svcstealer | 459a8ae8e6a7ed1ca5557ac1fe19a3490d043d62ca7bc9b4191d99dfcdccf652

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe
Size 16.4MB
Sample260808-c9q37abc72
SHA256 459a8ae8e6a7ed1ca5557ac1fe19a3490d043d62ca7bc9b4191d99dfcdccf652
MD5 c18c3548f8a279761baac2d66c22b518
SHA1 d9c12972fb88b93657d326d4a7afd546acb9f7b3
SHA512 ee395d1d05d63347521731788bd2fee18f9d881106d61746787599dcbcedc9393a56c85547666c46128995cac0be5a079bab978d1cf4e9090194971b247f801e
SSDEEP 393216:jT/ksT/jYk/aMlL8uClD6zVzlhOqBDyIu:jT8sT7PYuCd6zVz7Tu
TLSH
T1B307334BD3BD63CAF29417BAE27C6A945BF2AD0614B0973825CC8E593EA38554C3F305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader execution svcstealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://62.60.226.232/bioxp/post.php

Attributes

build_id
SlLoaded
srv_delay
1
srv_retry
1

Signatures

Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects SvcStealer Payload 2 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral1/files/0x00080000000242e0-4.dat	family_svcstealer
behavioral1/files/0x00070000000242e5-23.dat	family_svcstealer

Detect binaries embedding considerable number of MFA browser extension IDs. 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242e0-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral1/files/0x00070000000242e5-23.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242e0-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/files/0x00070000000242e5-23.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral1/memory/2976-53-0x000001AA3A4D0000-0x000001AA3A4D2000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242e0-4.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/files/0x00070000000242e5-23.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242e0-4.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/files/0x00070000000242e5-23.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing common artifacts observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242e0-4.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral1/files/0x00070000000242e5-23.dat	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables referencing many IR and analysis tools 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242e0-4.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x00070000000242e5-23.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242e0-4.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/files/0x00070000000242e5-23.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe

Executes dropped EXE 10 IoCs

pid	Process
1840	tvlvqb71.exe
2948	subo7lgu.exe
4708	8vc634hy.exe
3844	swon5qut.exe
4892	m08wdufx.exe
1384	50sq7owb.exe
4996	AntiPub_Checker.exe
1984	msedgeupdateswg.exe
2904	wlrmdr.exe
984	50sq7owb.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\msedgeupdateswg.exe"	swon5qut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\50sq7owb.exe"	50sq7owb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\50sq7owb.exe"	50sq7owb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1384 set thread context of 3656	1384	50sq7owb.exe	60
PID 984 set thread context of 3656	984	50sq7owb.exe	60

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4104	cmd.exe
2732	cmd.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	AntiPub_Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	AntiPub_Checker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	AntiPub_Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	AntiPub_Checker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	AntiPub_Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	AntiPub_Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	AntiPub_Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AntiPub_Checker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AntiPub_Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	AntiPub_Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AntiPub_Checker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	AntiPub_Checker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	AntiPub_Checker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	AntiPub_Checker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	AntiPub_Checker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	AntiPub_Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	AntiPub_Checker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	AntiPub_Checker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	AntiPub_Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AntiPub_Checker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
4892	m08wdufx.exe
4892	m08wdufx.exe
2948	subo7lgu.exe
2948	subo7lgu.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe
1840	tvlvqb71.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4996	AntiPub_Checker.exe
3152	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3656	RuntimeBroker.exe
Token: SeShutdownPrivilege	3656	RuntimeBroker.exe
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4996	AntiPub_Checker.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1840	3540	2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe	83
PID 3540 wrote to memory of 2948	3540	2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe	84
PID 3540 wrote to memory of 4708	3540	2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe	85
PID 3540 wrote to memory of 3844	3540	2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe	86
PID 3540 wrote to memory of 4892	3540	2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe	87
PID 4892 wrote to memory of 3152	4892	m08wdufx.exe	56
PID 2948 wrote to memory of 2976	2948	subo7lgu.exe	51
PID 2948 wrote to memory of 3040	2948	subo7lgu.exe	53
PID 2948 wrote to memory of 3152	2948	subo7lgu.exe	56
PID 2948 wrote to memory of 3656	2948	subo7lgu.exe	60
PID 2948 wrote to memory of 3912	2948	subo7lgu.exe	62
PID 3540 wrote to memory of 1384	3540	2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe	88
PID 3152 wrote to memory of 3644	3152	Explorer.EXE
PID 3152 wrote to memory of 1872	3152	Explorer.EXE
PID 3540 wrote to memory of 4996	3540	2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe	91
PID 4996 wrote to memory of 4104	4996	AntiPub_Checker.exe	96
PID 4104 wrote to memory of 4880	4104	cmd.exe	98
PID 3152 wrote to memory of 3052	3152	Explorer.EXE
PID 1384 wrote to memory of 3656	1384	50sq7owb.exe	60
PID 984 wrote to memory of 3656	984	50sq7owb.exe	60
PID 1840 wrote to memory of 996	1840	tvlvqb71.exe	107
PID 1840 wrote to memory of 996	1840	tvlvqb71.exe	107
PID 1840 wrote to memory of 1248	1840	tvlvqb71.exe	110
PID 1840 wrote to memory of 1248	1840	tvlvqb71.exe	110
PID 1840 wrote to memory of 2732	1840	tvlvqb71.exe	111
PID 2732 wrote to memory of 4340	2732	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2976

