darksiderat | 304f1e07e2ae215c879ab68e8b7407142c2c0ef112c5f93f73fb4e5b9f8f9db6

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 8.4MB
Sample260803-ffdsjscb87
SHA256 304f1e07e2ae215c879ab68e8b7407142c2c0ef112c5f93f73fb4e5b9f8f9db6
MD5 aec6232155a51b6d0d4d2316cb0de6ae
SHA1 6fa674d13d99da07ebf2e556e4f03280d15bf9e4
SHA512 d90a6dd8da39308a21abe0ab956ece4bab1a161e3e7e80d1d7ac5970a7e628df4316767883b2e723c15f65ce6f5017efa57237239ca303e865282ef26583e0bd
SSDEEP 98304:jWwhZo+ylyfwQWcJ3lr+hkFSPQ8+8V80/j7xqpUP:awhZo+ylyfwQWcJ3lr+h4mlzwOP
TLSH
T15796E5257B5F996CD09BC474824B8A66492030DB0B39A9FF4484963C2F7EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/2108-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2108-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/files/0x000c00000001c5d3-261.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe

Executes dropped EXE 1 IoCs

pid	Process
4420	ox_1785732543697.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4272 set thread context of 2108	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe	89

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_118359563\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_903874835\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_903874835\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_118359563\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_903874835\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_118359563\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4112_679056244\passwords.txt	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4652	msedgewebview2.exe
4652	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4112	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2108	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe	89
PID 4272 wrote to memory of 2108	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe	89
PID 4272 wrote to memory of 2108	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe	89
PID 4272 wrote to memory of 2108	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe	89
PID 4272 wrote to memory of 2108	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe	89
PID 4272 wrote to memory of 2108	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe	89
PID 4272 wrote to memory of 2108	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe	89
PID 4272 wrote to memory of 4112	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe	90
PID 4112 wrote to memory of 1840	4112	msedgewebview2.exe	91
PID 4112 wrote to memory of 700	4112	msedgewebview2.exe	92
PID 4112 wrote to memory of 700	4112	msedgewebview2.exe	92
PID 4112 wrote to memory of 700	4112	msedgewebview2.exe	92
PID 4112 wrote to memory of 700	4112	msedgewebview2.exe	92
PID 4112 wrote to memory of 3556	4112	msedgewebview2.exe	93
PID 4112 wrote to memory of 4496	4112	msedgewebview2.exe	94
PID 4112 wrote to memory of 4496	4112	msedgewebview2.exe	94
PID 4112 wrote to memory of 4496	4112	msedgewebview2.exe	94
PID 4112 wrote to memory of 988	4112	msedgewebview2.exe	95
PID 4112 wrote to memory of 988	4112	msedgewebview2.exe	95
PID 4112 wrote to memory of 988	4112	msedgewebview2.exe	95
PID 4112 wrote to memory of 988	4112	msedgewebview2.exe	95
PID 4112 wrote to memory of 988	4112	msedgewebview2.exe	95
PID 4272 wrote to memory of 4784	4272	2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe	97
PID 4784 wrote to memory of 4420	4784	cmd.exe	99
PID 4112 wrote to memory of 1508	4112	msedgewebview2.exe	105
PID 4112 wrote to memory of 1508	4112	msedgewebview2.exe	105
PID 4112 wrote to memory of 1508	4112	msedgewebview2.exe	105
PID 4112 wrote to memory of 5284	4112	msedgewebview2.exe	106
PID 4112 wrote to memory of 5284	4112	msedgewebview2.exe	106
PID 4112 wrote to memory of 5284	4112	msedgewebview2.exe	106
PID 4112 wrote to memory of 4652	4112	msedgewebview2.exe	107
PID 4112 wrote to memory of 4108	4112	msedgewebview2.exe	108
PID 4112 wrote to memory of 4108	4112	msedgewebview2.exe	108
PID 4112 wrote to memory of 4108	4112	msedgewebview2.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe"
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4272.5116.13819950555190480918 /pfhostedapp:b6ef3f07c9c482228486403ca9f8a3361bcd9fbd
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView /prefetch:4 /pfhostedapp:b6ef3f07c9c482228486403ca9f8a3361bcd9fbd --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffab4d45fd8,0x7ffab4d45fe4,0x7ffab4d45ff0
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView" --webview-exe-name=2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1872 --field-trial-handle=1876,i,11294905895331993883,7169220916614213,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b6ef3f07c9c482228486403ca9f8a3361bcd9fbd
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView" --webview-exe-name=2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1876,i,11294905895331993883,7169220916614213,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b6ef3f07c9c482228486403ca9f8a3361bcd9fbd
