salatstealer | c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.9.9d/general (ALT).bat
Size 3KB
Sample260730-w44lwavemb
SHA256 c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc
MD5 cadb63e600829d6d26aaac973d55d89d
SHA1 c737ce586f9c4cc9d68abc62ed9a149f68d5b4c6
SHA512 f9cfbb955e914dd9e1dfdf75d7cca4973bcf81e1dbeebb833e8e247cfea88b571878c8e80a638021234a1034e74ff9451c060c85b03a95d91d488011ef297738
TLSH
T194715DA7E00CDE47F5CDA53EF85FA6A420279C8329D6D452835B89F8CC4EDBD684E484
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral8/files/0x0009000000024362-4944.dat	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
56	2352	powershell.exe
57	2352	powershell.exe
58	2352	powershell.exe
59	2352	powershell.exe
60	2352	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2380	Setup-TaasfKQdEtTesVxb.exe
2096	agent_DnvVoGmF.exe
4356	Setup-TaasfKQdEtTesVxb.exe
5032	agent_dDuiIRRp.exe
4952	Setup-TaasfKQdEtTesVxb.exe
3856	winlogon.exe
4620	agent_NVfLmBvs.exe
1292	Setup-TaasfKQdEtTesVxb.exe
2764	agent_TQrRczIl.exe
2640	winlogon.exe
4288	winlogon.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4576	certutil.exe
2328	certutil.exe
2932	certutil.exe
4312	certutil.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\27298a85-31c1-eeba-011f-bd1d10ae8531	agent_DnvVoGmF.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\services.exe	agent_DnvVoGmF.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\27298a85-31c1-eeba-011f-bd1d10ae8531	agent_DnvVoGmF.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\winlogon.exe	agent_DnvVoGmF.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe	winlogon.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\winlogon.exe	winlogon.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
544	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_DnvVoGmF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_dDuiIRRp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_TQrRczIl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent_NVfLmBvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2096	agent_DnvVoGmF.exe
2096	agent_DnvVoGmF.exe
2096	agent_DnvVoGmF.exe
2096	agent_DnvVoGmF.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
2352	powershell.exe
3856	winlogon.exe
3856	winlogon.exe
2352	powershell.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe
3856	winlogon.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4316	winws.exe
Token: SeBackupPrivilege	4316	winws.exe
Token: SeDebugPrivilege	4316	winws.exe
Token: SeDebugPrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2052	544	cmd.exe	85
PID 544 wrote to memory of 4576	544	cmd.exe	87
PID 544 wrote to memory of 2380	544	cmd.exe	88
PID 2380 wrote to memory of 2096	2380	Setup-TaasfKQdEtTesVxb.exe	91
PID 544 wrote to memory of 2328	544	cmd.exe	93
PID 544 wrote to memory of 4356	544	cmd.exe	94
PID 4356 wrote to memory of 5032	4356	Setup-TaasfKQdEtTesVxb.exe	95
PID 544 wrote to memory of 2932	544	cmd.exe	99
PID 544 wrote to memory of 4952	544	cmd.exe	100
PID 2096 wrote to memory of 3856	2096	agent_DnvVoGmF.exe	103
PID 4952 wrote to memory of 4620	4952	Setup-TaasfKQdEtTesVxb.exe	105
PID 544 wrote to memory of 4312	544	cmd.exe	108
PID 544 wrote to memory of 1292	544	cmd.exe	109
PID 544 wrote to memory of 4316	544	cmd.exe	110
PID 1292 wrote to memory of 2764	1292	Setup-TaasfKQdEtTesVxb.exe	115
PID 3856 wrote to memory of 2352	3856	winlogon.exe	116
PID 3856 wrote to memory of 2640	3856	winlogon.exe	118
PID 3856 wrote to memory of 4288	3856	winlogon.exe	120
PID 2352 wrote to memory of 2328	2352	powershell.exe	123