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3040

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_c18c3548f8a279761baac2d66c22b518_cobalt-strike_icedid_satacom_vidar.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Users\Admin\AppData\Local\Temp\tvlvqb71.exe
    "C:\Users\Admin\AppData\Local\Temp\tvlvqb71.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
      4⤵
      PID:1248
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4340
- - C:\Users\Admin\AppData\Local\Temp\subo7lgu.exe
    "C:\Users\Admin\AppData\Local\Temp\subo7lgu.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\8vc634hy.exe
    "C:\Users\Admin\AppData\Local\Temp\8vc634hy.exe"
    3⤵
    - Executes dropped EXE
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\swon5qut.exe
    "C:\Users\Admin\AppData\Local\Temp\swon5qut.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\m08wdufx.exe
    "C:\Users\Admin\AppData\Local\Temp\m08wdufx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\50sq7owb.exe
    "C:\Users\Admin\AppData\Local\Temp\50sq7owb.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1384
- - C:\Users\Admin\AppData\Local\Temp\AntiPub_Checker.exe
    "C:\Users\Admin\AppData\Local\Temp\AntiPub_Checker.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\cmd.exe
      cmd /C "mode con: cols=120 lines=38"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4104
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=38
        5⤵
        
        PID:4880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3912

C:\Users\Admin\AppData\Roaming\msedgeupdateswg.exe
C:\Users\Admin\AppData\Roaming\msedgeupdateswg.exe
1⤵
- Executes dropped EXE
PID:1984

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:2904

C:\Users\Admin\AppData\Local\Temp\50sq7owb.exe
C:\Users\Admin\AppData\Local\Temp\50sq7owb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

50sq7owb.exe

Path C:\Users\Admin\AppData\Local\Temp\50sq7owb.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8vc634hy.exe

Path C:\Users\Admin\AppData\Local\Temp\8vc634hy.exe
Size 2.3MB
SHA256 14219a41f1e1b3d5a3081e8b3369f5ef05fe41bba5b9fd08b98b18bbdab1ecf3
MD5 522bf8d9520bb7d3948c594d0f4252d3
SHA1 b86c3ed2d3c98c3faa4dea5ed807c5f67d1f2373
SHA512 129c00a425d975ad9b3157c15ba2c8f246efabdad0d87640d67be6431588fbc4dccb04bdae2ccddafd5feb3dbf2f2c4bf1b18d04162bdea96c06bd4cb269de45
SSDEEP 49152:BL2n/GN8i6JmPXcj/R2Z3Au/PJvTs6WBC:lC/Ra/54
TLSH
T1DEB59E4AA3A802FDE0FBD274C9165A07D7B2B8461674D79F13D0479A2F23B715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AntiPub_Checker.exe

Path C:\Users\Admin\AppData\Local\Temp\AntiPub_Checker.exe
Size 10.3MB
SHA256 62b325c5a6ca0565dc58e62c5d3a0e6f7feb946ef0e1ce2ea2f4b2755ad7a022
MD5 e3c21cda7f60957ec0a3eca85c2397ca
SHA1 3b8ef028739caa1c39ba2fecc1fd3b6c4c6934a3
SHA512 d18c62a946913094c35a32f1feb2a25b096bd7ef58141b6ad4636fc5ad4c01bfd4b06ccda7b3a256cb2c2daadee00deadd64a50c8944d4857689ef9c82e7276e
SSDEEP 98304:7R5toWutR0NK8m4okrZw58HE1AnbyUtfEQ:7NeMhn/8
TLSH
T1C2B64947EDA505E9C4AEC530CAA692637B717C884B3067D72B60F7246F32BE06E79350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\dia_abe_240727593\Chrome\Default\cookies.json
Size 338B
SHA256 dec13b26f4288d16e3037e4a228e22ba45fec19ea5d62ad5f43a649cfabca4be
MD5 14900e13def9e3e4b6f774f3c1e73fda
SHA1 c2462864f0aed69d452ed729af4e2386361ae48e
SHA512 93564ce71f30644aacdbf103462b0953fc6cca32a589963d310babb74d84f679334e70e19118786f605fe0830d318a6743631a7259345e46bc353aa824094b85
TLSH
T10BE0C08D1E9A5817CC835D955E18CE55BB6A325168E1DC5202A0E4042E14F151294053
MD5 SHA1 SHA512 TLSH

