stealc | 8c5081addc841a01fb8d0a175db452df35dd506d19036229d075f910152135c7

Resubmissions

03/08/2026, 20:54

260803-zpyc4aff5310

02/08/2026, 23:23

260802-3c7yjstcrd10

Analysis

max time kernel
33s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 20:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe
Size 16.2MB
Sample260803-zpyc4aff53
SHA256 8c5081addc841a01fb8d0a175db452df35dd506d19036229d075f910152135c7
MD5 f503a9c311d074521e292218cb4418ef
SHA1 109aad14833afccdaf9f9f2383e6323a3a01c899
SHA512 800c3be602a5aa98aac23e30cc1874496a2e6728aaa98489b0ab81ab51ab5acfd30b52263d3fa359f0038db3d1c4a96e9dd047edc07c147eaddb4ac31d203733
SSDEEP 393216:h6mjiUPsCBN1VWNjf+znYfOBgiKnqbGT6:h61U0CBN1VWN/OFby6
TLSH
T18F07331FB2E3E5F8D4AB54354D864682BB707E702F4F8B470285423EFF09A965E226D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

run discovery downloader stealc svcstealer installer persistence stealer

Malware Config

Extracted

Family

stealc

Botnet

http://196.251.107.163

rc4.plain

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://196.251.107.163/bioxp/post.php

Attributes

build_id
Dropped
srv_delay
1
srv_retry
1

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	2776	4w3cguqx.exe

Executes dropped EXE 18 IoCs

pid	Process
1692	ozjyl889.exe
4776	td5mqfmx.exe
2884	y6wptxud.exe
4572	k3cb5or5.exe
2116	o7ljdlbj.exe
2776	4w3cguqx.exe
1256	k3cb5or5.tmp
4948	TotalExtractor.exe
2496	cryptsvchaj.exe
5780	wlrmdr.exe
3456	o7ljdlbj.exe
3532	fffbbedfdc.exe
2460	y6wptxud.exe
4652	4w3cguqx.exe
4384	taskhost.exe
5624	taskhost.tmp
2860	spoolsv.exe
4600	spoolsv.exe

Loads dropped DLL 2 IoCs

pid	Process
1256	k3cb5or5.tmp
5624	taskhost.tmp

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\fffbbedfdc = "\"C:\\ProgramData\\fffbbedfdc.exe\""	y6wptxud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\o7ljdlbj.exe"	o7ljdlbj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\fffbbedfdc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\y6wptxud.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\fffbbedfdc = "\"C:\\ProgramData\\fffbbedfdc.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\o7ljdlbj.exe"	o7ljdlbj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\spoolsv.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\spoolsv.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\cryptsvchaj.exe"	td5mqfmx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Security Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4w3cguqx.exe"	4w3cguqx.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3168 set thread context of 4868	3168	2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe	89
PID 2116 set thread context of 4392	2116	o7ljdlbj.exe	59
PID 3456 set thread context of 4392	3456	o7ljdlbj.exe	59
PID 2860 set thread context of 4464	2860	spoolsv.exe	60
PID 4600 set thread context of 4464	4600	spoolsv.exe	60

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	4948	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TotalExtractor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhost.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3cb5or5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3cb5or5.tmp

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000c00000001c571-57.dat	innosetup
behavioral2/memory/4572-73-0x0000000000CB0000-0x0000000000DB6000-memory.dmp	innosetup
behavioral2/memory/4572-135-0x0000000000CB0000-0x0000000000DB6000-memory.dmp	innosetup
behavioral2/memory/4384-155-0x0000000000810000-0x0000000000916000-memory.dmp	innosetup
behavioral2/memory/4384-180-0x0000000000810000-0x0000000000916000-memory.dmp	innosetup

