707-0x0000000005530000-0x000000000554E000-memory.dmp

Download

memory/2776-13708-0x0000000006D80000-0x0000000006DCC000-memory.dmp

Download

memory/2776-13709-0x0000000006DD0000-0x0000000006E14000-memory.dmp

Download

memory/2776-13694-0x0000000006220000-0x0000000006286000-memory.dmp

Download

memory/2776-13712-0x0000000007BB0000-0x0000000007BCA000-memory.dmp

Download

memory/2776-13711-0x0000000008210000-0x000000000888A000-memory.dmp

Download

memory/2776-13714-0x0000000070940000-0x000000007098C000-memory.dmp

Download

memory/2776-13715-0x0000000070BB0000-0x0000000070F04000-memory.dmp

Download

memory/2776-13713-0x0000000007D80000-0x0000000007DB2000-memory.dmp

Download

memory/2776-13723-0x0000000007DC0000-0x0000000007DDE000-memory.dmp

Download

memory/2776-13724-0x0000000007DE0000-0x0000000007E83000-memory.dmp

Download

memory/2776-13725-0x0000000007EE0000-0x0000000007EEA000-memory.dmp

Download

memory/2776-13693-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Download

memory/2776-13727-0x0000000007F10000-0x0000000007F21000-memory.dmp

Download

memory/2776-13728-0x0000000007F40000-0x0000000007F4E000-memory.dmp

Download

memory/2776-13729-0x0000000007F50000-0x0000000007F64000-memory.dmp

Download

memory/2776-13730-0x0000000008050000-0x000000000806A000-memory.dmp

Download

memory/2776-13731-0x0000000007F80000-0x0000000007F88000-memory.dmp

Download

memory/2776-13736-0x0000000008090000-0x00000000080B2000-memory.dmp

Download

memory/2776-13737-0x0000000008E40000-0x00000000093E4000-memory.dmp

Download

memory/2776-13692-0x0000000005920000-0x0000000005942000-memory.dmp

Download

memory/2776-13690-0x0000000002EF0000-0x0000000002F26000-memory.dmp

Download

memory/2776-13691-0x0000000005BF0000-0x0000000006218000-memory.dmp

Download

memory/3320-13761-0x00000000000D0000-0x0000000000D27000-memory.dmp

Download

memory/4264-13744-0x0000000000130000-0x0000000000D87000-memory.dmp

Download

memory/4264-13752-0x0000000000130000-0x0000000000D87000-memory.dmp

Download

memory/4264-13753-0x0000000000130000-0x0000000000D87000-memory.dmp

Download

memory/4264-13754-0x0000000000130000-0x0000000000D87000-memory.dmp

Download

memory/4264-13760-0x0000000000130000-0x0000000000D87000-memory.dmp

Download