salatstealer | 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT6).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe
MD5 e6973238d03286140e2469f9616c9edc
SHA1 a01e8061bfc7cb2b93aca815ebcd85bc46145ed7
SHA512 28f8aacc46144648af1d03ede61d4983ee0942469526c49d86c633b63b52b2aeb80ab57b459775ac2b0ef975d1d822907b93171c4999952aecc934a98022d06a
TLSH
T144612753E00DDE4AB68FB83FF85EA6E52017C8C35CD6D452539B89E8C84FDBA494E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral25/files/0x000d00000001c55a-3840.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
18	3196	powershell.exe
19	3196	powershell.exe
20	3196	powershell.exe
21	3196	powershell.exe
22	3196	powershell.exe
22	3196	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
4496	Setup-TaasfKQdEtTesVxb.exe
3456	Setup-TaasfKQdEtTesVxb.exe
424	agent_MwItPIFw.exe
4680	Setup-TaasfKQdEtTesVxb.exe
2004	agent_RhCPQWAJ.exe
3384	agent_OtrXAnWK.exe
5864	Setup-TaasfKQdEtTesVxb.exe
1640	agent_fgDhyrTg.exe
5564	explorer.exe
5244	explorer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3632	certutil.exe
2900	certutil.exe
3772	certutil.exe
944	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\SearchHost.exe	agent_MwItPIFw.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\9d4f8fec-99b7-cf00-394b-0609b531ec99	agent_MwItPIFw.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\explorer.exe	agent_MwItPIFw.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe	explorer.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\9d4f8fec-99b7-cf00-394b-0609b531ec99	agent_MwItPIFw.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_OtrXAnWK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_MwItPIFw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_RhCPQWAJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_fgDhyrTg.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
424	agent_MwItPIFw.exe
424	agent_MwItPIFw.exe
424	agent_MwItPIFw.exe
424	agent_MwItPIFw.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
3196	powershell.exe
3196	powershell.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
3196	powershell.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe
5564	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4780	winws.exe
Token: SeBackupPrivilege	4780	winws.exe
Token: SeDebugPrivilege	4780	winws.exe
Token: SeDebugPrivilege	5564	explorer.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeIncreaseQuotaPrivilege	3196	powershell.exe
Token: SeSecurityPrivilege	3196	powershell.exe
Token: SeTakeOwnershipPrivilege	3196	powershell.exe
Token: SeLoadDriverPrivilege	3196	powershell.exe
Token: SeSystemProfilePrivilege	3196	powershell.exe
Token: SeSystemtimePrivilege	3196	powershell.exe
Token: SeProfSingleProcessPrivilege	3196	powershell.exe
Token: SeIncBasePriorityPrivilege	3196	powershell.exe
Token: SeCreatePagefilePrivilege	3196	powershell.exe
Token: SeBackupPrivilege	3196	powershell.exe
Token: SeRestorePrivilege	3196	powershell.exe
Token: SeShutdownPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeSystemEnvironmentPrivilege	3196	powershell.exe
Token: SeRemoteShutdownPrivilege	3196	powershell.exe
Token: SeUndockPrivilege	3196	powershell.exe
Token: SeManageVolumePrivilege	3196	powershell.exe
Token: 33	3196	powershell.exe
Token: 34	3196	powershell.exe
Token: 35	3196	powershell.exe
Token: 36	3196	powershell.exe
Token: SeIncreaseQuotaPrivilege	3196	powershell.exe
Token: SeSecurityPrivilege	3196	powershell.exe
Token: SeTakeOwnershipPrivilege	3196	powershell.exe
Token: SeLoadDriverPrivilege	3196	powershell.exe
Token: SeSystemProfilePrivilege	3196	powershell.exe
Token: SeSystemtimePrivilege	3196	powershell.exe
Token: SeProfSingleProcessPrivilege	3196	powershell.exe
Token: SeIncBasePriorityPrivilege	3196	powershell.exe
Token: SeCreatePagefilePrivilege	3196	powershell.exe
Token: SeBackupPrivilege	3196	powershell.exe
Token: SeRestorePrivilege	3196	powershell.exe
Token: SeShutdownPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeSystemEnvironmentPrivilege	3196	powershell.exe
Token: SeRemoteShutdownPrivilege	3196	powershell.exe
Token: SeUndockPrivilege	3196	powershell.exe
Token: SeManageVolumePrivilege	3196	powershell.exe
Token: 33	3196	powershell.exe
Token: 34	3196	powershell.exe
Token: 35	3196	powershell.exe
Token: 36	3196	powershell.exe
Token: SeIncreaseQuotaPrivilege	3196	powershell.exe
Token: SeSecurityPrivilege	3196	powershell.exe
Token: SeTakeOwnershipPrivilege	3196	powershell.exe
Token: SeLoadDriverPrivilege	3196	powershell.exe
Token: SeSystemProfilePrivilege	3196	powershell.exe
Token: SeSystemtimePrivilege	3196	powershell.exe
Token: SeProfSingleProcessPrivilege	3196	powershell.exe
Token: SeIncBasePriorityPrivilege	3196	powershell.exe
Token: SeCreatePagefilePrivilege	3196	powershell.exe
Token: SeBackupPrivilege	3196	powershell.exe
Token: SeRestorePrivilege	3196	powershell.exe
Token: SeShutdownPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeSystemEnvironmentPrivilege	3196	powershell.exe
Token: SeRemoteShutdownPrivilege	3196	powershell.exe
Token: SeUndockPrivilege	3196	powershell.exe
Token: SeManageVolumePrivilege	3196	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4736	4604	cmd.exe	91
PID 4604 wrote to memory of 2900	4604	cmd.exe	92
PID 4604 wrote to memory of 4496	4604	cmd.exe	93
PID 4604 wrote to memory of 3772	4604	cmd.exe	94
PID 4604 wrote to memory of 3456	4604	cmd.exe	95
PID 4496 wrote to memory of 424	4496	Setup-TaasfKQdEtTesVxb.exe	96
PID 4604 wrote to memory of 944	4604	cmd.exe	97
PID 4604 wrote to memory of 4680	4604	cmd.exe	98
PID 3456 wrote to memory of 2004	3456	Setup-TaasfKQdEtTesVxb.exe	99
PID 4680 wrote to memory of 3384	4680	Setup-TaasfKQdEtTesVxb.exe	101
PID 4604 wrote to memory of 3632	4604	cmd.exe	103
PID 4604 wrote to memory of 5864	4604	cmd.exe	104
PID 4604 wrote to memory of 4780	4604	cmd.exe	105
PID 5864 wrote to memory of 1640	5864	Setup-TaasfKQdEtTesVxb.exe	107
PID 424 wrote to memory of 5564	424	agent_MwItPIFw.exe	109
PID 5564 wrote to memory of 3196	5564	explorer.exe	110
PID 5564 wrote to memory of 5244	5564	explorer.exe	112
PID 3196 wrote to memory of 2132	3196	powershell.exe	115

