67b147a37db437d68c8009463fa63c5d07b80332a0505fbd5e7019a875c528c7

Analysis

max time kernel
147s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_3162ef47f0f3a805aa7917230d36550f_icedid_stealc_vidar.exe
Size 752KB
Sample260806-b6bcwsfb97
SHA256 67b147a37db437d68c8009463fa63c5d07b80332a0505fbd5e7019a875c528c7
MD5 3162ef47f0f3a805aa7917230d36550f
SHA1 aba8984ba1b3454f8f96e3c197d1e56edff76335
SHA512 9a37d51ef8121e7a6961b53793fa3abcf440b85c62ea7456109a5c5f1dfdfbdca75f7fefaa1e66e399d5e39a1e9d89aef858b1700a0489cf43eaa13701ee89bc
SSDEEP 12288:uRo4T9T9/Juor2Fe/UxvhuU5Y0WHfPhC+OsjIKdmmH/wQR2Cvrn8om/UNKJkiXxp:uRnT95/JuqIesx0UvW/tOs01e4ZCT1mx
TLSH
T100F4010362E520F9E0735434C8654957E3B6B9B607719EBF03A482B7CF672A58D2BE21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
1268	alg.exe
4748	elevation_service.exe
4716	elevation_service.exe
4152	maintenanceservice.exe
1508	OSE.EXE
2040	GameInputSvc.exe
3480	GameInputSvc.exe
5028	msdtc.exe
5096	PerceptionSimulationService.exe
4664	perfhost.exe
5260	ReFsDedupSvc.exe
5848	locator.exe
2812	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e79a5f40763f1d8f.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_3162ef47f0f3a805aa7917230d36550f_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_3162ef47f0f3a805aa7917230d36550f_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3480	GameInputSvc.exe
3480	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4512	2026-08-06_3162ef47f0f3a805aa7917230d36550f_icedid_stealc_vidar.exe
Token: SeDebugPrivilege	1268	alg.exe
Token: SeDebugPrivilege	1268	alg.exe
Token: SeTakeOwnershipPrivilege	4748	elevation_service.exe
Token: SeTcbPrivilege	2040	GameInputSvc.exe
Token: SeBackupPrivilege	5260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5260	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3480	2040	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-06_3162ef47f0f3a805aa7917230d36550f_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_3162ef47f0f3a805aa7917230d36550f_icedid_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4716

