salatstealer | 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT8).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5
MD5 a2865133b7b6bc0adcc51acb7d64ae20
SHA1 5ccf2ac6e98ef57e60adaef840104f94035f776a
SHA512 e0f5aaf76637c1a1934a1eba13e35f6cae87c83741ae26b594ee7ef9e9d1b894f75224992b67f82e48577d009187a2152e0475faedec4a7a0b1410bfd3d06329
TLSH
T162616A93E00CDE46B58CA83EF85FA6B42127DCC32CD2D452539B88F8D84EDBE584E584
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral29/files/0x000d00000001c611-4811.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
33	1088	powershell.exe
34	1088	powershell.exe
35	1088	powershell.exe
36	1088	powershell.exe
37	1088	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
5208	Setup-TaasfKQdEtTesVxb.exe
5228	agent_HGVyWIKf.exe
4824	Setup-TaasfKQdEtTesVxb.exe
4596	agent_JjRzVOhi.exe
2492	Setup-TaasfKQdEtTesVxb.exe
1984	agent_eWuDJJIS.exe
5892	Setup-TaasfKQdEtTesVxb.exe
2960	SecurityHealthSystray.exe
2896	agent_Wvxnlqss.exe
1164	dwm.exe
936	dwm.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1180	certutil.exe
2636	certutil.exe
4896	certutil.exe
3080	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft.NET\SecurityHealthSystray.exe	agent_HGVyWIKf.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\c3b1ef68-161a-0db0-a074-944496256816	agent_Wvxnlqss.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\OfficeClickToRun.exe	agent_Wvxnlqss.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\c3b1ef68-161a-0db0-a074-944496256816	agent_Wvxnlqss.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\c3b1ef68-161a-0db0-a074-944496256816	agent_HGVyWIKf.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\dwm.exe	agent_Wvxnlqss.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe	dwm.exe
File opened for modification	C:\Program Files (x86)\Google\c3b1ef68-161a-0db0-a074-944496256816	agent_HGVyWIKf.exe
File opened for modification	C:\Program Files (x86)\Google\dllhost.exe	agent_HGVyWIKf.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4308	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_eWuDJJIS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityHealthSystray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_HGVyWIKf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_JjRzVOhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_Wvxnlqss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
5228	agent_HGVyWIKf.exe
5228	agent_HGVyWIKf.exe
5228	agent_HGVyWIKf.exe
5228	agent_HGVyWIKf.exe
2896	agent_Wvxnlqss.exe
2896	agent_Wvxnlqss.exe
2896	agent_Wvxnlqss.exe
2896	agent_Wvxnlqss.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1088	powershell.exe
1088	powershell.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe
1164	dwm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4972	winws.exe
Token: SeBackupPrivilege	4972	winws.exe
Token: SeDebugPrivilege	4972	winws.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	1164	dwm.exe
Token: SeIncreaseQuotaPrivilege	1088	powershell.exe
Token: SeSecurityPrivilege	1088	powershell.exe
Token: SeTakeOwnershipPrivilege	1088	powershell.exe
Token: SeLoadDriverPrivilege	1088	powershell.exe
Token: SeSystemProfilePrivilege	1088	powershell.exe
Token: SeSystemtimePrivilege	1088	powershell.exe
Token: SeProfSingleProcessPrivilege	1088	powershell.exe
Token: SeIncBasePriorityPrivilege	1088	powershell.exe