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\NotificationData	explorer.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1692	ozjyl889.exe
1692	ozjyl889.exe
2884	y6wptxud.exe
2884	y6wptxud.exe
2116	o7ljdlbj.exe
2116	o7ljdlbj.exe
2116	o7ljdlbj.exe
2116	o7ljdlbj.exe
3456	o7ljdlbj.exe
3456	o7ljdlbj.exe
3456	o7ljdlbj.exe
3456	o7ljdlbj.exe
2860	spoolsv.exe
2860	spoolsv.exe
2860	spoolsv.exe
2860	spoolsv.exe
4600	spoolsv.exe
4600	spoolsv.exe
4600	spoolsv.exe
4600	spoolsv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2176	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe
Token: SeShutdownPrivilege	2176	explorer.exe
Token: SeCreatePagefilePrivilege	2176	explorer.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 4868	3168	2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe	89
PID 3168 wrote to memory of 4868	3168	2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe	89
PID 3168 wrote to memory of 1692	3168	2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe	90
PID 3168 wrote to memory of 4776	3168	2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe	91
PID 1692 wrote to memory of 4392	1692	ozjyl889.exe	59
PID 1692 wrote to memory of 4464	1692	ozjyl889.exe	60
PID 1692 wrote to memory of 4988	1692	ozjyl889.exe	64
PID 1692 wrote to memory of 5244	1692	ozjyl889.exe	66
PID 1692 wrote to memory of 1764	1692	ozjyl889.exe	80
PID 1692 wrote to memory of 2176	1692	ozjyl889.exe	81
PID 3168 wrote to memory of 2884	3168	2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe	92
PID 2884 wrote to memory of 2176	2884	y6wptxud.exe	81
PID 3168 wrote to memory of 4572	3168	2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe	93
PID 3168 wrote to memory of 2116	3168	2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe	94
PID 2176 wrote to memory of 4980	2176	explorer.exe
PID 2176 wrote to memory of 1568	2176	explorer.exe
PID 2176 wrote to memory of 3940	2176	explorer.exe
PID 2176 wrote to memory of 1064	2176	explorer.exe
PID 2116 wrote to memory of 4392	2116	o7ljdlbj.exe	59
PID 3168 wrote to memory of 2776	3168	2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe	99
PID 4572 wrote to memory of 1256	4572	k3cb5or5.exe	100
PID 3168 wrote to memory of 4948	3168	2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe	101
PID 2176 wrote to memory of 1948	2176	explorer.exe
PID 2176 wrote to memory of 828	2176	explorer.exe
PID 3456 wrote to memory of 4392	3456	o7ljdlbj.exe	59
PID 2776 wrote to memory of 4384	2776	4w3cguqx.exe	115
PID 4384 wrote to memory of 5624	4384	taskhost.exe	116
PID 2776 wrote to memory of 2860	2776	4w3cguqx.exe	117
PID 2860 wrote to memory of 4464	2860	spoolsv.exe	60
PID 2176 wrote to memory of 2004	2176	explorer.exe
PID 4600 wrote to memory of 4464	4600	spoolsv.exe	60

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4464

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000268;000000000000026C;
1⤵
PID:4988

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5244

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1764
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Users\Admin\AppData\Local\Temp\2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_f503a9c311d074521e292218cb4418ef_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\system32\notepad.exe
      C:\Windows\system32\notepad.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\ozjyl889.exe
      "C:\Users\Admin\AppData\Local\Temp\ozjyl889.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\79u95oma.exe
        
        "C:\Users\Admin\AppData\Local\Temp\79u95oma.exe"
        5⤵
        
        PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\td5mqfmx.exe
      "C:\Users\Admin\AppData\Local\Temp\td5mqfmx.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\y6wptxud.exe
      "C:\Users\Admin\AppData\Local\Temp\y6wptxud.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\k3cb5or5.exe
      "C:\Users\Admin\AppData\Local\Temp\k3cb5or5.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\is-NP8UE9Z3SH.tmp\k3cb5or5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-NP8UE9Z3SH.tmp\k3cb5or5.tmp" /SL5="$501D8,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\k3cb5or5.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\o7ljdlbj.exe
      "C:\Users\Admin\AppData\Local\Temp\o7ljdlbj.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\4w3cguqx.exe
      "C:\Users\Admin\AppData\Local\Temp\4w3cguqx.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\taskhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\taskhost.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\is-HLJ6DIBBM6.tmp\taskhost.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HLJ6DIBBM6.tmp\taskhost.tmp" /SL5="$30054,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\taskhost.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\spoolsv.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\lsass.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\lsass.exe"
        5⤵
        
        PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\TotalExtractor.exe
      "C:\Users\Admin\AppData\Local\Temp\TotalExtractor.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4948
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 984
        5⤵
        Program crash
        
        PID:2868
- - C:\Users\Admin\AppData\Local\Temp\A26B.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\A26B.tmp.exe
    3⤵
    PID:5680
- - C:\Users\Admin\AppData\Local\Temp\8D59.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\8D59.tmp.exe
    3⤵
    PID:5896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:5780

C:\Users\Admin\AppData\Roaming\cryptsvchaj.exe
C:\Users\Admin\AppData\Roaming\cryptsvchaj.exe
1⤵
- Executes dropped EXE
PID:2496

C:\Users\Admin\AppData\Local\Temp\o7ljdlbj.exe
C:\Users\Admin\AppData\Local\Temp\o7ljdlbj.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3456

C:\ProgramData\fffbbedfdc.exe
"C:\ProgramData\fffbbedfdc.exe"
1⤵
- Executes dropped EXE
PID:3532

C:\Users\Admin\AppData\Local\Temp\y6wptxud.exe
"C:\Users\Admin\AppData\Local\Temp\y6wptxud.exe"
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4948 -ip 4948
1⤵
PID:3140

C:\Users\Admin\AppData\Local\Temp\4w3cguqx.exe
C:\Users\Admin\AppData\Local\Temp\4w3cguqx.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4600

C:\Users\Admin\AppData\Local\Temp\A26B.tmp.exe
C:\Users\Admin\AppData\Local\Temp\A26B.tmp.exe
1⤵
PID:5156

C:\Users\Admin\AppData\Local\Temp\79u95oma.exe
C:\Users\Admin\AppData\Local\Temp\79u95oma.exe
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4w3cguqx.exe

Path C:\Users\Admin\AppData\Local\Temp\4w3cguqx.exe
Size 120KB
SHA256 32b173a4a2bbc767d93bd6c645170479f1d3eb27f9ae5b47c9260ec31f739bf7
MD5 842b09509ab819c1e7edecd41d4c301b
SHA1 38efdf62dfb36898c662bb912c0e76d79e8836bf
SHA512 aa3ecddb8af12b6970fccd5106406f86bf55656193b0683da17b23ce47d3abe4cd7e64c4377206664709678f338c338d5e0ba44b193cb38b34113ea33ec29e6a
SSDEEP 1536:HlyFwDCtFe20zYrnw5p15i8VOTypRxn2KXdTY+sWLdP9dldGOIJ:HlyFPtv0kTwDxUepRx2KG6vbGOI
TLSH
T1C2C36B1777A530F8E17B823589215A16E7B378310B758B6F03A4426A6F277D09E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TotalExtractor.exe

