svcstealer | 7a077d84bc19099d4a17ea2d3bd75dce5b72a6be46906cb78ba6ca0a8334d946

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar.exe
Size 6.8MB
Sample260808-epqysszejd
SHA256 7a077d84bc19099d4a17ea2d3bd75dce5b72a6be46906cb78ba6ca0a8334d946
MD5 121531cb07077f91defeea5bbe43f436
SHA1 0373723b8887656b5e2bc1a8730a3e37c70765f0
SHA512 dcd4c7404b4ba920c7d5968e8399520290f47c161a5641aa8f9b8cc339bfce37680cf487997b19c37664462e7969871769a2bb711bc351646ae4e5fa3b7d0f97
SSDEEP 196608:GeIDlS1qqxmDwUpBpeme1fDlS1qqEmDwUpBpem6+ZBhgD7IRF:/duDHLe31g9DHLeLuBrF
TLSH
T16966332EB66B71C5C6EAE23CAC35026047BE7616150B6E1B42FA5133BC7B0513D2DC9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader execution svcstealer persistence privilege_escalation spyware stealer vmprotect

Malware Config

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://62.60.226.232/bioxp/post.php

Attributes

build_id
SlLoaded
srv_delay
1
srv_retry
1

Signatures

Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects SvcStealer Payload 2 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/files/0x000f000000019c8f-4.dat	family_svcstealer
behavioral2/files/0x000c00000001c511-20.dat	family_svcstealer

Detect binaries embedding considerable number of MFA browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x000f000000019c8f-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/files/0x000c00000001c511-20.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x000f000000019c8f-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/files/0x000c00000001c511-20.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/4376-21-0x000001ECF2DA0000-0x000001ECF2DA2000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000f000000019c8f-4.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x000c00000001c511-20.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000f000000019c8f-4.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/files/0x000c00000001c511-20.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing common artifacts observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000f000000019c8f-4.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x000c00000001c511-20.dat	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables packed with NETProtect.IO 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c514-77.dat	INDICATOR_EXE_Packed_NETProtectIO
behavioral2/memory/4316-84-0x00000000007E0000-0x00000000008E4000-memory.dmp	INDICATOR_EXE_Packed_NETProtectIO

Detects executables packed with VMProtect. 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c514-77.dat	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4316-84-0x00000000007E0000-0x00000000008E4000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Detects executables referencing many IR and analysis tools 2 IoCs

resource	yara_rule
behavioral2/files/0x000f000000019c8f-4.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000c00000001c511-20.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs

resource	yara_rule
behavioral2/files/0x000f000000019c8f-4.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/files/0x000c00000001c511-20.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	4844	explorer.exe

Executes dropped EXE 13 IoCs

pid	Process
268	ob6yarc1.exe
4392	0ptknb2t.exe
4632	d8zbuwga.exe
3864	fqe170xf.exe
4248	rhnfabb1.exe
2616	wlrmdr.exe
2808	f7obt0s6.exe
4316	Credit Card Gen & Checker.exe
5096	audiodgueb.exe
5816	f7obt0s6.exe
2900	93BA.tmp.exe
1764	A1EB.tmp.exe
3356	A1EB.tmp.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000d00000001c514-77.dat	vmprotect
behavioral2/memory/4316-84-0x00000000007E0000-0x00000000008E4000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\audiodgueb.exe"	fqe170xf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f7obt0s6.exe"	f7obt0s6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f7obt0s6.exe"	f7obt0s6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Security Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A1EB.tmp.exe"	A1EB.tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 4376	2808	f7obt0s6.exe	59
PID 5816 set thread context of 4376	5816	f7obt0s6.exe	59