Submit Download

m08wdufx.exe

Path C:\Users\Admin\AppData\Local\Temp\m08wdufx.exe
Size 88KB
SHA256 bdf4942298bd77738d50c80d53174b5c01dbb7f0e7460a15c10c6fb18a9f8b95
MD5 747d123b5acc9e6fecb3c9a40dc15c5d
SHA1 27360c2017b2100774542f9f8af6ebab237c7968
SHA512 f0504049aef498d384e0c4ba5086663c565f09c37388474ba32325c04dfc8199debcca4cd827ea3e588eca7f2cbfc814c1eb263f50e2e676edfb579811f52304
SSDEEP 1536:00GygBsWhz/TuMTYirB7lth/y21aFlCLeCPKBBNUhSTXPjFuiJBKHBbUcumUZxaI:00GHxhUidltxzyxnBB6IXPAinKHBbUcQ
TLSH
T15F93BE2A23A414F4D96ED539C9B1CA27E6F3B8451516431F03B8D9A61F63722B23FB07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

subo7lgu.exe

Path C:\Users\Admin\AppData\Local\Temp\subo7lgu.exe
Size 54KB
SHA256 91cbdb753f45ed138804ddcb73c426731144e75ff1508c179bb3110f7501990f
MD5 1ce59def164888b52e1d4061267113b4
SHA1 b0d5c0a072ae723aa297fae28499f9ccc717b5fd
SHA512 3a1d24967bfc3ea3d87be120e0d1879b5ebc08869259808fbaa6d3979bad9314144843a5d5a15dc8bc85d3e2ce584bbde45cf7db42f952c068e52beb6481ee4e
SSDEEP 1536:Iq8p1bFQi53lcrl3+XfJ9a/gDsJSxY+ghmbAu:4b3lW3+XfKXJZu
TLSH
T1B8432A3777928277CC968A38DBB9533BC174F642A620921F73A5CA0F3F939497518D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swon5qut.exe

Path C:\Users\Admin\AppData\Local\Temp\swon5qut.exe
Size 166KB
SHA256 982eead72a720efc097bdf415d06e9b97f213d6f6ecce5b2bbef1125af1e2217
MD5 78d1e706beb5a1794e08db0475b47e6e
SHA1 e28b7241c83ee13a68b23b3e04e10d0780eec012
SHA512 273ba8cc545a6f2964ad53d6659f20be59e2fce834ce43137e9fa66cd3f7272be800c2b8ae2ade21acf13a3ed26d2aa7c6f39aa2d9275305c884e87094e09513
SSDEEP 3072:ltJ2fCsQiuzYJ8WreWgxgjIFafthDCMfCv4vHXrbl5STd:lwCszCYJ8OcgsaffB
TLSH
T1DEF37D4A73E510FDE1778139C9551A05F372782207209BAF07A047BA9F272E1AD3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tvlvqb71.exe

Path C:\Users\Admin\AppData\Local\Temp\tvlvqb71.exe
Size 2.3MB
SHA256 4574a15398111c257404062f40e2a04caa2327d4af1fddead63feda4ed0cb228
MD5 37c620993d1b2b5997a61060d9173620
SHA1 025f9a051c4c7208a5dc13d64494e25985206fa1
SHA512 68a26aa8a97ef4429bfbbb80e74e886be1962fddf0f92c44a7c2af75409db4f337381954cc103a6954625590ee11b42edb9c6b8a1ca41dea861651c28e6c0d44
SSDEEP 49152:hK2n/GN8i6JmPXcjUR2Z3Au/PJvTs6yBC:6CURa/54
TLSH
T16CB59E4AA3A802FDE0FBD274C9165A07D7B2B8461674D79F13D0479A2F23B715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2976-53-0x000001AA3A4D0000-0x000001AA3A4D2000-memory.dmp

Download

memory/3152-75-0x00000000034B0000-0x00000000034D5000-memory.dmp

Download

memory/3152-100-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/3152-76-0x00000000034B0000-0x00000000034D5000-memory.dmp

Download

memory/3152-78-0x0000000003500000-0x0000000003501000-memory.dmp

Download

memory/3152-74-0x00000000034B0000-0x00000000034D5000-memory.dmp

Download

memory/3152-73-0x00000000034B0000-0x00000000034D5000-memory.dmp

Download

memory/3152-72-0x00000000034F0000-0x00000000034F1000-memory.dmp

Download

memory/3152-113-0x00000000034B0000-0x00000000034D5000-memory.dmp

Download

memory/3152-50-0x00000000034B0000-0x00000000034D5000-memory.dmp

Download

memory/3152-49-0x00000000034B0000-0x00000000034D5000-memory.dmp

Download

memory/3152-77-0x00000000034B0000-0x00000000034D5000-memory.dmp

Download

memory/3152-56-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/3656-102-0x000001B41D990000-0x000001B41D9C2000-memory.dmp

Download

memory/3656-111-0x000001B41F950000-0x000001B41F981000-memory.dmp

Download

memory/4892-52-0x00007FF686E10000-0x00007FF686E2E000-memory.dmp

Download