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView" --webview-exe-name=2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1876,i,11294905895331993883,7169220916614213,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b6ef3f07c9c482228486403ca9f8a3361bcd9fbd
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView" --webview-exe-name=2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2868 --field-trial-handle=1876,i,11294905895331993883,7169220916614213,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b6ef3f07c9c482228486403ca9f8a3361bcd9fbd /prefetch:1
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView" --webview-exe-name=2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=1876,i,11294905895331993883,7169220916614213,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b6ef3f07c9c482228486403ca9f8a3361bcd9fbd
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView" --webview-exe-name=2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2196 --field-trial-handle=1876,i,11294905895331993883,7169220916614213,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b6ef3f07c9c482228486403ca9f8a3361bcd9fbd
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView" --webview-exe-name=2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4624 --field-trial-handle=1876,i,11294905895331993883,7169220916614213,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b6ef3f07c9c482228486403ca9f8a3361bcd9fbd
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView" --webview-exe-name=2026-08-03_aec6232155a51b6d0d4d2316cb0de6ae_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1052 --field-trial-handle=1876,i,11294905895331993883,7169220916614213,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b6ef3f07c9c482228486403ca9f8a3361bcd9fbd
    3⤵
    PID:4108
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1785732543697.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\ox_1785732543697.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1785732543697.exe
    3⤵
    - Executes dropped EXE
    PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ox_1785732543697.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1785732543697.exe
Size 67KB
SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
MD5 32b268f7114cd6816d3b1c0558e88f95
SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
TLSH
T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 14c645ffb730e363978fb3b4d578b35ca2336b918109b7d7210628bbaf128596
MD5 8414cb067e006f8888819cfb2fbe445d
SHA1 abb18a4b0a2da9b7e44bb5c9cca272db465d63bb
SHA512 4b77c33ef3811c5b6fa3a638b355d085993956826a75eeefa024fe1bd3e3d62b97fd63735a333fb1470afcd0d167ba6ebc083dfdf1ca459522635408dbec6393
TLSH
T1B0D0121336050534C010203325026A0C2900C91B42C740006428975D1A04854291A483
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5607d702e6486a4b0b36d53aa0c8e6d0015c6923bf535d9f1e4331ba1ea71b03
MD5 2d70ca623a43c56632f2b6e1516237d1
SHA1 06676f299aeb6bd060c70233b498fdd9fc396477
SHA512 14988f5398ce729226bda81977d432eb338165f338441bfe91d1550d4c92994284bcd161ba85a2f1d069cbbc1e1a1705f9a96720c7305491c95a591a6160dbdf
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 d6f3e7237474a465c856671a29d5ccdd87157466cae8962928a5dcd3a957b01d
MD5 570220ca2c8b2065aa5f0a742845d141
SHA1 e5af2253e8f1cdb7b03bc8ec1c8da3f6d4a40f7a
SHA512 485b32389918ed0fe732d60f20f7053c425773c7420155e2017075e43d00d1e1e6abe150efab2957eb4591ecf8772968c50ab0a0c443cd19c9f7819d4ca35cf0
TLSH
T133B01203DC714410CB8481B251C2704C30368420038F59C383E2017344113BC3240304
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 b158219b92c3fe3c60bf3018040937c30689efe0da06e12c7bd0842830939933
MD5 1a3613ebf667f8489a4c2aa7f6af8ae0
SHA1 77cf8fe6ef28a770a8026cb0f0ec956e4fa6bcd2
SHA512 5208271e6241b27ca28370dfc585396ab4da535a9add74256918c39d01275ad8e431de645d1cc82b774c83759ba1c56184f4243eb1cc861d557d222e4ca0224d
TLSH
T1FCC02B13CC30A000CF0040B78DC5645CF83758805B0F4EE38663107204153AF33E030B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595eb0.TMP

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe595eb0.TMP
Size 48B
SHA256 c98bd49c45ff01eb5d03f1048cfe4d8e487bcefa188b5cb66ec4b740ae305f94
MD5 efc9a74c67fe4ade2b9770663a493482
SHA1 2d07f2bed7de3902b5c88f3b667f6583658b8254
SHA512 8ca3fd337efa4a0473df8c8b8f7d449391689f0126df951109673bde8eff67a0a28d2020575be7cf7dabc6ba36e5b27e7b2034db54e3c06fa435bd6880e1b9c7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 9342b6ec40e0e2f68b7ed5a0bec157f5e1c2e00508f38b245cadaff25d17730c
MD5 457657e656e5093af54567ad6023d071
SHA1 3006360eaf847977e1845fb4e3f245a8cd2ab1be
SHA512 f10613c106a0b7d82903c830ecbaa8f686489ce1494de3e667ee5ef800dcf80cfe76955dd3e384cc5455d921bf350e371113a188125bdd36b59edcc12fe82a0a
TLSH
T1AD314DA6C3E4C66D894126E427347D17C92E0519A2283D36CDDAFBD567D2071E22164B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a2135.TMP

