3084afefef0d17605f8e14b6bee81df73c0c47b3216aa5d8a42d311a992283d0

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
Size 3.7MB
Sample260804-m2dg8stycv
SHA256 3084afefef0d17605f8e14b6bee81df73c0c47b3216aa5d8a42d311a992283d0
MD5 8a33d9f9ff03f49e1147255bbe96762e
SHA1 e305311996996f58f2808624384fdb7dc837fb4a
SHA512 c36aebfe616714075f4b719fad2094281a3d5a7303257816eeaac9e89a1c023026102dec4a2617008a2c11b8e993349d7edd7b39ece4bec08652f411c4a3a251
SSDEEP 49152:tqzbbf6Sz6aRvDp9io0M9HVzfmVQ7ocfMW7P5acdtTmDf0orxITYIU6ilE:U3bySBR9hJl7DPTtThnn+
TLSH
T10B068D13E2A580F9D29EC078C71E9637EB72B8891620F3EB17D48A652F23BB0575D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5740	powershell.exe
5740	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe

Executes dropped EXE 3 IoCs

pid	Process
1060	31443_PlateHub.exe
4548	AutoIt3.exe
2564	AutoIt3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\ibrowser = "\"\\\\?\\C:\\Users\\Admin\\AppData\\Local\\Packages\\Extensions\\DC5F6BCCC49FC2A54B0F1EFD809802210095E39EEA8E733276211792054E6979-agent\\ibrowser.exe\""	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4548 set thread context of 2564	4548	AutoIt3.exe	135

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
4588	taskkill.exe
4484	taskkill.exe
5844	taskkill.exe
3368	taskkill.exe
4780	taskkill.exe
1972	taskkill.exe
5848	taskkill.exe
3312	taskkill.exe
5968	taskkill.exe
4872	taskkill.exe
4904	taskkill.exe
1776	taskkill.exe
6052	taskkill.exe
3052	taskkill.exe
2140	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
5740	powershell.exe
5740	powershell.exe
5740	powershell.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
4548	AutoIt3.exe
4548	AutoIt3.exe
4548	AutoIt3.exe
4548	AutoIt3.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	5740	powershell.exe
Token: SeIncreaseQuotaPrivilege	5740	powershell.exe
Token: SeSecurityPrivilege	5740	powershell.exe
Token: SeTakeOwnershipPrivilege	5740	powershell.exe
Token: SeLoadDriverPrivilege	5740	powershell.exe
Token: SeSystemProfilePrivilege	5740	powershell.exe
Token: SeSystemtimePrivilege	5740	powershell.exe
Token: SeProfSingleProcessPrivilege	5740	powershell.exe
Token: SeIncBasePriorityPrivilege	5740	powershell.exe
Token: SeCreatePagefilePrivilege	5740	powershell.exe
Token: SeBackupPrivilege	5740	powershell.exe
Token: SeRestorePrivilege	5740	powershell.exe
Token: SeShutdownPrivilege	5740	powershell.exe
Token: SeDebugPrivilege	5740	powershell.exe
Token: SeSystemEnvironmentPrivilege	5740	powershell.exe
Token: SeRemoteShutdownPrivilege	5740	powershell.exe
Token: SeUndockPrivilege	5740	powershell.exe
Token: SeManageVolumePrivilege	5740	powershell.exe
Token: 33	5740	powershell.exe
Token: 34	5740	powershell.exe
Token: 35	5740	powershell.exe
Token: 36	5740	powershell.exe
Token: SeDebugPrivilege	4904	taskkill.exe
Token: SeDebugPrivilege	4588	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	6052	taskkill.exe
Token: SeDebugPrivilege	4484	taskkill.exe
Token: SeDebugPrivilege	5848	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	5844	taskkill.exe
Token: SeDebugPrivilege	2140	taskkill.exe
Token: SeDebugPrivilege	3312	taskkill.exe
Token: SeDebugPrivilege	3368	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	5968	taskkill.exe
Token: SeDebugPrivilege	4780	taskkill.exe
Token: SeDebugPrivilege	4872	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4548	AutoIt3.exe
4548	AutoIt3.exe
4548	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4548	AutoIt3.exe
4548	AutoIt3.exe
4548	AutoIt3.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 2180	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	90
PID 476 wrote to memory of 5740	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	93
PID 476 wrote to memory of 4904	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	95
PID 476 wrote to memory of 1060	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	97
PID 1060 wrote to memory of 4548	1060	31443_PlateHub.exe	98
PID 476 wrote to memory of 4588	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	99
PID 476 wrote to memory of 1776	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	101
PID 476 wrote to memory of 6052	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	103
PID 476 wrote to memory of 4484	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	105
PID 476 wrote to memory of 5848	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	107
PID 476 wrote to memory of 1972	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	109
PID 476 wrote to memory of 5844	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	111
PID 476 wrote to memory of 2140	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	113
PID 476 wrote to memory of 3312	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	115
PID 476 wrote to memory of 3368	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	117
PID 476 wrote to memory of 3052	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	119
PID 476 wrote to memory of 5968	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	121
PID 476 wrote to memory of 4780	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	123
PID 476 wrote to memory of 4872	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	125
PID 476 wrote to memory of 2828	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	129
PID 476 wrote to memory of 2828	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	129
PID 476 wrote to memory of 5352	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	131
PID 476 wrote to memory of 5352	476	2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe	131
PID 4548 wrote to memory of 2564	4548	AutoIt3.exe	135
PID 4548 wrote to memory of 2564	4548	AutoIt3.exe	135
PID 4548 wrote to memory of 2564	4548	AutoIt3.exe	135