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4480	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5308	4316	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Credit Card Gen & Checker.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
4392	0ptknb2t.exe
4392	0ptknb2t.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe
268	ob6yarc1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4844	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeDebugPrivilege	4316	Credit Card Gen & Checker.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 268	4260	2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar.exe	89
PID 4260 wrote to memory of 4392	4260	2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar.exe	90
PID 4392 wrote to memory of 4376	4392	0ptknb2t.exe	59
PID 4392 wrote to memory of 4432	4392	0ptknb2t.exe	60
PID 4392 wrote to memory of 4980	4392	0ptknb2t.exe	64
PID 4392 wrote to memory of 5192	4392	0ptknb2t.exe	66
PID 4392 wrote to memory of 1508	4392	0ptknb2t.exe	80
PID 4392 wrote to memory of 4844	4392	0ptknb2t.exe	81
PID 4844 wrote to memory of 3532	4844	explorer.exe
PID 4260 wrote to memory of 4632	4260	2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar.exe	92
PID 4260 wrote to memory of 3864	4260	2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar.exe	94
PID 4260 wrote to memory of 4248	4260	2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar.exe	95
PID 4248 wrote to memory of 4844	4248	rhnfabb1.exe	81
PID 4260 wrote to memory of 2808	4260	2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar.exe	97
PID 4260 wrote to memory of 4316	4260	2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar.exe	98
PID 2808 wrote to memory of 4376	2808	f7obt0s6.exe	59
PID 4844 wrote to memory of 4304	4844	explorer.exe
PID 4844 wrote to memory of 2436	4844	explorer.exe
PID 5816 wrote to memory of 4376	5816	f7obt0s6.exe	59
PID 4844 wrote to memory of 2900	4844	explorer.exe	103
PID 268 wrote to memory of 2612	268	ob6yarc1.exe	105
PID 268 wrote to memory of 2612	268	ob6yarc1.exe	105
PID 268 wrote to memory of 1232	268	ob6yarc1.exe	108
PID 268 wrote to memory of 1232	268	ob6yarc1.exe	108
PID 268 wrote to memory of 4480	268	ob6yarc1.exe	109
PID 4480 wrote to memory of 2848	4480	cmd.exe	111
PID 4844 wrote to memory of 1764	4844	explorer.exe	115
PID 4844 wrote to memory of 4448	4844	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4432

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000268;000000000000026C;
1⤵
PID:4980

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5192

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1508
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Downloads MZ/PE file
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Users\Admin\AppData\Local\Temp\2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_121531cb07077f91defeea5bbe43f436_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\ob6yarc1.exe
      "C:\Users\Admin\AppData\Local\Temp\ob6yarc1.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        5⤵
        
        PID:2612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        5⤵
        
        PID:1232
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4480
      - C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\0ptknb2t.exe
      "C:\Users\Admin\AppData\Local\Temp\0ptknb2t.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\d8zbuwga.exe
      "C:\Users\Admin\AppData\Local\Temp\d8zbuwga.exe"
      4⤵
      Executes dropped EXE
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\fqe170xf.exe
      "C:\Users\Admin\AppData\Local\Temp\fqe170xf.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\rhnfabb1.exe
      "C:\Users\Admin\AppData\Local\Temp\rhnfabb1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\f7obt0s6.exe
      "C:\Users\Admin\AppData\Local\Temp\f7obt0s6.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Credit Card Gen & Checker.exe
      "C:\Users\Admin\AppData\Local\Temp\Credit Card Gen & Checker.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 1656
        5⤵
        Program crash
        
        PID:5308
- - C:\Users\Admin\AppData\Local\Temp\93BA.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\93BA.tmp.exe
    3⤵
    - Executes dropped EXE
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\A1EB.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\A1EB.tmp.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1764

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Users\Admin\AppData\Roaming\audiodgueb.exe
C:\Users\Admin\AppData\Roaming\audiodgueb.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Users\Admin\AppData\Local\Temp\f7obt0s6.exe
C:\Users\Admin\AppData\Local\Temp\f7obt0s6.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4316 -ip 4316
1⤵
PID:3632

C:\Users\Admin\AppData\Local\Temp\A1EB.tmp.exe
C:\Users\Admin\AppData\Local\Temp\A1EB.tmp.exe
1⤵
- Executes dropped EXE
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0ptknb2t.exe