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Network\Network Persistent State~RFe5a2135.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Network\TransportSecurity
Size 858B
SHA256 28a2b8d3daafc29f2f3dc31c86d21c00dd8f11e25256e3828909463d6589d8db
MD5 53fb56414eb72268fc290613d89d4ede
SHA1 414e4f5222ac98b6b50cf3b8514adcb0fb8acfec
SHA512 4decdd8daa0de6030610c6bf7cf1839e3fa0aae153491804a9f7c003c28d887c255cedd73fa08062bbac0b7ed6a4cb6cfed8261b6429afeec9a63e2386c258ac
TLSH
T112116BE3467EF437106C29672E447C452ABDF03523967CE8EB96812DB090AF35B1A433
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe598a83.TMP

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Network\TransportSecurity~RFe598a83.TMP
Size 691B
SHA256 3f98b70ad6c07c12ca10fa1d44fde3a16fd72ed1b12d34c0076572818ae4f015
MD5 a6d8bc0e3191a71b0c77257c543f48c0
SHA1 d327ee8be8abb8f85832fcdaccd5ffa0db3c2081
SHA512 5c6ef0033c8c7ddc59511d7d5d81789291f31f51ddbc772ea5ecdfc4b5aee89da84964de2fc71ad12b804d923fbb29711349ee81b4aea2edd4c05c321ba44e36
TLSH
T129019EE3417BF477506C29672E447C492ABDF13523A67CF8EB96412D70909F35716423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Preferences
Size 6KB
SHA256 1bfe3b6849130eaec56fb0233aaef560bc737538ba683041d6dd2e3f8330bf75
MD5 16ee07b10535706bd070732ab0b1ff8a
SHA1 2e27046c4331a676a6f5d70e85746b44eb361c9e
SHA512 5694e0519d7f263539eeb129bca3f07ddf844f701b612bbb11a77b38a09106c8b4af0ef2fa1cbca3db9703fe71069e2f5e476d08f56243064926a3f36a9351c6
SSDEEP 96:stl/dsDDAb9ckmo5h16Z06s7/x+6MhmuecJe91ejezUK+gq28XM1C7K:stZ6ZVon6sV+Fde9Qj0H8G6K
TLSH
T158D1C6115E64B97B8CC6F119BA39BB07E2F9507264D51D58E7F8862C04DB6CC6307E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Preferences
Size 6KB
SHA256 0a553d8bc54e205413da31e4e32133de0072af16e5a133c55ed8602217f91a9d
MD5 05bc45c6acf4db671897332162fd728a
SHA1 a4f2b2a39de92573a38cc14f52cedb930eb57b8c
SHA512 a599942dc33ff1227a95b8dec50d8ad4083bb8819792bb073ec5130a32c99fc43dfc2663da5209df9dbfe19309d4b261dab2bf7db8175ee6c77d56a914b49d20
SSDEEP 96:stl/dsDiGAb9ckmo5h16Z06s7/x+6MhmuecJe91ejezUK+g/28XM1C7K:stZ6DVon6sV+Fde9Qj0HFG6K
TLSH
T192D1B5125E64B87B8CC7E119BA39BB07E2F9507264D51E58E7F8862C04DB6CC6307A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5995dd.TMP