Token: SeCreatePagefilePrivilege	1088	powershell.exe
Token: SeBackupPrivilege	1088	powershell.exe
Token: SeRestorePrivilege	1088	powershell.exe
Token: SeShutdownPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeSystemEnvironmentPrivilege	1088	powershell.exe
Token: SeRemoteShutdownPrivilege	1088	powershell.exe
Token: SeUndockPrivilege	1088	powershell.exe
Token: SeManageVolumePrivilege	1088	powershell.exe
Token: 33	1088	powershell.exe
Token: 34	1088	powershell.exe
Token: 35	1088	powershell.exe
Token: 36	1088	powershell.exe
Token: SeIncreaseQuotaPrivilege	1088	powershell.exe
Token: SeSecurityPrivilege	1088	powershell.exe
Token: SeTakeOwnershipPrivilege	1088	powershell.exe
Token: SeLoadDriverPrivilege	1088	powershell.exe
Token: SeSystemProfilePrivilege	1088	powershell.exe
Token: SeSystemtimePrivilege	1088	powershell.exe
Token: SeProfSingleProcessPrivilege	1088	powershell.exe
Token: SeIncBasePriorityPrivilege	1088	powershell.exe
Token: SeCreatePagefilePrivilege	1088	powershell.exe
Token: SeBackupPrivilege	1088	powershell.exe
Token: SeRestorePrivilege	1088	powershell.exe
Token: SeShutdownPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeSystemEnvironmentPrivilege	1088	powershell.exe
Token: SeRemoteShutdownPrivilege	1088	powershell.exe
Token: SeUndockPrivilege	1088	powershell.exe
Token: SeManageVolumePrivilege	1088	powershell.exe
Token: 33	1088	powershell.exe
Token: 34	1088	powershell.exe
Token: 35	1088	powershell.exe
Token: 36	1088	powershell.exe
Token: SeIncreaseQuotaPrivilege	1088	powershell.exe
Token: SeSecurityPrivilege	1088	powershell.exe
Token: SeTakeOwnershipPrivilege	1088	powershell.exe
Token: SeLoadDriverPrivilege	1088	powershell.exe
Token: SeSystemProfilePrivilege	1088	powershell.exe
Token: SeSystemtimePrivilege	1088	powershell.exe
Token: SeProfSingleProcessPrivilege	1088	powershell.exe
Token: SeIncBasePriorityPrivilege	1088	powershell.exe
Token: SeCreatePagefilePrivilege	1088	powershell.exe
Token: SeBackupPrivilege	1088	powershell.exe
Token: SeRestorePrivilege	1088	powershell.exe
Token: SeShutdownPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeSystemEnvironmentPrivilege	1088	powershell.exe
Token: SeRemoteShutdownPrivilege	1088	powershell.exe
Token: SeUndockPrivilege	1088	powershell.exe
Token: SeManageVolumePrivilege	1088	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 1260	4308	cmd.exe	90
PID 4308 wrote to memory of 1180	4308	cmd.exe	91
PID 4308 wrote to memory of 5208	4308	cmd.exe	92
PID 5208 wrote to memory of 5228	5208	Setup-TaasfKQdEtTesVxb.exe	93
PID 4308 wrote to memory of 2636	4308	cmd.exe	94
PID 4308 wrote to memory of 4824	4308	cmd.exe	95
PID 4824 wrote to memory of 4596	4824	Setup-TaasfKQdEtTesVxb.exe	96
PID 4308 wrote to memory of 4896	4308	cmd.exe	98
PID 4308 wrote to memory of 2492	4308	cmd.exe	99
PID 2492 wrote to memory of 1984	2492	Setup-TaasfKQdEtTesVxb.exe	100
PID 4308 wrote to memory of 3080	4308	cmd.exe	102
PID 4308 wrote to memory of 5892	4308	cmd.exe	103
PID 4308 wrote to memory of 4972	4308	cmd.exe	104
PID 5228 wrote to memory of 2960	5228	agent_HGVyWIKf.exe	106
PID 5892 wrote to memory of 2896	5892	Setup-TaasfKQdEtTesVxb.exe	107
PID 2896 wrote to memory of 1164	2896	agent_Wvxnlqss.exe	108
PID 1164 wrote to memory of 1088	1164	dwm.exe	109
PID 1164 wrote to memory of 936	1164	dwm.exe	111
PID 1088 wrote to memory of 3068	1088	powershell.exe	114