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4152

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1508

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3480

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5028

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5260

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5848

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:2812

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5320

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4108

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 16cfe72991d3c8f68cd7bec936be1176bdf2fda2e67a36a90c91db65473687fa
MD5 c6d76dd44538314f3db3740d1f290f43
SHA1 eeead768eead78f8592eeb0998deab971a178b65
SHA512 656df7007c5a1b0954ce450731262626482d13e29b1f8e3571c54597ffb2dd81c5a8bfee9684634f47df6cc9775912d466341f5585b1a3f0c2269c3e471ee105
SSDEEP 49152:tb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnIsx0WW/Yc1mwM+wB:z3q6gjBMxu/Ax
TLSH
T151D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ab069386ed16a3c6689b154c086062b19535db724e934228ef74628ed6cbbd46
MD5 36088e10bfbb8f451be80ecbdbbfb4d7
SHA1 600221222f00bcd1f970fa3df41bd631b88f7b74
SHA512 a1c23b4202d93a634abcc0210c9911ce6e9561204729d2390c59fd9246340cd9284b66d60017585697cc4dd07aaa7f44db0b8f931895acd81c8135b00f5ef57a
SSDEEP 24576:wXYRDtczAdsx0UvW/tOs01e4ZCT1m/UNKJdcw/p:xtcQsx0WW/Yc1mwM+wB
TLSH
T16A05012463E409F9EC67917CCCA28512E773B8A64760E78F03F495660F232D99E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 a3f1bf703643c3a78762f02a66b27e5530d0f92aac0674866294b2f0f5682f7d
MD5 96939a3943dfab7720d75145dbfda75d
SHA1 26f2e89c008e64518985756c243db25c9a9ce9ce
SHA512 96281a3a99b93ebec5a8a7007c7a75ccfccfa2427b049864a1880d9f17aef168e949bd79893a53ecb5856c518b7986997777fbf45de39f0b4d2e32113abc606b
SSDEEP 24576:uwuuOWcsx0UvW/tOs01e4ZCT1m/UNKJdcw/p:uwVOPsx0WW/Yc1mwM+wB
TLSH
T1E805F14266E40CF9E9A35138C59B8537E7F3B8522A21DB1F0770C65B5F37262AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 91eebaffd42ffb564107d3a517b2db79dc1108f2939d7244afa9eb8587eaf95a
MD5 e43f98f9b6388fe630a7a9ec27baeabe
SHA1 1b9fd8608c047950a40946636de0df73db24b1a8
SHA512 12afc98fa6b9bdd2f929bacef8f4f0c17db9871026b11f9045c1c12c4913c59ccb0bedca0420861d60299780fc2f8ca0e6911c7acc9fe4a7026f85ae83abab46
SSDEEP 49152:KB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glnsx0WW/Yc1mwM+wB:Yu6JmTxd2dsxu/Ax
TLSH
T18CD59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 129089992522673254faa9eff44c911a6ef71b148701ca96d670055a42d67a26
MD5 98da3153a148d23faa5ffad1227c2ed5
SHA1 b68f3db9e6f594574989ece73840842ea6a69312
SHA512 09d63634fe735fce8ed5013286d20c3334a26253822ce7a98e1965fb72983d9f8b0d04018a442b591e26bf5433190641c7bc46f23bc615042c2e53b4e100d678
SSDEEP 12288:sv7y/UxvhuU5Y0WHfPhC+OsjIKdmmH/wQR2Cvrn8om/UNKJkiXxKw/x+XK:uysx0UvW/tOs01e4ZCT1m/UNKJdcw/p
TLSH