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Preferences~RFe5995dd.TMP
Size 5KB
SHA256 d8520c15053516cbe82f99dd2ff83bafe1e069c42953a9aa387c10b043e6606a
MD5 5daad24958386a1224a37979ebac6106
SHA1 bb48fef5ad9aea3395a4ba17e9cbb67d83ec3aab
SHA512 3d960cae957e726483698bf9dd21f64e8104295b857bafab8df812140a5e57073cadf6bf492d3fa063b47f5ace05f0fb4a970c8667d4a63b99c5641926489cc2
SSDEEP 96:rl/dsDDAb9ck4do616Z06s7/x+6MhmuecJe91ejezUK+gcD28XM1C7K:rZ6Zzo66sV+Fde9Qj0HeG6K
TLSH
T1D1C1C6025E64B97B8CC6E118BA397B07D2F9507265D52D58E7F8867C04DB6CC630BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Local State
Size 2KB
SHA256 7faca3b427aaac29c424d2342fe4b2f41d77ccb23902795ffdec85b152b845ac
MD5 8a93e0be77cf5de65942a5039c5bc8a9
SHA1 fe7dd34623dc6704229a0be54edfd2c6b2e39e60
SHA512 cb18aa21bee2b81e8f17faef7d227777f537b607616c9f22264264cf60cc3c7c7e9bcfef823dbb19dc697dbedecfb7b0789d2b667f1a8c29832000ce11c61122
TLSH
T10951A873A811AB77C9E28704B94F3F17CE7951A6E9821F6095DD1B1C01D758D6301C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Local State
Size 3KB
SHA256 6a1abd00b1b11a21d449ba7401ed4f59cb4494624f52741a7f8789bebc9888ad
MD5 3109d8bce1544a5502f254152a4f0169
SHA1 da12f0367bbe3ce4835195d2a0dad90ce85ea462
SHA512 aadd11501a851108687feec10b0000de68aacf1a54bb3597654a1946bb4bd0eb93c0ef0ccdac1fb2b570fb5335c5a5677a0af5f9a9bc5c9a53d377d4d22b940a
TLSH
T13C619537A971AA778DE2DA04B88A3B1AABB55127E9C13FA4D5EC1F1D01D72C81302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Local State
Size 3KB
SHA256 b544427aed32047402f56134d22f6e63ce9b3db706d19325624a761dfa57375b
MD5 5758dcd3c1a8937b62dfc9678aadbe76
SHA1 fbd87b4c1b193ccf6a4807f002dbe5a3b6447457
SHA512 852185456615983130b92705eea62b4fa77bed897ae6c3fae8be7a7f9c8f9371d9d784bdd933da91ae794a650f49e9bf68f1aeab0012f75e3e610704b9606faf
TLSH
T1F3717332A4B0A9678DF2DA05B88A3B07ABB45063E8C56FA8D5EC0F1D02D72C91302916
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Local State
Size 15KB
SHA256 ec6962f9f91205015a3177a45fef918cf33400d1bd8d821ffc0a5713b2ee59a0
MD5 62683be4350addabc006bf85a1d88419
SHA1 c87363b59c84fc18f8051003f4c2f2e15fa7be73
SHA512 1023fe02a9997605cc8edb389e5d55d6cc99da06d149a09251ccb2db9303df7b9706339c98c55c6fb2e4f9bb9552c9c769f70783507c279b3e52b57affd44c4e
SSDEEP 384:f+aQikB+z/xvxjg/qhEwNBSiEZGIxrLAVdpi69ze:u/UxvxjgC+T0MrLUVFe
TLSH
T17572AE2B94697E23A5F3FA05795D5B4FCBB894B294C16DB849ADAF0E02C72C81302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590c6a.TMP

Path C:\Users\Admin\AppData\Local\com.sodalol.app\EBWebView\Local State~RFe590c6a.TMP
Size 1KB
SHA256 3c63bc74a5a5f6e36ebc4ef30ccdd7c711819b36f972ae86e4d394b05998a1e3
MD5 91932f4c9f60f0158ead9f81e5a83f94
SHA1 9fa64e7bb1006cc91b9daf5b22114e282b999be1
SHA512 1f2b02174fc31c74e9ef17b63f79946b5159afc0aa4902fce513d090daadb6beeed6f66430aea2601e4a493d9ecbe17e9b28a7b036df5fd22e6db0e71ce80197
TLSH
T1612184B3D0A15FB3DC81574A715F7A9F9E7020ABD5418F1461DE472D02E218DD616D32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-31-0x00007FFAD6990000-0x00007FFAD6991000-memory.dmp

Download

memory/988-106-0x00007FFAD6990000-0x00007FFAD6991000-memory.dmp

Download

memory/1508-322-0x00007FFAD57C0000-0x00007FFAD57C1000-memory.dmp

Download

memory/1508-321-0x00007FFAD6B80000-0x00007FFAD6B81000-memory.dmp

Download

memory/2108-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2108-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4272-206-0x0000000140000000-0x0000000140875000-memory.dmp

Download

memory/4272-0-0x0000000140000000-0x0000000140875000-memory.dmp

Download

memory/4652-397-0x000001EDC9370000-0x000001EDC9371000-memory.dmp

Download

memory/4652-388-0x000001EDC9370000-0x000001EDC9371000-memory.dmp

Download

memory/4652-396-0x000001EDC9370000-0x000001EDC9371000-memory.dmp

Download

memory/4652-395-0x000001EDC9370000-0x000001EDC9371000-memory.dmp

Download

memory/4652-394-0x000001EDC9370000-0x000001EDC9371000-memory.dmp

Download

memory/4652-393-0x000001EDC9370000-0x000001EDC9371000-memory.dmp

Download

memory/4652-392-0x000001EDC9370000-0x000001EDC9371000-memory.dmp

Download

memory/4652-386-0x000001EDC9370000-0x000001EDC9371000-memory.dmp

Download