Analysis
- max time kernel
150s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 03:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-15_df6a195aa1eb1190c8285e3cc0ae6180_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_df6a195aa1eb1190c8285e3cc0ae6180_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-08-15_df6a195aa1eb1190c8285e3cc0ae6180_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe
- Size 75.3MB
- Sample260815-dn5vwsxfnd
- SHA256 e495f4c299d627420d5fe7fd8b07fef23dc9814b0e118b80f55036b5470812e3
- MD5 df6a195aa1eb1190c8285e3cc0ae6180
- SHA1 046644e6aeca294e5b34208fde1fba7f464d7c92
- SHA512 fbed3f5c3df4f3495a087c8da9a5e1551ef3e4ae698c5f2c256de4694ce288d95efb62e76d17e97b3398b888ff6a905a01753904384bbb9b6cfb171316636335
- SSDEEP 393216:cGDTToR7N6AzwamVw5Z8vU0v/GIseP2dcaCad4IGZ3dpGRtOIUc9l5lZmYCWDpg7:nDwZ8ZALDtOBc9pDaUV5OtsFitaMoa
- TLSH T10308BF15B3E80A16D67FC27CC2639112E6F1B4530352C7CF0559EA992F63BC1AB3B266
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 15 IoCs
resource yara_rule behavioral2/memory/2816-9-0x0000000000930000-0x000000000156D000-memory.dmp family_salatstealer behavioral2/memory/2816-10-0x0000000000930000-0x000000000156D000-memory.dmp family_salatstealer behavioral2/memory/2816-11-0x0000000000930000-0x000000000156D000-memory.dmp family_salatstealer behavioral2/memory/2816-24-0x0000000000930000-0x000000000156D000-memory.dmp family_salatstealer behavioral2/memory/2632-25-0x00000000002A0000-0x0000000000EDD000-memory.dmp family_salatstealer behavioral2/memory/2632-26-0x00000000002A0000-0x0000000000EDD000-memory.dmp family_salatstealer behavioral2/memory/4476-44-0x0000000000D70000-0x00000000019AD000-memory.dmp family_salatstealer behavioral2/memory/2632-57-0x00000000002A0000-0x0000000000EDD000-memory.dmp family_salatstealer behavioral2/memory/2632-61-0x00000000002A0000-0x0000000000EDD000-memory.dmp family_salatstealer behavioral2/memory/2632-62-0x00000000002A0000-0x0000000000EDD000-memory.dmp family_salatstealer behavioral2/memory/2632-63-0x00000000002A0000-0x0000000000EDD000-memory.dmp family_salatstealer behavioral2/memory/2632-64-0x00000000002A0000-0x0000000000EDD000-memory.dmp family_salatstealer behavioral2/memory/2632-65-0x00000000002A0000-0x0000000000EDD000-memory.dmp family_salatstealer behavioral2/memory/2632-66-0x00000000002A0000-0x0000000000EDD000-memory.dmp family_salatstealer behavioral2/memory/2632-67-0x00000000002A0000-0x0000000000EDD000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 15 IoCs
resource yara_rule behavioral2/memory/2816-9-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2816-10-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2816-11-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2816-24-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2632-25-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2632-26-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4476-44-0x0000000000D70000-0x00000000019AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2632-57-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2632-61-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2632-62-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2632-63-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2632-64-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2632-65-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2632-66-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2632-67-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 15 IoCs
resource yara_rule behavioral2/memory/2816-9-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2816-10-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2816-11-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2816-24-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2632-25-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2632-26-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4476-44-0x0000000000D70000-0x00000000019AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2632-57-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2632-61-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2632-62-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2632-63-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2632-64-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2632-65-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2632-66-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2632-67-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 15 IoCs