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\general (ALT).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2052
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Users\Admin\AppData\Roaming\SyncRemove\agent_DnvVoGmF.exe
    C:\Users\Admin\AppData\Roaming\SyncRemove\agent_DnvVoGmF.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Program Files (x86)\Windows Sidebar\winlogon.exe
      "C:\Program Files (x86)\Windows Sidebar\winlogon.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3856
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2352
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2640
    - - C:\Program Files\Google\Chrome\Application\winlogon.exe
        
        "C:\Program Files\Google\Chrome\Application\winlogon.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4288
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2328
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Users\Admin\AppData\Roaming\Sun\agent_dDuiIRRp.exe
    C:\Users\Admin\AppData\Roaming\Sun\agent_dDuiIRRp.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5032
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Users\Admin\AppData\Roaming\SyncRemove\agent_NVfLmBvs.exe
    C:\Users\Admin\AppData\Roaming\SyncRemove\agent_NVfLmBvs.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4620
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp" "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4312
- C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Users\Admin\AppData\Roaming\ImportUnblock\agent_TQrRczIl.exe
    C:\Users\Admin\AppData\Roaming\ImportUnblock\agent_TQrRczIl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2764
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.9.9d\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n3
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup-TaasfKQdEtTesVxb.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.exe
Size 11.2MB
SHA256 a9d389962576cbeabc56d02907088e2c340e68c36bc3fd0634365dcee51508c7
MD5 f748f66c76cc83496a8961bbe7cc3ea2
SHA1 d6a182056085177c365ec17937932844b1be8023
SHA512 4a3e60177b2cf9e0352e8f9dba0396273c7d1c2a3a8d74e8ee493bbbb576ddda85ca045f05a54210353093ddfb56a901519075ee983e3cf96143f99a4816555d
SSDEEP 98304:TgomJ0WkhiVm0EKMvF+NhyQw3jcLfR4CcpBHapnVlPXUNi6gXuH15wszI7tIB4Cj:ToKW+KMvcfcH6pnVJLfszlBuqqcJ
TLSH
T1DDC6BF03EC5959E9C1AED2318A729162BB717C880B3163D32B50F2393F76BD0AD79758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 15.0MB
SHA256 8677999b4147d6e8d7ecb9707481f43f59a7ca989688eaed8210e507e957c1af
MD5 d2fde098f9b5d9ebcd654c9a339f1dec
SHA1 2e2a10dfb7e064bc6716a4c0a05dbdce930a97fa
SHA512 9747121a02d258dbde0a5f98f8bf06482d7902b82cff83645e0a6514bb54a1b9949227c2e80230ab738cf652ce6e69a36769eb36414ae1b62f814d699e51a6f0
SSDEEP 49152:/2fMK+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQRD:v
TLSH
T12EF6CF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 430a6e344da69c81025b7da7f38f36e48780837f685978fa0d1d01e624beb8dd
MD5 83737ea3da30a4140057311e7a5927f7