Path C:\Users\Admin\AppData\Local\Temp\0ptknb2t.exe
Size 54KB
SHA256 91cbdb753f45ed138804ddcb73c426731144e75ff1508c179bb3110f7501990f
MD5 1ce59def164888b52e1d4061267113b4
SHA1 b0d5c0a072ae723aa297fae28499f9ccc717b5fd
SHA512 3a1d24967bfc3ea3d87be120e0d1879b5ebc08869259808fbaa6d3979bad9314144843a5d5a15dc8bc85d3e2ce584bbde45cf7db42f952c068e52beb6481ee4e
SSDEEP 1536:Iq8p1bFQi53lcrl3+XfJ9a/gDsJSxY+ghmbAu:4b3lW3+XfKXJZu
TLSH
T1B8432A3777928277CC968A38DBB9533BC174F642A620921F73A5CA0F3F939497518D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93BA.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\93BA.tmp.exe
Size 166KB
SHA256 3ea66df0155ad39a658607c9eb1e035f0f8dd12dd75cc69725bdb15b73a4e5d4
MD5 878daa2275262e2d5a124d997b8f3f22
SHA1 91322a927c535b04513eb255d1238039d994b133
SHA512 a2e0473d4d5a0cb8baee3b77df636e436a3637524bd8bd3d453baad9a0c2079569241e38b6f32f46ec0c235a5b19750bae5d4695cfce181a42aafe109e7553ce
SSDEEP 3072:XtJ2fCsQiuzYJ8WreWgxgjIFaphDCMfCv6vHXrbl5STd:XwCszCYJ8OcgsaBB
TLSH
T192F37D4A73E510FDE1778239C9551A45F372782207209BAF07A047BA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A1EB.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\A1EB.tmp.exe
Size 120KB
SHA256 32b173a4a2bbc767d93bd6c645170479f1d3eb27f9ae5b47c9260ec31f739bf7
MD5 842b09509ab819c1e7edecd41d4c301b
SHA1 38efdf62dfb36898c662bb912c0e76d79e8836bf
SHA512 aa3ecddb8af12b6970fccd5106406f86bf55656193b0683da17b23ce47d3abe4cd7e64c4377206664709678f338c338d5e0ba44b193cb38b34113ea33ec29e6a
SSDEEP 1536:HlyFwDCtFe20zYrnw5p15i8VOTypRxn2KXdTY+sWLdP9dldGOIJ:HlyFPtv0kTwDxUepRx2KG6vbGOI
TLSH
T1C2C36B1777A530F8E17B823589215A16E7B378310B758B6F03A4426A6F277D09E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Credit Card Gen & Checker.exe

Path C:\Users\Admin\AppData\Local\Temp\Credit Card Gen & Checker.exe
Size 693KB
SHA256 b1fec85f2708e55f07e6301f8ac4f61457d8b5706dc72705d89a9001ee90ca5d
MD5 6f14dcfb307f4f9d9fe04c277f9e6e73
SHA1 c1b3cf0ee07b96678b27f546a914cd4501c11b25
SHA512 8ef3c25434c004c2cdf3f07e4e632b42feb180ed740d34f4b5506ee0d387b12bbf0c34ce63250f64fef62de94843ec8a20e62887db0647d06818555b39ce9d80
SSDEEP 6144:RaygbSvoQ1X55LSv1Ic38IdAVT5z+i8gPXR1r2qC4mSTN+jjeyRLq:4SvRX55Lm1LsLzEg5xC4BSE
TLSH
T1B0E46B32A2BC916BCA907378AC1960519EAD7F1FB7478E3B30797F95E930050DF091A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8zbuwga.exe

Path C:\Users\Admin\AppData\Local\Temp\d8zbuwga.exe
Size 2.3MB
SHA256 14219a41f1e1b3d5a3081e8b3369f5ef05fe41bba5b9fd08b98b18bbdab1ecf3
MD5 522bf8d9520bb7d3948c594d0f4252d3
SHA1 b86c3ed2d3c98c3faa4dea5ed807c5f67d1f2373
SHA512 129c00a425d975ad9b3157c15ba2c8f246efabdad0d87640d67be6431588fbc4dccb04bdae2ccddafd5feb3dbf2f2c4bf1b18d04162bdea96c06bd4cb269de45
SSDEEP 49152:BL2n/GN8i6JmPXcj/R2Z3Au/PJvTs6WBC:lC/Ra/54
TLSH
T1DEB59E4AA3A802FDE0FBD274C9165A07D7B2B8461674D79F13D0479A2F23B715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7obt0s6.exe

Path C:\Users\Admin\AppData\Local\Temp\f7obt0s6.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fqe170xf.exe

Path C:\Users\Admin\AppData\Local\Temp\fqe170xf.exe
Size 166KB
SHA256 982eead72a720efc097bdf415d06e9b97f213d6f6ecce5b2bbef1125af1e2217
MD5 78d1e706beb5a1794e08db0475b47e6e
SHA1 e28b7241c83ee13a68b23b3e04e10d0780eec012
SHA512 273ba8cc545a6f2964ad53d6659f20be59e2fce834ce43137e9fa66cd3f7272be800c2b8ae2ade21acf13a3ed26d2aa7c6f39aa2d9275305c884e87094e09513
SSDEEP 3072:ltJ2fCsQiuzYJ8WreWgxgjIFafthDCMfCv4vHXrbl5STd:lwCszCYJ8OcgsaffB
TLSH
T1DEF37D4A73E510FDE1778139C9551A05F372782207209BAF07A047BA9F272E1AD3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ob6yarc1.exe