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT8).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1260
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Users\Admin\AppData\Roaming\OptimizeStop\agent_HGVyWIKf.exe
    C:\Users\Admin\AppData\Roaming\OptimizeStop\agent_HGVyWIKf.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5228
  - - C:\Program Files (x86)\Microsoft.NET\SecurityHealthSystray.exe
      "C:\Program Files (x86)\Microsoft.NET\SecurityHealthSystray.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2960
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Roaming\MeasureMount\agent_JjRzVOhi.exe
    C:\Users\Admin\AppData\Roaming\MeasureMount\agent_JjRzVOhi.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4596
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4896
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Roaming\DisableWait\agent_eWuDJJIS.exe
    C:\Users\Admin\AppData\Roaming\DisableWait\agent_eWuDJJIS.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1984
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3080
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Users\Admin\AppData\Roaming\Sun\agent_Wvxnlqss.exe
    C:\Users\Admin\AppData\Roaming\Sun\agent_Wvxnlqss.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Program Files (x86)\Internet Explorer\dwm.exe
      "C:\Program Files (x86)\Internet Explorer\dwm.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1164
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:936
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fake-tls-mod=none --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=2 --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 8856e94978504a35e4a818719aeb20abfa455999751773ea8a565f9d4b578cc7
MD5 656227de8bb25a652a6cc39105050dd0
SHA1 42f708c09d91ef63f4ed259cd3a65ee3a1065aef
SHA512 54c270a77e7b2a09e65e0c3267702e52ab804a61ec54e1074a6e47e0dbd26c4f6dfeccb4d8ca9d4822d0f878ebcdd76e087adc1dbf675ed159bad2f37982ebab
SSDEEP 384:bGDFzrbpZNa/sJUm6fZUCMIFA5ILbmlaEue/fC0N0qdAmE6NVMI6+:bGD15joUwK50bmYaXmqjE6NS3+
TLSH
T11492E091F9EB92D92CB5D2664802F0C423F9A7D44796FFCF1209E2122629F1E35D99E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 6.1MB
SHA256 e55433c83ace4bb2621658d931f48fe9bac749506f743057d0a96fd1b96740e1
MD5 0d0b7e2669b959b39141b644d7796fb4
SHA1 d9537a1d4b264eed525e0dd1c35a193f186772b1
SHA512 24a854ee1b188c22e04a42fa03469fa5a5972420e00b035e00cb885a26dfbd208a44c1433906938efb7e7f1dab2ebc9b487cedd4e606219af9c62ea3ebe55037
SSDEEP 49152:28EPyTfwpHneao+6CP8WaSghxhdm727DJi5y3SkSIIGo0subUVLhmXTjdzLooMjZ:S
TLSH
T191562331DF1FED2E3669BB2CE05B2EA61F7B2917D558F0CDDA1480A612E9600CD4B874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 9f42f916a4d813732a368df6dcf078e054bcafa8787fb3f467d6a55e5d35e20d
MD5 a65f27a7286c5f0e8a87466b5a15f112
SHA1 d9535b1126f34c9e5445a6336a806c8e3213b22a
SHA512 429ba832e40b6e4248d0a4162a15c01ef65da8d400285d5bc82dd8e3bed54cb48a2ac24f069859c3dff8f94defe9cdb8e2037d269c021c3a7f9509b53fd50991
SSDEEP 384:vvwEj2kt/Hs7KIxVsv4YcA8mtj6UeTq2nbJy2ryU9zvQr681+:vj/gKzZ6UelbJy2ryU9DQr6m+
TLSH
T12992E7394AAB687835AC7D1625130E1E2DCC260B2279035FA7C470FD37AEDF98E18935
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 11.8MB
SHA256 e6259c2b960113e7a96bdfaf7f19cba7d09d91034694a9d9be9017a017c49434
MD5 4deca138c76e308c661d9c64e316d663
SHA1 6a254d9ae7fd9320894f79ac6070452e7a0dfdac
SHA512 77077a82654a55c7bb04599ab3623165da367e1d6efe389b269e5eaea201579a5314dc1d7eb2d5e90c8b5a73a9a05dbadc075ba2403cd87346550954bc25cd59
SSDEEP 49152:bhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxu:V
TLSH
T1F0C6D0330243FDED2F6A5D88D0043A415D9D7A1B62A4D299FF8D34BA62EE524DE3C874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 9.9MB
SHA256 64ba82d4c4b67a051263b1e92fa6e12588c0dcf0bc9ba20ef96ced0920ee55ec
MD5 2180c3e30bbbe98048ab88f6fd8b6921
SHA1 22c631874a1e4f26183994be783ed80fdf5733a3
SHA512 44782d0d74287223a32d512bcd1302d6ad5c056756228e8e6bea7f6831d56ee26d0f5fe89944f8439a8669f39dea4f553d012b48e07f4f479345610a8a973a2b
SSDEEP 49152:OrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+6CP8WaSghxhdm727DJi5y3E:F
TLSH
T14BA6F1331603FDDA2FA95D45D00439812C5C796B52E4E2E4FF4E75AB61EA620EE3D8B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 693cc3a41d7f672f566504d1b97da852fab775e7d04c2c8d4bb92d7c62faa04c
MD5 68dc9a041895253997348b7b5dff7cc6
SHA1 ab0c14a1dce2be1cf96804758e2a201712bf5a8d
SHA512 11d6bf032b88ac3230549dfe39692d23d7846eca4aa707bacc2dd3968fcef5a52ff87ac67d6a122a5c1989a2feb6ac1af7c6f243cca82c9ec82518f5a5027cd0
SSDEEP 384:4WNvr6KjTVtSl5FH31B0Y5wbzArMwIAHmhFAKwqEHQ8J5Ma9zRbj:4+e0TV4TFH31B2krfjmhFAKiHQ8J5MaH
TLSH
T1B99286335A723D201FEAA4243558B1A9D30DB69570F3C2D5EE0A7D66FAF903943B1938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 d8eccfe1ae6ec6e4a7f865688fe1760856033db69e133417e03679e60859c79e
MD5 47715b1ddc196dbb2f50b7a3bb7d9366
SHA1 e4bede47168a0bd15dbfb2cd4c144c2eb2518819
SHA512 f87aa4dab947035b1b77b568e1e2206babe7ca2e71826dda6250d11afff37d701f81f50227719aa866d43483452524d997707ec963dd92aa3174b4d29462584b
SSDEEP 768:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZGl9+e:lV9utQVN65vt6j6Uam
TLSH
T11DB24C304FE328BD399C7C5175205DEC6D6C2F8B1465030A97C978FAA2985BC8E29C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_HGVyWIKf.exe