SHA1 4c92c12952bf31b115895894799727970a67392a
SHA512 8e3af443385243e773551b60defcddf23a3dee835d4c0b7d88fe85f02400a695bb2c66bd34dd0ac4c02a7bd812ca2856f772ef55aea5bdd7d6459d940d222ef2
SSDEEP 384:lVH9x1M0YqutQse9FKkNKn5BYdAQFNl88uayR2ZxBp6UaMEDEZ/Hopsli:lVH9iqutQsGxN65BsRr8tH6xj6UaMeZP
TLSH
T107926E704AE33CBD3D8C7C5061505DAC5D6C2F8B51650209ABC834FA63E85BC8E6AD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 24KB
SHA256 37bfc8fe26f331275df0d2c59a756603628299cc313a23be46ace5e691140f21
MD5 61ee34473cd8fe4ce71899230cb2f63f
SHA1 70b3af0b6424b1a3b62b186fa07030ff69d807d7
SHA512 40933df473dfbc62cef7dc1b879ed19b01284c00a797374e9477d92f29ccf79c6c461bfee58fed198d514889a7180e07097543cd05925100573d1dc0690e9f62
SSDEEP 384:yQ7tzpfyVps1gOIdnILDyY+1faxPCuC6adl23d043LEK+8xwS4U8DuB0:Btdie1wIofaxquC6afGd0+H7wS45aB0
TLSH
T12CB2F7390EE330BD35AC3D9634715DAE5E2D2F4955B6430A43C831F6A3AD5ECCA26839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 13.4MB
SHA256 8bbe8312923b15b92e4fb966797c1fd8886925c6621cf195369c3beed67cad3c
MD5 89a1becab56cc4b0dd8e31c8f92eb0df
SHA1 5983cc7df8fc1bc5a1e68ba99ad289d9350240f9
SHA512 d8a820a60917a148bf6c84ef8cb5076299060cdb77a696a45a10b94be2cb54de430698ae14f05b11693b6ebb129749d1ee0741da7a68648668407c6b542b1ddd
SSDEEP 49152:5LhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPyTfwpHneao+Z:S
TLSH
T1CCE6CF320243FDBD3FAD3D45E0012D455D9D7A1B62A8D299FB8930BA63E95A4CE2CC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 abe961cf8956d1353d6d207c65596ed21449c3fd6ad1fafbb2db69871fecbbb3
MD5 f816a99b0aae24b7617ee579f2547b88
SHA1 85bae2d2f2767197ea3d04a5ebea4d7972623a61
SHA512 4823881beaf963725ad6c0c59b7ba218f1437d44cf2e5370037699c0e0e6cc835c2fa801f5c056d3a6bc62b8865323cf20f53ba55287046f3429196a0a6fe767
SSDEEP 384:dEnoM2iV17d3z4KkWZh7MGuMgJWWcPs89bi1ODnY0y6wtk/W/y:dEP2iX7dth6WW18bicDryv+/Wq
TLSH
T1B892D0EBB95CD1CE3652170684D771B76E724473B1A8B0C2A940508BA2DAF452DFB4F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 2.4MB
SHA256 9b2c98fdcc74d617022ef24ce958514ec44f6e9e21daf2bedcad94a252b006a6
MD5 4eab1f1c7fc80c964862d4a504e45809
SHA1 53c32e2217600ebe1d2aba8e3e42c5fe1efea9c1
SHA512 d1824abb4aa31cbdd8d34f91e02035855733f50c0ef8776d5b44b2610737569d6326867be9864ad7773b39ed4e27e849ea72df77cd4cb87baa9440737d5f3d39
SSDEEP 24576:UPqjFz8zRlsiUJPPPteldvDmlv5mny2xLTjk8mqnzLoANK4gokXx5OgsSHFLiAbx:UsubUVLhmXTjdzLooMjsMiAAPCCm
TLSH
T14CC51232DE0FEE1E366ABF5CD04629A72F3F292BD5A4E18DDA24C0B611D5204CE5B474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 14.7MB
SHA256 c5005faef155c45c8cd309a0164151c54a1d61075e50d52c7a96b545d69abd1e
MD5 c811b3a07e37ca85ef2bbe4841d24071
SHA1 b4d68a63e6ca1edea8b5c8f349e15732f466883d
SHA512 88bd29abb9e2f5b7f6d35d8d3ef3c5b06c6ffefabf21b3cef5b4ab38ede67fdba02ea002e39f66f5d84af51de890473df72db253b9558e9f98c364362da00cb8
SSDEEP 49152:5K+5stLJr0gPLhmOcuOJplhxnDT7A4e3rVrfRf+oPI92QVbM/i78ANXctFQR8EPb:J
TLSH
T1BBF6BF320657BCBD3FAD3D85E0012D495D5D7A0B12A8934AFB8930BA63ED5A4CE2CD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup-TaasfKQdEtTesVxb.tmp