T1B5D4231287A8422AF4A330B0A87E0573D3FFB7F75F1260CF496691A741B65ABC977019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7cab8d31d3d3090407f76c2a5705961d25c263437d9e28babae2de23eab7a2a1
MD5 03514c2fc9702098817be08eceb9bed2
SHA1 43e8f5b849d085a44521f1f0bcce950a444103df
SHA512 f2c7c4b9ea31f456a2331ff15e2fc1edd728b3121b969ab80f656c1395e36f28ce74af08e46d29e407c58bf126ac81bc12f10c3d9c4bf17a810c52b7f9ae7ea4
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYlsx0UvW/tOs01e4ZCT1m/UNKJdcw/p:Mgb4mBIBhGFSsx0WW/Yc1mwM+wB
TLSH
T15D659E1E22EC02F5E0F6E2B8DDAA4417D6B278161732D2DF0151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 9241cd9349fcdc87a71228b6140a65cf60684e5e4af00b1c3fdf982955f661bb
MD5 d25a2b3bd3fca94cdc02e1d6bcc061fe
SHA1 cbbaebfea92dd7d1f249abcac90a672a017ced4d
SHA512 f73034a84b38e6c9cf39ca1d1626fc49f46122c21a44a1082741ae00ad8489ee85a5937d0e8b9e3ea1c6a7b1243087f52e19799195d020858e2c8c4e56953809
SSDEEP 12288:A2Gp/UxvhuU5Y0WHfPhC+OsjIKdmmH/wQR2Cvrn8om/UNKJkiXxKw/x+XK:3Gpsx0UvW/tOs01e4ZCT1m/UNKJdcw/p
TLSH
T1D6E4232216F421A8D4736174987E0473F6F677F25B1231EF09E1D0B68BAA5F6E23AC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 bae8c73f999df5569fd6557ed7a329dcecb8f3d78505c047c21f3c76f1ead502
MD5 17a724df97921787cb4e53a75dc48fc6
SHA1 4b6d789a445582afb69d639e3444d3c7df0e00a4
SHA512 416236e28550dc4bb03bf9aa04c58603dc2ed7d10af601960150aedb3124d9b18c45d1f2eed937b457cbce066298ae5f060f9ce8b936a12e74dddf51a53b5b82
SSDEEP 12288:CE/UxvhuU5Y0WHfPhC+OsjIKdmmH/wQR2Cvrn8om/UNKJkiXxKw/x+XK:CEsx0UvW/tOs01e4ZCT1m/UNKJdcw/p
TLSH
T105D4231246A84269E49330B5A87F0863C3FE57F75B1331CF49B6A1A741AA5FFC577024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 cb8631134661573d1a04581f6a6041dc58719bd8505c3a9a404671ba31443da2
MD5 73918b48003ccf2c83374bc2ffe1bed2
SHA1 5712d684e23895608ca067748ea22ddb39a838a8
SHA512 90d1bff58958ff3b956e848a64ff3ed9125b5154434cfe2c43c697faa326fc518112fafacf19823ad6f1d92fc882ede17f727018ffd202fae842c5c48dfb5b88
SSDEEP 24576:boe8d83FJqH1Mzria7/m0sx0UvW/tOs01e4ZCT1m/UNKJdcw/p:8du37qVra7/3sx0WW/Yc1mwM+wB
TLSH
T1C735F16167E001F1D477E13889964663F6B2B4260361FBDF07A88B560F23AE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 f9607df846ca9608a2dd2e552358a7e06bd688d0f058cea931429599878cec2e
MD5 ede77074b555feff2ff8a345fd343643
SHA1 efa2030328d5cf4d0a18b59383f5f682294b2c6b
SHA512 f1a84d3adbab3e65c319053b3b13ad729949746b6c5da3eb45136706245d0612b632beedadfdcdd33a655cbc844592c145f4c170bd2495658db42e174f8d029b
SSDEEP 24576:/PUr+NQLsx0UvW/tOs01e4ZCT1m/UNKJdcw/p:/JQLsx0WW/Yc1mwM+wB
TLSH
T15E05F21B22EC18E5F577B17D8986461AE772B463071292CF02E1817E4F67DE8BD3EA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 8bc21c6667835c79133f77cd73c59a4a6c13e2cc8f9268146bd5846114adc4db
MD5 354f02d8c5ae68ff89154f223a6a1d6a
SHA1 d62eb75d0c77f88eec5386f9100732b49e26ae4a