Path C:\Users\Admin\AppData\Roaming\OptimizeStop\agent_HGVyWIKf.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-10988-0x0000000005A60000-0x0000000005A82000-memory.dmp

Download

memory/1088-11005-0x0000000007CC0000-0x0000000007CE0000-memory.dmp

Download

memory/1088-11012-0x00000000090A0000-0x000000000965A000-memory.dmp

Download

memory/1088-11011-0x0000000008330000-0x0000000008352000-memory.dmp

Download

memory/1088-10986-0x0000000003000000-0x0000000003036000-memory.dmp

Download

memory/1088-10987-0x0000000005C00000-0x000000000624A000-memory.dmp

Download

memory/1088-11010-0x0000000007F30000-0x0000000007FC6000-memory.dmp

Download

memory/1088-10990-0x0000000005B80000-0x0000000005BE6000-memory.dmp

Download

memory/1088-10989-0x0000000005B10000-0x0000000005B76000-memory.dmp

Download

memory/1088-10993-0x00000000062D0000-0x000000000662B000-memory.dmp

Download

memory/1088-10997-0x00000000056D0000-0x00000000056EE000-memory.dmp

Download

memory/1088-10998-0x0000000006DA0000-0x0000000006DEC000-memory.dmp

Download

memory/1088-10999-0x0000000006E00000-0x0000000006E48000-memory.dmp

Download

memory/1088-11000-0x0000000007C80000-0x0000000007CB6000-memory.dmp

Download

memory/1088-11001-0x00000000703B0000-0x00000000703FC000-memory.dmp

Download

memory/1088-11006-0x0000000007CE0000-0x0000000007D83000-memory.dmp

Download

memory/1088-11009-0x0000000007E80000-0x0000000007E8A000-memory.dmp

Download

memory/1088-11002-0x0000000070750000-0x0000000070AAB000-memory.dmp

Download

memory/1088-11007-0x0000000008460000-0x0000000008ADC000-memory.dmp

Download

memory/1088-11008-0x0000000007E20000-0x0000000007E3A000-memory.dmp

Download

memory/4972-10960-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4972-10959-0x00007FFE8BE10000-0x00007FFE8C112000-memory.dmp

Download

memory/4972-10963-0x00007FFE8BE10000-0x00007FFE8C112000-memory.dmp

Download

memory/4972-10961-0x0000000062800000-0x0000000062813000-memory.dmp

Download