Path C:\Users\Admin\AppData\Local\Temp\Setup-TaasfKQdEtTesVxb.tmp
Size 20KB
SHA256 8c462aec5f95024b3d98fa8d2b5f504ccb018910a92c63a9ce239bece04cb22c
MD5 64861e9313fb51c201949b87c962b7fa
SHA1 639959c64abb35aa38322a309e59adc00f0cf269
SHA512 83f6e76a617d5eaced012d6d683c8666d59afd1902d1fe2b5797a7b7812fadbe3c1428f459389641e11f539d64a93d21adb789894a2a8a3a9ac7d0e018a5a278
SSDEEP 192:451bB4DmLT/uZQrcHy64bZDh2mIiAas9T9dIIBUcaIj1QgADTyaMKSxD9Ed2w7/r:4zm2uAbEBiArQc+gAPP8EQUe6I9FUL5
TLSH
T1DA925BB50AC3257D39EC7C8231625E2CAD6D1F4F2026024A67C931F977AD1D88F25FA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_c3223i5x.uki.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c3223i5x.uki.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_DnvVoGmF.exe

Path C:\Users\Admin\AppData\Roaming\SyncRemove\agent_DnvVoGmF.exe
Size 12.0MB
SHA256 8e1beeda70d3ac94b2c2fbd2cc3ce6a81388d8571f1f8b6ad4563c62c6571e0d
MD5 1b96f34e6c96f5e6aea9250d8b660d5a
SHA1 85fa8fb43b07fa45bfa90a39b76a573de6941574
SHA512 472db85361d22aa749fe0c93baca568dffb248fc3e4ef7836d5ff5eab73c3fedbcfeb2dd1b2f827f7a04d5fe032d9caa20113af641524b0cfae9c1bd83294edd
SSDEEP 98304:7h2290FF1WCREMbEdyWmQGzQ4tG20CEE9:H9sxEYJWm/sHA9
TLSH
T1AEC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2352-11716-0x0000000007D60000-0x0000000007D92000-memory.dmp

Download

memory/2352-11715-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

Download

memory/2352-11740-0x0000000008E50000-0x00000000093F4000-memory.dmp

Download

memory/2352-11693-0x0000000002ED0000-0x0000000002F06000-memory.dmp

Download

memory/2352-11694-0x0000000005A40000-0x0000000006068000-memory.dmp

Download

memory/2352-11695-0x00000000057F0000-0x0000000005812000-memory.dmp

Download

memory/2352-11739-0x0000000008060000-0x0000000008082000-memory.dmp

Download

memory/2352-11702-0x0000000006070000-0x00000000060D6000-memory.dmp

Download

memory/2352-11701-0x00000000059C0000-0x0000000005A26000-memory.dmp

Download

memory/2352-11704-0x00000000061A0000-0x00000000064F4000-memory.dmp

Download

memory/2352-11706-0x00000000067F0000-0x000000000680E000-memory.dmp

Download

memory/2352-11707-0x0000000006830000-0x000000000687C000-memory.dmp

Download

memory/2352-11712-0x0000000006D60000-0x0000000006DA4000-memory.dmp

Download

memory/2352-11713-0x0000000007920000-0x0000000007996000-memory.dmp

Download

memory/2352-11714-0x0000000008220000-0x000000000889A000-memory.dmp

Download

memory/2352-11734-0x0000000007F60000-0x0000000007F68000-memory.dmp

Download

memory/2352-11718-0x0000000070B60000-0x0000000070EB4000-memory.dmp

Download

memory/2352-11717-0x0000000070790000-0x00000000707DC000-memory.dmp

Download

memory/2352-11726-0x0000000007DA0000-0x0000000007DBE000-memory.dmp

Download

memory/2352-11733-0x0000000008030000-0x000000000804A000-memory.dmp

Download

memory/2352-11727-0x0000000007DC0000-0x0000000007E63000-memory.dmp

Download

memory/2352-11728-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Download

memory/2352-11729-0x0000000007F90000-0x0000000008026000-memory.dmp

Download

memory/2352-11730-0x0000000007EF0000-0x0000000007F01000-memory.dmp

Download

memory/2352-11731-0x0000000007F20000-0x0000000007F2E000-memory.dmp

Download

memory/2352-11732-0x0000000007F30000-0x0000000007F44000-memory.dmp

Download

memory/4316-11680-0x00007FF86F880000-0x00007FF86FB82000-memory.dmp

Download

memory/4316-11684-0x00007FF86F880000-0x00007FF86FB82000-memory.dmp

Download

memory/4316-11681-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/4316-11683-0x0000000062800000-0x0000000062813000-memory.dmp

Download