Path C:\Users\Admin\AppData\Local\Temp\TotalExtractor.exe
Size 758KB
SHA256 25a7a44f72272e62be83446161caacfce11f152b90ba686fe52eac663b5a730e
MD5 10d9f87a004ca4bbc15fced05348a8bd
SHA1 6105acb1e9754786016809aa708327f7e22a1b8f
SHA512 826eade060d5c1863b1decb2be72e0ba35b1a4f20dac16d5d49e53717fbe7e0e2ca7e6f6e35219d9884c405ef2d0a1d9c6b23a572138fc35d6fdb09cbed5d71a
SSDEEP 6144:6M5hvl5z9dG98LPC/CfdF0l86Z7VRsEDsvVjKRERunuCmeRATA5rcC2Ly8488ML1:uCDrCVOEDcVktqyGHEc7N7I2sqEXq
TLSH
T169F476655388FF63C81493B123A7536643F94C9EE371B61F9E2529E47BF14F0BA0284A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-2M2IYQUQ25.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k3cb5or5.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-NP8UE9Z3SH.tmp\k3cb5or5.tmp
Size 4.3MB
SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
MD5 33453f6a4881d9959e8f964a185e1e04
SHA1 5adb5722c611dbeceba40d753c766211bc461787
SHA512 2572420402140eec620b219d7db73e05f4ef210ffe9cc0608edd399c42ec9d1a990330bcace4653156f0f389a4d72acb77d2f6817744672d46a96bf71283a789
SSDEEP 49152:6eGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4ji2333DneQ:6eGwK5YHCNmi16F+QxvCeFLm2333zB
TLSH
T148267E13B688753ED4A71A3B483BA684983B7E213A11CC4B7BF42D4C9E3D740AD26757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k3cb5or5.exe

Path C:\Users\Admin\AppData\Local\Temp\k3cb5or5.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o7ljdlbj.exe

Path C:\Users\Admin\AppData\Local\Temp\o7ljdlbj.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ozjyl889.exe

Path C:\Users\Admin\AppData\Local\Temp\ozjyl889.exe
Size 54KB
SHA256 1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1
MD5 3e88f1a1f48cb2a3556fdac9de4e8ef9
SHA1 dd839cd4619e104298bb2d823f4678504f148622
SHA512 fe55272561838a1cc3ed5d4145c7e4c7a1418d3c1bfd92f5bc8dfa29b1f7e7417ab6e3635ed8f249277c0be3a24be09bfa4f3065c81390624b0a65fdcc3fde0f
SSDEEP 1536:vtW4y8UFRx6GbgCSUMH18htq5Hk9Uepxc6kRdps:1W4yKBHmhg5HSUep3
TLSH
T15F43092916F64B65E8728279EAB44327D0F87C46BC70421F0773CE592F938C1A67CB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

td5mqfmx.exe

Path C:\Users\Admin\AppData\Local\Temp\td5mqfmx.exe
Size 166KB
SHA256 3ea66df0155ad39a658607c9eb1e035f0f8dd12dd75cc69725bdb15b73a4e5d4
MD5 878daa2275262e2d5a124d997b8f3f22
SHA1 91322a927c535b04513eb255d1238039d994b133
SHA512 a2e0473d4d5a0cb8baee3b77df636e436a3637524bd8bd3d453baad9a0c2079569241e38b6f32f46ec0c235a5b19750bae5d4695cfce181a42aafe109e7553ce
SSDEEP 3072:XtJ2fCsQiuzYJ8WreWgxgjIFaphDCMfCv6vHXrbl5STd:XwCszCYJ8OcgsaBB
TLSH
T192F37D4A73E510FDE1778239C9551A45F372782207209BAF07A047BA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y6wptxud.exe

Path C:\Users\Admin\AppData\Local\Temp\y6wptxud.exe
Size 90KB
SHA256 706409b4cfeba987355f41d23c31e047f9b1c851ccacaf49fc243a692f7a3e22
MD5 b4994740359f6302a3047feb3e6d3453
SHA1 723990132e40adab04d65fd38e15e2d3044ceeae
SHA512 e4bdd846611147115d00368b28ce8d2d100cc4934c8000913b5bde137130ba3681d411d5f2119a68c93980770e913fe2654bdedd88dcbe3ea467724d41450254
SSDEEP 1536:/Dq9NyTUi+O2IOiJ3hP51h/SeDIiG0hL47okrNTWIxUtGsNTfqroYD4c76j:/Dq99jwx51xhDJXL4DrNTWoU7rqrfD41
TLSH
T1D293CFA7279414F5D9AAD678D5A18F23F2F3B8894A15871F03B8C9852F23362723D707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-136-0x0000000000990000-0x0000000000DF0000-memory.dmp