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT6).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4736
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2900
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Users\Admin\AppData\Roaming\LockMove\agent_MwItPIFw.exe
    C:\Users\Admin\AppData\Roaming\LockMove\agent_MwItPIFw.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Program Files (x86)\WindowsPowerShell\explorer.exe
      "C:\Program Files (x86)\WindowsPowerShell\explorer.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5564
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3196
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5244
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3772
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Users\Admin\AppData\Roaming\UnpublishMount\agent_RhCPQWAJ.exe
    C:\Users\Admin\AppData\Roaming\UnpublishMount\agent_RhCPQWAJ.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2004
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:944
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Users\Admin\AppData\Roaming\SaveGrant\agent_OtrXAnWK.exe
    C:\Users\Admin\AppData\Roaming\SaveGrant\agent_OtrXAnWK.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3384
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3632
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Users\Admin\AppData\Roaming\Adobe\agent_fgDhyrTg.exe
    C:\Users\Admin\AppData\Roaming\Adobe\agent_fgDhyrTg.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1640
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 32KB
SHA256 e93c66b93c48dd75c8b4fadb201748a3ad8bb11479ba7cafcc0b46a92f21bdc5
MD5 27bbcd04db5525a85ee22d80cdd8d7de
SHA1 2d078ef7220211a6cb18ce2ac04041cee8d0ad4e
SHA512 6d50234f500de58d91d7a710febb1d9c3423b002dffca2d62e3fbd8e7f36e16dc2ac116b96c58e57fea4d805d9f699c247ef94cdf65453188194ebdbf0d2babc
SSDEEP 768:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZGl9+LvM5vrcNyZct:lV9utQVN65vt6j6Uaj8YMct
TLSH
T1A2E23A304EE328BC3ADC7C6225605DEC9D6C2F8B14A9030F97C478F5A5599BC8E29C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_MwItPIFw.exe

Path C:\Users\Admin\AppData\Roaming\LockMove\agent_MwItPIFw.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3196-3885-0x00000000077A0000-0x00000000077D6000-memory.dmp

Download

memory/3196-3880-0x0000000006350000-0x000000000639C000-memory.dmp

Download

memory/3196-3897-0x0000000008BC0000-0x000000000917A000-memory.dmp

Download

memory/3196-3896-0x0000000007E40000-0x0000000007E62000-memory.dmp

Download

memory/3196-3869-0x0000000002A70000-0x0000000002AA6000-memory.dmp

Download

memory/3196-3870-0x0000000005670000-0x0000000005CBA000-memory.dmp

Download

memory/3196-3871-0x0000000005500000-0x0000000005522000-memory.dmp

Download

memory/3196-3872-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/3196-3873-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Download

memory/3196-3876-0x0000000005E20000-0x000000000617B000-memory.dmp

Download

memory/3196-3879-0x00000000062F0000-0x000000000630E000-memory.dmp

Download

memory/3196-3895-0x0000000007A50000-0x0000000007AE6000-memory.dmp

Download

memory/3196-3884-0x00000000068C0000-0x0000000006908000-memory.dmp

Download

memory/3196-3886-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

Download

memory/3196-3891-0x0000000007800000-0x00000000078A3000-memory.dmp

Download

memory/3196-3890-0x00000000077E0000-0x0000000007800000-memory.dmp

Download

memory/3196-3887-0x0000000070DB0000-0x000000007110B000-memory.dmp

Download

memory/3196-3892-0x0000000007F80000-0x00000000085FC000-memory.dmp

Download

memory/3196-3893-0x0000000007940000-0x000000000795A000-memory.dmp

Download

memory/3196-3894-0x00000000079A0000-0x00000000079AA000-memory.dmp

Download

memory/4780-3852-0x00007FFFAE340000-0x00007FFFAE642000-memory.dmp

Download

memory/4780-3854-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4780-3853-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4780-3856-0x00007FFFAE340000-0x00007FFFAE642000-memory.dmp

Download