C:\Users\Admin\AppData\Local\Temp\2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8a33d9f9ff03f49e1147255bbe96762e_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Downloads MZ/PE file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:476
- C:\Windows\system32\getmac.exe
  "getmac" /fo csv /nh
  2⤵
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5740
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Users\Admin\AppData\Local\Packages\Extensions\DC5F6BCCC49FC2A54B0F1EFD809802210095E39EEA8E733276211792054E6979-agent\downloads\31443_PlateHub.exe
  "\\?\C:\Users\Admin\AppData\Local\Packages\Extensions\DC5F6BCCC49FC2A54B0F1EFD809802210095E39EEA8E733276211792054E6979-agent\downloads\31443_PlateHub.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Traveling.a3x
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      4⤵
      Executes dropped EXE
      PID:2564
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedgewebview2.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6052
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4484
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5848
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5844
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedgewebview2.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3312
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3368
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5968
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedgewebview2.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google/Chrome/Application/chrome.exe"
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google/Chrome/Application/chrome.exe"
  2⤵
  PID:5352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31443_PlateHub.exe

Path C:\Users\Admin\AppData\Local\Packages\Extensions\DC5F6BCCC49FC2A54B0F1EFD809802210095E39EEA8E733276211792054E6979-agent\downloads\31443_PlateHub.exe
Size 6.0MB
SHA256 0807ac4a22bed48ea5d501a839fdec3c71c769f4ab3dfa08f9a918d279fcd66e
MD5 5cffc0e0314cd6a2b8248c043596d189
SHA1 66c25822d2ba5f39e3ea6aa1fb019449cbda27a2
SHA512 fec16d9fd988827d1580e7202c12dcf79ec9da76d9a83aeda283544de2243089a792388400afca09c089569598d9b057e6d5b6e8fb4927ecc03ddcd2cb980bca
SSDEEP 98304:PFFNnF0KNpPC8YJoAyLAdiT7gka2X0sIVc07LG5jkE+sltg0uOe:PJnFDaEAyL7gkafXZlE+sltg
TLSH
T1625633662BE5180AF2A5DFF57DD880768A307C4ED77946DE6690C50FAE01BCDA23430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.ts-D6ogNSgd.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\DC5F6BCCC49FC2A54B0F1EFD809802210095E39EEA8E733276211792054E6979\e0\assets\background.ts-D6ogNSgd.js
Size 19KB
SHA256 bd742007cae08999c3b3ec1c16e6d55c34901aceffe666d71b61c46dbf002d06
MD5 8f3f4f1ae7382de336182c746274fb93
SHA1 dadd8cb7089c17bcf778972f5cb973965753d0d4
SHA512 8d86adf662b352a70089a0266481933daa0ad7c7983bbaff654753c38ab7caa2aa77767438b4ed88444050a136a60d94dfe659e2d1f8d6f3559d646018395b5d
SSDEEP 384:T5hGacWt1UArM8iwIVP4svuUtCGRhxdno4o/ZDE/v6fqvTprRqA660aOvBMI4M2C:T5EacWt17rM8iwCP4svuUtCGRhnno4oR
TLSH
T16D920B59317A2030E6E539F4A0774241B239CB347409C0A2B13E8EB57D6ED46A97EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\DC5F6BCCC49FC2A54B0F1EFD809802210095E39EEA8E733276211792054E6979\e0\manifest.json
