3084afefef0d17605f8e14b6bee81df73c0c47b3216aa5d8a42d311a992283d0

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
Size 3.7MB
Sample260804-m2dg8stycv
SHA256 3084afefef0d17605f8e14b6bee81df73c0c47b3216aa5d8a42d311a992283d0
MD5 8a33d9f9ff03f49e1147255bbe96762e
SHA1 e305311996996f58f2808624384fdb7dc837fb4a
SHA512 c36aebfe616714075f4b719fad2094281a3d5a7303257816eeaac9e89a1c023026102dec4a2617008a2c11b8e993349d7edd7b39ece4bec08652f411c4a3a251
SSDEEP 49152:tqzbbf6Sz6aRvDp9io0M9HVzfmVQ7ocfMW7P5acdtTmDf0orxITYIU6ilE:U3bySBR9hJl7DPTtThnn+
TLSH
T10B068D13E2A580F9D29EC078C71E9637EB72B8891620F3EB17D48A652F23BB0575D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1356	powershell.exe
1356	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe

Executes dropped EXE 3 IoCs

pid	Process
2816	31442_PlateHub.exe
4616	AutoIt3.exe
2120	AutoIt3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ibrowser = "\"\\\\?\\C:\\Users\\Admin\\AppData\\Local\\Packages\\Extensions\\9FD21B92A1E147028119AA42CA6DE422DDD852EB9300DFE3B1E4D51F3404CFEB-agent\\ibrowser.exe\""	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4616 set thread context of 2120	4616	AutoIt3.exe	130

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
968	taskkill.exe
2564	taskkill.exe
2392	taskkill.exe
4872	taskkill.exe
412	taskkill.exe
3588	taskkill.exe
1848	taskkill.exe
3268	taskkill.exe
1304	taskkill.exe
3800	taskkill.exe
3232	taskkill.exe
4548	taskkill.exe
1660	taskkill.exe
4112	taskkill.exe
5056	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
1356	powershell.exe
1356	powershell.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
4616	AutoIt3.exe
4616	AutoIt3.exe
4616	AutoIt3.exe
4616	AutoIt3.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeIncreaseQuotaPrivilege	1356	powershell.exe
Token: SeSecurityPrivilege	1356	powershell.exe
Token: SeTakeOwnershipPrivilege	1356	powershell.exe
Token: SeLoadDriverPrivilege	1356	powershell.exe
Token: SeSystemProfilePrivilege	1356	powershell.exe
Token: SeSystemtimePrivilege	1356	powershell.exe
Token: SeProfSingleProcessPrivilege	1356	powershell.exe
Token: SeIncBasePriorityPrivilege	1356	powershell.exe
Token: SeCreatePagefilePrivilege	1356	powershell.exe
Token: SeBackupPrivilege	1356	powershell.exe
Token: SeRestorePrivilege	1356	powershell.exe
Token: SeShutdownPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeSystemEnvironmentPrivilege	1356	powershell.exe
Token: SeRemoteShutdownPrivilege	1356	powershell.exe
Token: SeUndockPrivilege	1356	powershell.exe
Token: SeManageVolumePrivilege	1356	powershell.exe
Token: 33	1356	powershell.exe
Token: 34	1356	powershell.exe
Token: 35	1356	powershell.exe
Token: 36	1356	powershell.exe
Token: SeDebugPrivilege	968	taskkill.exe
Token: SeDebugPrivilege	412	taskkill.exe
Token: SeDebugPrivilege	3588	taskkill.exe
Token: SeDebugPrivilege	1304	taskkill.exe
Token: SeDebugPrivilege	3800	taskkill.exe
Token: SeDebugPrivilege	1848	taskkill.exe
Token: SeDebugPrivilege	3232	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	4112	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	3268	taskkill.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeDebugPrivilege	4872	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4616	AutoIt3.exe
4616	AutoIt3.exe
4616	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4616	AutoIt3.exe
4616	AutoIt3.exe
4616	AutoIt3.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 3480	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	84
PID 2544 wrote to memory of 1356	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	88
PID 2544 wrote to memory of 968	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	90
PID 2544 wrote to memory of 2816	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	92
PID 2544 wrote to memory of 412	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	94
PID 2816 wrote to memory of 4616	2816	31442_PlateHub.exe	93
PID 2544 wrote to memory of 3588	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	96
PID 2544 wrote to memory of 1304	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	98
PID 2544 wrote to memory of 3800	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	100
PID 2544 wrote to memory of 3232	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	102
PID 2544 wrote to memory of 1848	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	103
PID 2544 wrote to memory of 4548	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	106
PID 2544 wrote to memory of 1660	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	108
PID 2544 wrote to memory of 2564	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	110
PID 2544 wrote to memory of 4112	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	112
PID 2544 wrote to memory of 2392	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	114
PID 2544 wrote to memory of 3268	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	116
PID 2544 wrote to memory of 5056	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	118
PID 2544 wrote to memory of 4872	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	120
PID 2544 wrote to memory of 976	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	124
PID 2544 wrote to memory of 976	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	124
PID 2544 wrote to memory of 2124	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	126
PID 2544 wrote to memory of 2124	2544	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	126
PID 4616 wrote to memory of 2120	4616	AutoIt3.exe	130
PID 4616 wrote to memory of 2120	4616	AutoIt3.exe	130
PID 4616 wrote to memory of 2120	4616	AutoIt3.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Downloads MZ/PE file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\system32\getmac.exe
  "getmac" /fo csv /nh
  2⤵
  PID:3480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Users\Admin\AppData\Local\Packages\Extensions\9FD21B92A1E147028119AA42CA6DE422DDD852EB9300DFE3B1E4D51F3404CFEB-agent\downloads\31442_PlateHub.exe
  "\\?\C:\Users\Admin\AppData\Local\Packages\Extensions\9FD21B92A1E147028119AA42CA6DE422DDD852EB9300DFE3B1E4D51F3404CFEB-agent\downloads\31442_PlateHub.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Traveling.a3x
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      4⤵
      Executes dropped EXE
      PID:2120
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedgewebview2.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1304
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3232
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedgewebview2.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedgewebview2.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google/Chrome/Application/chrome.exe"
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google/Chrome/Application/chrome.exe"
  2⤵
  PID:2124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31442_PlateHub.exe