resource yara_rule behavioral2/memory/2816-9-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2816-10-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2816-11-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2816-24-0x0000000000930000-0x000000000156D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2632-25-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2632-26-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4476-44-0x0000000000D70000-0x00000000019AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2632-57-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2632-61-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2632-62-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2632-63-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2632-64-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2632-65-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2632-66-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2632-67-0x00000000002A0000-0x0000000000EDD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral2/files/0x000d00000001c594-4.dat UPX behavioral2/memory/2816-8-0x0000000000930000-0x000000000156D000-memory.dmp UPX behavioral2/memory/2816-9-0x0000000000930000-0x000000000156D000-memory.dmp UPX behavioral2/memory/2816-10-0x0000000000930000-0x000000000156D000-memory.dmp UPX behavioral2/memory/2816-11-0x0000000000930000-0x000000000156D000-memory.dmp UPX behavioral2/memory/2632-23-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX behavioral2/memory/2816-24-0x0000000000930000-0x000000000156D000-memory.dmp UPX behavioral2/memory/2632-25-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX behavioral2/memory/2632-26-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX behavioral2/memory/4476-33-0x0000000000D70000-0x00000000019AD000-memory.dmp UPX behavioral2/memory/4476-44-0x0000000000D70000-0x00000000019AD000-memory.dmp UPX behavioral2/memory/2632-57-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX behavioral2/memory/2632-61-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX behavioral2/memory/2632-62-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX behavioral2/memory/2632-63-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX behavioral2/memory/2632-64-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX behavioral2/memory/2632-65-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX behavioral2/memory/2632-66-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX behavioral2/memory/2632-67-0x00000000002A0000-0x0000000000EDD000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 2816 recovered.exe 2632 WUDFHost.exe 4476 WUDFHost.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
resource yara_rule behavioral2/files/0x000d00000001c594-4.dat upx behavioral2/memory/2816-8-0x0000000000930000-0x000000000156D000-memory.dmp upx behavioral2/memory/2816-9-0x0000000000930000-0x000000000156D000-memory.dmp upx behavioral2/memory/2816-10-0x0000000000930000-0x000000000156D000-memory.dmp upx behavioral2/memory/2816-11-0x0000000000930000-0x000000000156D000-memory.dmp upx behavioral2/memory/2632-23-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx behavioral2/memory/2816-24-0x0000000000930000-0x000000000156D000-memory.dmp upx behavioral2/memory/2632-25-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx behavioral2/memory/2632-26-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx behavioral2/memory/4476-33-0x0000000000D70000-0x00000000019AD000-memory.dmp upx behavioral2/memory/4476-44-0x0000000000D70000-0x00000000019AD000-memory.dmp upx behavioral2/memory/2632-57-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx behavioral2/memory/2632-61-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx behavioral2/memory/2632-62-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx behavioral2/memory/2632-63-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx behavioral2/memory/2632-64-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx behavioral2/memory/2632-65-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx behavioral2/memory/2632-66-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx behavioral2/memory/2632-67-0x00000000002A0000-0x0000000000EDD000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\WUDFHost.exe recovered.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe WUDFHost.exe File opened for modification C:\Program Files (x86)\Internet Explorer\4bf68746-2402-c1a1-1af1-f53dd53e4624 recovered.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUDFHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language recovered.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUDFHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 2816 recovered.exe 2816 recovered.exe 2816 recovered.exe 2816 recovered.