Size 1KB
SHA256 a68297b6ff8218690abddc5ef63de45cd126695a4e677e3e3a2be087a7c6ac2c
MD5 ac45ab511f5530abc94313434adaf432
SHA1 febec023387908b6be72a9dfba895d886ed1e60e
SHA512 f7aeb6110d091b0ebcd5f19d50588eeb84980fa7fbe80238cb99458d52189709a417c9f3b2e2393b89fe08b66f8b6e87f3881431e1acb452e4f90e796b1d6e05
TLSH
T19D310025D9685C6B03CCAB302DFA4987A50509879D947C1C7ADE800C8FBD61F02FBB9C
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Traveling.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Traveling.a3x
Size 5.4MB
SHA256 61416c7b346f845acc2e08c67fe39d3d2f21bcb8a0b81b0daed3ff449a3c4337
MD5 14882d98882e5d61d8a82037413ab35f
SHA1 6fedfa6a1204361eb4d7a5ef351d3bc8d066246b
SHA512 a3456e11b3a186d302884708ff6fd6923146d89aa72415facd0fad8446d68ea527b1561d8559e3971083640c3ff52d096047a37ad425a1cff3cdb8fc585c92cd
SSDEEP 98304:sfvEW0+4EUYTL+aKCO5dtq7DkpBtAS5RRf2dF5LPn1s7X10WO:wEWzRFKCD7Dkpk+yvn1s7X1A
TLSH
T12E4633AA3B563D0E3295EEF63D8880B49E102C4FE79E0AA8E961C60FFD0075D517494F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ck_476_1785841057070480500.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_476_1785841057070480500.bin
Size 32B
SHA256 428f9a1347112bfeab6fe848fe0a5be10684948d01b3a8d16f8d778c24e037e8
MD5 1f62435f1b8f01563ace0b756ec43eba
SHA1 1f416cfcb0513270779b40aa97a5afc62e8221c2
SHA512 02757b970eb301e54480d9e0e06efaf250ff1480eee1e9f1760471768ac69c180e2c09aa77a6dd12137ed4639a69ba23c53a5b3bd05fd33668dea20f1e678ff1
MD5 SHA1 SHA512

Submit Download

memory/2564-94-0x000002EB2BE50000-0x000002EB2C351000-memory.dmp

Download

memory/2564-93-0x000002EB2BE50000-0x000002EB2C351000-memory.dmp

Download

memory/4548-91-0x0000020580660000-0x0000020580661000-memory.dmp

Download

memory/4548-75-0x00007FFA6A9A0000-0x00007FFA6AC03000-memory.dmp

Download

memory/5740-46-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-62-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-52-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-53-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-51-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-57-0x000001A07A6C0000-0x000001A07A772000-memory.dmp

Download

memory/5740-56-0x000001A07A6A0000-0x000001A07A6BE000-memory.dmp

Download

memory/5740-59-0x000001A07AB20000-0x000001A07AB4A000-memory.dmp

Download

memory/5740-60-0x000001A07AB20000-0x000001A07AB44000-memory.dmp

Download

memory/5740-50-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-58-0x000001A07A990000-0x000001A07A99A000-memory.dmp

Download

memory/5740-49-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-48-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-47-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-45-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-44-0x000001A062060000-0x000001A062082000-memory.dmp

Download

memory/5740-90-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-41-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-40-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/5740-39-0x00007FFA47CFF000-0x00007FFA47D00000-memory.dmp

Download