Path C:\Users\Admin\AppData\Local\Temp\ob6yarc1.exe
Size 2.3MB
SHA256 4574a15398111c257404062f40e2a04caa2327d4af1fddead63feda4ed0cb228
MD5 37c620993d1b2b5997a61060d9173620
SHA1 025f9a051c4c7208a5dc13d64494e25985206fa1
SHA512 68a26aa8a97ef4429bfbbb80e74e886be1962fddf0f92c44a7c2af75409db4f337381954cc103a6954625590ee11b42edb9c6b8a1ca41dea861651c28e6c0d44
SSDEEP 49152:hK2n/GN8i6JmPXcjUR2Z3Au/PJvTs6yBC:6CURa/54
TLSH
T16CB59E4AA3A802FDE0FBD274C9165A07D7B2B8461674D79F13D0479A2F23B715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rhnfabb1.exe

Path C:\Users\Admin\AppData\Local\Temp\rhnfabb1.exe
Size 88KB
SHA256 bdf4942298bd77738d50c80d53174b5c01dbb7f0e7460a15c10c6fb18a9f8b95
MD5 747d123b5acc9e6fecb3c9a40dc15c5d
SHA1 27360c2017b2100774542f9f8af6ebab237c7968
SHA512 f0504049aef498d384e0c4ba5086663c565f09c37388474ba32325c04dfc8199debcca4cd827ea3e588eca7f2cbfc814c1eb263f50e2e676edfb579811f52304
SSDEEP 1536:00GygBsWhz/TuMTYirB7lth/y21aFlCLeCPKBBNUhSTXPjFuiJBKHBbUcumUZxaI:00GHxhUidltxzyxnBB6IXPAinKHBbUcQ
TLSH
T15F93BE2A23A414F4D96ED539C9B1CA27E6F3B8451516431F03B8D9A61F63722B23FB07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4248-69-0x00007FF6E5300000-0x00007FF6E531E000-memory.dmp

Download

memory/4248-60-0x00007FF6E5300000-0x00007FF6E531E000-memory.dmp

Download

memory/4316-94-0x00000000069C0000-0x0000000006F7A000-memory.dmp

Download

memory/4316-100-0x0000000006540000-0x0000000006596000-memory.dmp

Download

memory/4316-99-0x0000000006400000-0x000000000640A000-memory.dmp

Download

memory/4316-95-0x00000000064A0000-0x0000000006532000-memory.dmp

Download

memory/4316-84-0x00000000007E0000-0x00000000008E4000-memory.dmp

Download

memory/4316-93-0x0000000006360000-0x00000000063FC000-memory.dmp

Download

memory/4316-92-0x0000000002C60000-0x0000000002CC6000-memory.dmp

Download

memory/4376-82-0x000001ECF4210000-0x000001ECF4242000-memory.dmp

Download

memory/4376-21-0x000001ECF2DA0000-0x000001ECF2DA2000-memory.dmp

Download

memory/4376-113-0x000001ECF42C0000-0x000001ECF42F1000-memory.dmp

Download

memory/4844-64-0x0000000001170000-0x0000000001195000-memory.dmp

Download

memory/4844-90-0x0000000001170000-0x0000000001195000-memory.dmp

Download

memory/4844-86-0x0000000003A20000-0x0000000003A21000-memory.dmp

Download

memory/4844-40-0x0000000001150000-0x0000000001151000-memory.dmp

Download

memory/4844-88-0x0000000001170000-0x0000000001195000-memory.dmp

Download

memory/4844-85-0x0000000002B40000-0x0000000002B41000-memory.dmp

Download

memory/4844-63-0x0000000001170000-0x0000000001195000-memory.dmp

Download

memory/4844-87-0x0000000001170000-0x0000000001195000-memory.dmp

Download

memory/4844-117-0x0000000001170000-0x0000000001195000-memory.dmp

Download

memory/4844-119-0x0000000001170000-0x0000000001195000-memory.dmp

Download

memory/4844-89-0x0000000001170000-0x0000000001195000-memory.dmp

Download

memory/4844-129-0x0000000001130000-0x0000000001131000-memory.dmp

Download

memory/4980-35-0x0000000180000000-0x0000000180005000-memory.dmp

Download