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 5232 powershell.exe 5232 powershell.exe 5232 powershell.exe 4476 WUDFHost.exe 4476 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe 2632 WUDFHost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5232 powershell.exe Token: SeDebugPrivilege 2632 WUDFHost.exe Token: SeIncreaseQuotaPrivilege 5232 powershell.exe Token: SeSecurityPrivilege 5232 powershell.exe Token: SeTakeOwnershipPrivilege 5232 powershell.exe Token: SeLoadDriverPrivilege 5232 powershell.exe Token: SeSystemProfilePrivilege 5232 powershell.exe Token: SeSystemtimePrivilege 5232 powershell.exe Token: SeProfSingleProcessPrivilege 5232 powershell.exe Token: SeIncBasePriorityPrivilege 5232 powershell.exe Token: SeCreatePagefilePrivilege 5232 powershell.exe Token: SeBackupPrivilege 5232 powershell.exe Token: SeRestorePrivilege 5232 powershell.exe Token: SeShutdownPrivilege 5232 powershell.exe Token: SeDebugPrivilege 5232 powershell.exe Token: SeSystemEnvironmentPrivilege 5232 powershell.exe Token: SeRemoteShutdownPrivilege 5232 powershell.exe Token: SeUndockPrivilege 5232 powershell.exe Token: SeManageVolumePrivilege 5232 powershell.exe Token: 33 5232 powershell.exe Token: 34 5232 powershell.exe Token: 35 5232 powershell.exe Token: 36 5232 powershell.exe Token: SeIncreaseQuotaPrivilege 5232 powershell.exe Token: SeSecurityPrivilege 5232 powershell.exe Token: SeTakeOwnershipPrivilege 5232 powershell.exe Token: SeLoadDriverPrivilege 5232 powershell.exe Token: SeSystemProfilePrivilege 5232 powershell.exe Token: SeSystemtimePrivilege 5232 powershell.exe Token: SeProfSingleProcessPrivilege 5232 powershell.exe Token: SeIncBasePriorityPrivilege 5232 powershell.exe Token: SeCreatePagefilePrivilege 5232 powershell.exe Token: SeBackupPrivilege 5232 powershell.exe Token: SeRestorePrivilege 5232 powershell.exe Token: SeShutdownPrivilege 5232 powershell.exe Token: SeDebugPrivilege 5232 powershell.exe Token: SeSystemEnvironmentPrivilege 5232 powershell.exe Token: SeRemoteShutdownPrivilege 5232 powershell.exe Token: SeUndockPrivilege 5232 powershell.exe Token: SeManageVolumePrivilege 5232 powershell.exe Token: 33 5232 powershell.exe Token: 34 5232 powershell.exe Token: 35 5232 powershell.exe Token: 36 5232 powershell.exe Token: SeIncreaseQuotaPrivilege 5232 powershell.exe Token: SeSecurityPrivilege 5232 powershell.exe Token: SeTakeOwnershipPrivilege 5232 powershell.exe Token: SeLoadDriverPrivilege 5232 powershell.exe Token: SeSystemProfilePrivilege 5232 powershell.exe Token: SeSystemtimePrivilege 5232 powershell.exe Token: SeProfSingleProcessPrivilege 5232 powershell.exe Token: SeIncBasePriorityPrivilege 5232 powershell.exe Token: SeCreatePagefilePrivilege 5232 powershell.exe Token: SeBackupPrivilege 5232 powershell.exe Token: SeRestorePrivilege 5232 powershell.exe Token: SeShutdownPrivilege 5232 powershell.exe Token: SeDebugPrivilege 5232 powershell.exe Token: SeSystemEnvironmentPrivilege 5232 powershell.exe Token: SeRemoteShutdownPrivilege 5232 powershell.exe Token: SeUndockPrivilege 5232 powershell.exe Token: SeManageVolumePrivilege 5232 powershell.exe Token: 33 5232 powershell.exe Token: 34 5232 powershell.exe Token: 35 5232 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5576 wrote to memory of 2816 5576 2026-08-15_df6a195aa1eb1190c8285e3cc0ae6180_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe 90 PID 2816 wrote to memory of 2632 2816 recovered.exe 93 PID 2632 wrote to memory of 5232 2632 WUDFHost.exe 94 PID 2632 wrote to memory of 4476 2632 WUDFHost.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_df6a195aa1eb1190c8285e3cc0ae6180_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_df6a195aa1eb1190c8285e3cc0ae6180_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\recovered.exe"C:\Users\Admin\AppData\Local\Temp\recovered.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Internet Explorer\WUDFHost.exe"C:\Program Files (x86)\Internet Explorer\WUDFHost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4476
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\recovered.exe
- Size 3.4MB
- SHA256 a33d2d78ac46d0d6996200b6cb0ccf41677019dd3b0fa5bd91454caff2730e2f
- MD5 b1849e847b4f8119d008a73d740c7d47
- SHA1 a6913c4db3a4b6893b344a03d674bd4d393dd139
- SHA512 4b894a53a3200fe1f0a88a53df7c52a15ab42a9a4b4f9c94a549409bc98e423b0e7f2b912cd596e14cccbe55632f5d2c71f6c1068bd79b0b53af6740d20be412
- SSDEEP 98304:Er+0L4MdYlFa97x2TU2k0tu3uv44hjm351/:mpdd8a99k2e3+51
- TLSH T108F53305DACCF503EF3A78356A466AE76189D3A431F661E0976D6BBBACA4DC0D103F10
- MD5 SHA1 SHA512 SSDEEP TLSH