Path C:\Users\Admin\AppData\Local\Packages\Extensions\9FD21B92A1E147028119AA42CA6DE422DDD852EB9300DFE3B1E4D51F3404CFEB-agent\downloads\31442_PlateHub.exe
Size 6.0MB
SHA256 0807ac4a22bed48ea5d501a839fdec3c71c769f4ab3dfa08f9a918d279fcd66e
MD5 5cffc0e0314cd6a2b8248c043596d189
SHA1 66c25822d2ba5f39e3ea6aa1fb019449cbda27a2
SHA512 fec16d9fd988827d1580e7202c12dcf79ec9da76d9a83aeda283544de2243089a792388400afca09c089569598d9b057e6d5b6e8fb4927ecc03ddcd2cb980bca
SSDEEP 98304:PFFNnF0KNpPC8YJoAyLAdiT7gka2X0sIVc07LG5jkE+sltg0uOe:PJnFDaEAyL7gkafXZlE+sltg
TLSH
T1625633662BE5180AF2A5DFF57DD880768A307C4ED77946DE6690C50FAE01BCDA23430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.ts-D6ogNSgd.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\9FD21B92A1E147028119AA42CA6DE422DDD852EB9300DFE3B1E4D51F3404CFEB\e0\assets\background.ts-D6ogNSgd.js
Size 19KB
SHA256 8317268611b264860271831e72c1995e1ec573e8fca88bcfecc35f22804d5662
MD5 31ad2d4e1520f32c278bab69860d8364
SHA1 6c2f66e4aceceddc1dd5c805071b5d2184e33108
SHA512 8da6ed97edd0ce9713c13425ae420f3ab9be61be1139372182442a0ee9b20f3a66106339794d04d4d5cff892ae32494fcc26439e8ce70bb30ee9d4a184ca3359
SSDEEP 384:HhGacWt1UArM8iwIVP4svuUtCGRhxdno4o/ZDE/v6fqvTprRqA660aOvBMI4M2nC:HEacWt17rM8iwCP4svuUtCGRhnno4o/5
TLSH
T14992FA59317A2070E6E535F4B0774242B2398B34740980A2B13E8EB97D6ED46997EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\9FD21B92A1E147028119AA42CA6DE422DDD852EB9300DFE3B1E4D51F3404CFEB\e0\manifest.json
Size 1KB
SHA256 a68297b6ff8218690abddc5ef63de45cd126695a4e677e3e3a2be087a7c6ac2c
MD5 ac45ab511f5530abc94313434adaf432
SHA1 febec023387908b6be72a9dfba895d886ed1e60e
SHA512 f7aeb6110d091b0ebcd5f19d50588eeb84980fa7fbe80238cb99458d52189709a417c9f3b2e2393b89fe08b66f8b6e87f3881431e1acb452e4f90e796b1d6e05
TLSH
T19D310025D9685C6B03CCAB302DFA4987A50509879D947C1C7ADE800C8FBD61F02FBB9C
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Traveling.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Traveling.a3x
Size 5.4MB
SHA256 61416c7b346f845acc2e08c67fe39d3d2f21bcb8a0b81b0daed3ff449a3c4337
MD5 14882d98882e5d61d8a82037413ab35f
SHA1 6fedfa6a1204361eb4d7a5ef351d3bc8d066246b
SHA512 a3456e11b3a186d302884708ff6fd6923146d89aa72415facd0fad8446d68ea527b1561d8559e3971083640c3ff52d096047a37ad425a1cff3cdb8fc585c92cd
SSDEEP 98304:sfvEW0+4EUYTL+aKCO5dtq7DkpBtAS5RRf2dF5LPn1s7X10WO:wEWzRFKCD7Dkpk+yvn1s7X1A
TLSH
T12E4633AA3B563D0E3295EEF63D8880B49E102C4FE79E0AA8E961C60FFD0075D517494F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cx2nepir.qcc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cx2nepir.qcc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ck_2544_1785841050570543700.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_2544_1785841050570543700.bin
Size 32B
SHA256 03f937e92a36f99e75000f128f84069bc58752795db87b834113680fa8b3ae3a
MD5 e68ea90f5bf78dd8b259ec5a4cb7f7f7
SHA1 4829bf3e2469b5e8742ac59f47c80e622dae3c6a
SHA512 b3229cfaae79eee8c373edbe5ed570af926acd77256e75e31d5baba77756f42727b3f97c798c73ddb635e83dcd65464e849370db8d7c89cd009f69365a0ef7b8
MD5 SHA1 SHA512