SHA512 e5d84ffe6f08aa9d1b75c3c4168e57f3a39ef5c1a1b45ffda424f994de558448caec9fd9132faf18399d530d5adc603f2668d27bd578a856122483b669f6e13e
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjsx0WW/Yc1mwM+wB:tG05lO43b1xu/Ax
TLSH
T1F5D5CF6A62EC11F9D0BBD17CDAC64A0BEBB23425033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 93d6be40923874833fdd576db84c08aa6e1349c56d8db2c36e7bc57b997b506d
MD5 d45d9e49d7707e6bc7b9636bda318a3c
SHA1 65e95f50c43b9b7212967a7f09100dd67cc563dd
SHA512 e68833311ac7646dc4b08030d41a4c409e2a20e99252eada4a6831ff5da0491187b37f979e5acad8afea06094cae9ddbc9ffe8f9bdb6ddd578e1802290a273c8
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fkcsx0UvW/tOs01e4ZCT1m/UNKJdcw/p:SNc/zEOVHFrsx0WW/Yc1mwM+wB
TLSH
T108858C1623E901E4F5BBE1BE897B9546FAB1786517308ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 20997cd261f3916270bd8ae0a1cda6fac1cfd26825525be52058ef126e14c3b9
MD5 11e0c6fdad68bd60761dd1be617d3f30
SHA1 0de1261826cf761494ca22e1550369e5ccecde5b
SHA512 e22ec5176fc34f857401f2276d3a589ac7f74d5f569c1985d9c2c491b2b2d5dce2d4837e9e1f48689de833009ccd45f07a3740e6a6f126f482be817306afe4ad
SSDEEP 24576:LJnJPbzB4SSsx0UvW/tOs01e4ZCT1m/UNKJdcw/p:LJnJv6SSsx0WW/Yc1mwM+wB
TLSH
T13715E03DC2A810E8E4B7D2B4815A1656FF71387D2F2269CB19B4D4353F12EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 938e5fdff0a2d3dede498a57e535be6178e580636fd176a12e1e349db39ae192
MD5 1c6c8cbf125278deea0e27f502f991a0
SHA1 1b2b5ca7270eaf246e61e2167e763f4cce25c922
SHA512 11a151e5ad2ee839277ba6f55e51c75612188f4e1d3aff41b94c29be664e6ba34b5e097b3715a00eab101d94aef0032a102c06fb16917d52636b75f3e02870c4
SSDEEP 24576:i6DIxsx0UvW/tOs01e4ZCT1m/UNKJdcw/p:i6DIxsx0WW/Yc1mwM+wB
TLSH
T11805011D237A11F9D067A03DC5970513D2F2B2B2872229DF0AA4C5BA4EA3EDDF93D941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 94878ab756f72e80df367a3113494ebb4f346c364238737f36690a8005fbbd9b
MD5 a984db8f96cabc91521ce690a4fe915d
SHA1 3ad38cc64e960f3ed7712e8da83a88565c96193f
SHA512 3f306e2ee9f62a88c978252358641fd911af98aa204037f2a6904b1a6c9cef00d67f2c604727fd6e0bcd7db6e27f30202e813c2823a473f82c40b2af945b4ed7
SSDEEP 12288:kG6ky7/UxvhuU5Y0WHfPhC+OsjIKdmmH/wQR2Cvrn8om/UNKJkiXxKw/x+XK:1ty7sx0UvW/tOs01e4ZCT1m/UNKJdcwB
TLSH
T155F4120143A81198F4B32174997B41A3CBBABE725F2262DF05E1E23F0F767E5E931A15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 312fb664610ccc14bcacb1788ca1d5bb9137f8c435a35c75b3c2eb46b9193427
MD5 b1995d344b7c2517210e6c72f8b1eb51
SHA1 ef56cdf01970ae50766a5921979bc7c937b71cd8
SHA512 1c2e47f740dc369a473a152c2bf9ea25967b7f45e8f20e9cd928ab921ed964ecbde1eb24e7e0572264a5becdae335d20e2d82d14c22d7e3b6f213c3462b1245f
SSDEEP 12288:Cvx/UxvhuU5Y0WHfPhC+OsjIKdmmH/wQR2Cvrn8om/UNKJkiXxKw/x+XK:Oxsx0UvW/tOs01e4ZCT1m/UNKJdcw/p
TLSH
T1D8D4231146B81269E45330B4A97E09A3C2FA77F71F1331EF09F2D1B682AB5EBC576814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-13-0x000002806FB40000-0x000002806FBA6000-memory.dmp