Download

memory/1256-146-0x0000000000990000-0x0000000000DF0000-memory.dmp

Download

memory/1256-183-0x0000000000990000-0x0000000000DF0000-memory.dmp

Download

memory/1256-236-0x0000000000990000-0x0000000000DF0000-memory.dmp

Download

memory/2176-94-0x00000000012B0000-0x00000000012D5000-memory.dmp

Download

memory/2176-84-0x00000000012E0000-0x00000000012E1000-memory.dmp

Download

memory/2176-278-0x0000000003A80000-0x0000000003A81000-memory.dmp

Download

memory/2176-92-0x00000000012B0000-0x00000000012D5000-memory.dmp

Download

memory/2176-91-0x00000000012B0000-0x00000000012D5000-memory.dmp

Download

memory/2176-89-0x00000000012B0000-0x00000000012D5000-memory.dmp

Download

memory/2176-88-0x0000000003DE0000-0x0000000003DE1000-memory.dmp

Download

memory/2176-86-0x00000000034C0000-0x00000000034C1000-memory.dmp

Download

memory/2176-85-0x00000000012F0000-0x00000000012F1000-memory.dmp

Download

memory/2176-90-0x00000000012B0000-0x00000000012D5000-memory.dmp

Download

memory/2176-221-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

Download

memory/2176-138-0x00000000012B0000-0x00000000012D5000-memory.dmp

Download

memory/2176-59-0x00000000012B0000-0x00000000012D5000-memory.dmp

Download

memory/2176-87-0x00000000012B0000-0x00000000012D5000-memory.dmp

Download

memory/2176-110-0x0000000006770000-0x0000000006771000-memory.dmp

Download

memory/2176-174-0x0000000003BF0000-0x0000000003BF1000-memory.dmp

Download

memory/2176-60-0x00000000012B0000-0x00000000012D5000-memory.dmp

Download

memory/2176-119-0x0000000006A70000-0x0000000006A71000-memory.dmp

Download

memory/2176-134-0x00000000012B0000-0x00000000012D5000-memory.dmp

Download

memory/2460-125-0x00007FF67E670000-0x00007FF67E68E000-memory.dmp

Download

memory/2884-53-0x00007FF67E670000-0x00007FF67E68E000-memory.dmp

Download

memory/2884-63-0x00007FF67E670000-0x00007FF67E68E000-memory.dmp

Download

memory/3532-122-0x00007FF710E00000-0x00007FF710E1E000-memory.dmp

Download

memory/3532-123-0x00007FF710E00000-0x00007FF710E1E000-memory.dmp

Download

memory/4384-155-0x0000000000810000-0x0000000000916000-memory.dmp

Download

memory/4384-180-0x0000000000810000-0x0000000000916000-memory.dmp

Download

memory/4392-142-0x000001B4D5150000-0x000001B4D5181000-memory.dmp

Download

memory/4392-96-0x000001B4D50A0000-0x000001B4D50D2000-memory.dmp

Download

memory/4392-31-0x000001B4D3C30000-0x000001B4D3C32000-memory.dmp

Download

memory/4464-206-0x00000189A7040000-0x00000189A7071000-memory.dmp

Download

memory/4572-135-0x0000000000CB0000-0x0000000000DB6000-memory.dmp

Download

memory/4572-73-0x0000000000CB0000-0x0000000000DB6000-memory.dmp

Download

memory/4868-3-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4948-117-0x0000000000730000-0x00000000007F4000-memory.dmp

Download

memory/4948-118-0x0000000005B90000-0x000000000614A000-memory.dmp

Download

memory/4988-35-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/5624-197-0x0000000001000000-0x0000000001460000-memory.dmp

Download

memory/5624-181-0x0000000001000000-0x0000000001460000-memory.dmp

Download

memory/5624-238-0x0000000001000000-0x0000000001460000-memory.dmp

Download