Submit Download

memory/1356-40-0x0000027EEF950000-0x0000027EEF960000-memory.dmp

Download

memory/1356-39-0x0000027EEF950000-0x0000027EEF960000-memory.dmp

Download

memory/1356-46-0x0000027EEF920000-0x0000027EEF942000-memory.dmp

Download

memory/1356-49-0x0000027EF1CD0000-0x0000027EF1CFA000-memory.dmp

Download

memory/1356-50-0x0000027EF1CD0000-0x0000027EF1CF4000-memory.dmp

Download

memory/1356-51-0x0000027EEF950000-0x0000027EEF960000-memory.dmp

Download

memory/2120-116-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-124-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-84-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-85-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-87-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-92-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-91-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-90-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-88-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-89-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-93-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-94-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-99-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-100-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-102-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-103-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-104-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-106-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-107-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-109-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-110-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-111-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-112-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-114-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-115-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-167-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-118-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-119-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-120-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-122-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-123-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-166-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-126-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-127-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-128-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-130-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-131-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-132-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-134-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-135-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-136-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-138-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-139-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-140-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-142-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-143-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-144-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-146-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-147-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-148-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-150-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-151-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-152-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-154-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-155-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-156-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-158-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-159-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-160-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-162-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-163-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/2120-165-0x0000019AA0290000-0x0000019AA0791000-memory.dmp

Download

memory/4616-82-0x000002A11C110000-0x000002A11C111000-memory.dmp

Download

memory/4616-66-0x00007FFCAA210000-0x00007FFCAA405000-memory.dmp

Download