Download

memory/1268-14-0x000002806FB40000-0x000002806FBA6000-memory.dmp

Download

memory/1268-12-0x000002806FB40000-0x000002806FBA6000-memory.dmp

Download

memory/1268-11-0x00007FF7EEE70000-0x00007FF7EEF93000-memory.dmp

Download

memory/1268-61-0x00007FF7EEE70000-0x00007FF7EEF93000-memory.dmp

Download

memory/1508-55-0x000001DBD0730000-0x000001DBD0857000-memory.dmp

Download

memory/1508-56-0x000001DBD0660000-0x000001DBD06C6000-memory.dmp

Download

memory/1508-57-0x000001DBD0660000-0x000001DBD06C6000-memory.dmp

Download

memory/1700-337-0x00007FF7C7760000-0x00007FF7C7A81000-memory.dmp

Download

memory/1700-338-0x000001F850870000-0x000001F8508D6000-memory.dmp

Download

memory/1700-340-0x000001F850870000-0x000001F8508D6000-memory.dmp

Download

memory/2040-233-0x000002D0C84A0000-0x000002D0C8506000-memory.dmp

Download

memory/2040-317-0x00007FF6DC240000-0x00007FF6DC309000-memory.dmp

Download

memory/2040-234-0x000002D0C84A0000-0x000002D0C8506000-memory.dmp

Download

memory/2040-232-0x00007FF6DC240000-0x00007FF6DC309000-memory.dmp

Download

memory/2812-301-0x0000016B1A420000-0x0000016B1A486000-memory.dmp

Download

memory/2812-299-0x0000016B1A420000-0x0000016B1A486000-memory.dmp

Download

memory/2812-300-0x00007FF7C5C00000-0x00007FF7C6017000-memory.dmp

Download

memory/3480-243-0x0000014204B80000-0x0000014204BE6000-memory.dmp

Download

memory/3480-241-0x00007FF6DC240000-0x00007FF6DC309000-memory.dmp

Download

memory/3480-242-0x0000014204B80000-0x0000014204BE6000-memory.dmp

Download

memory/3480-327-0x00007FF6DC240000-0x00007FF6DC309000-memory.dmp

Download

memory/3624-311-0x000001FD73660000-0x000001FD736C6000-memory.dmp

Download

memory/3624-310-0x000001FD73660000-0x000001FD736C6000-memory.dmp

Download

memory/3624-309-0x00007FF76F450000-0x00007FF76F504000-memory.dmp

Download

memory/4108-329-0x0000020E50F90000-0x0000020E50FF6000-memory.dmp

Download

memory/4108-330-0x0000020E50F90000-0x0000020E50FF6000-memory.dmp

Download

memory/4108-328-0x00007FF6CDBC0000-0x00007FF6CDD55000-memory.dmp

Download

memory/4152-52-0x00007FF7D7490000-0x00007FF7D75F8000-memory.dmp

Download

memory/4152-44-0x000002331CE00000-0x000002331CE66000-memory.dmp

Download

memory/4152-43-0x00007FF7D7490000-0x00007FF7D75F8000-memory.dmp

Download

memory/4152-45-0x000002331CE00000-0x000002331CE66000-memory.dmp

Download

memory/4152-50-0x000002331CE00000-0x000002331CE66000-memory.dmp

Download

memory/4512-0-0x00007FF668580000-0x00007FF6686A0000-memory.dmp

Download

memory/4512-3-0x0000016445A40000-0x0000016445AA6000-memory.dmp

Download

memory/4512-2-0x0000016445A40000-0x0000016445AA6000-memory.dmp

Download

memory/4512-19-0x0000016445A40000-0x0000016445AA6000-memory.dmp

Download

memory/4512-1-0x0000016445A40000-0x0000016445AA6000-memory.dmp

Download

memory/4512-22-0x00007FF668580000-0x00007FF6686A0000-memory.dmp

Download

memory/4664-276-0x00000000009F0000-0x0000000000A59000-memory.dmp

Download

memory/4664-271-0x00000000009F0000-0x0000000000A59000-memory.dmp

Download

memory/4664-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4716-37-0x000001D1666F0000-0x000001D166756000-memory.dmp

Download

memory/4716-35-0x000001D1666F0000-0x000001D166756000-memory.dmp

Download

memory/4716-36-0x000001D1666F0000-0x000001D166756000-memory.dmp

Download

memory/4716-34-0x000001D1664A0000-0x000001D1665C7000-memory.dmp

Download

memory/4748-26-0x0000016C62C80000-0x0000016C62CE6000-memory.dmp

Download

memory/4748-25-0x0000016C62A80000-0x0000016C62BA7000-memory.dmp

Download

memory/4748-27-0x0000016C62C80000-0x0000016C62CE6000-memory.dmp

Download

memory/4748-28-0x0000016C62C80000-0x0000016C62CE6000-memory.dmp

Download

memory/5028-251-0x000001CD24B00000-0x000001CD24B66000-memory.dmp

Download

memory/5028-336-0x00007FF7A3D60000-0x00007FF7A3E7A000-memory.dmp

Download

memory/5028-250-0x000001CD24B00000-0x000001CD24B66000-memory.dmp

Download

memory/5028-249-0x00007FF7A3D60000-0x00007FF7A3E7A000-memory.dmp

Download

memory/5096-261-0x00007FF7293B0000-0x00007FF7294FA000-memory.dmp

Download

memory/5096-263-0x00000233C7F80000-0x00000233C7FE6000-memory.dmp

Download

memory/5096-264-0x00000233C7F80000-0x00000233C7FE6000-memory.dmp

Download

memory/5260-282-0x000001D8AC0A0000-0x000001D8AC106000-memory.dmp

Download

memory/5260-284-0x00007FF638B50000-0x00007FF639294000-memory.dmp

Download

memory/5260-283-0x000001D8AC0A0000-0x000001D8AC106000-memory.dmp

Download

memory/5320-321-0x000001E987EA0000-0x000001E987F06000-memory.dmp

Download

memory/5320-319-0x00007FF7D87A0000-0x00007FF7D8A43000-memory.dmp

Download

memory/5320-320-0x000001E987EA0000-0x000001E987F06000-memory.dmp

Download

memory/5848-292-0x0000027BA41B0000-0x0000027BA4216000-memory.dmp

Download

memory/5848-291-0x0000027BA41B0000-0x0000027BA4216000-memory.dmp

Download

memory/5848-290-0x00007FF6686A0000-0x00007FF66874E000-memory.dmp

Download